OpenapiLicensing
Publishes a signed binary release, answering 201 Created.
Publishes a signed binary release, answering 201 Created.
POST /v1/licensing/releases
| Address | https://api.hanzo.ai/v1/licensing/releases |
| Method | POST |
| Operation | post_licensing_releases |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Publishes a signed binary release, answering 201 Created.
Outside dev a release MUST carry its cosign signature: this is how a binary becomes downloadable, so accepting an unsigned one would let an unverifiable artifact into the distribution path. Org-admin only — publishing is an operator action, not something a licensee does.
Request
12 fields, body application/json (required).
| Field | In | Type | Required | Description |
|---|---|---|---|---|
app_id | body | string | — | AppID scopes the release to an app build ("hanzo" | "lux" | "zoo"). |
artifact_ref | body | string | — | ArtifactRef is where the binary lives (object-store key / OCI ref / path). |
cosign_cert | body | string | — | CosignCert is the cosign/Fulcio cert (keyless) or public key ref used to verify CosignSignature. |
cosign_signature | body | string | — | CosignSignature is the base64 cosign signature over the artifact digest. |
created_at | body | integer | — | |
id | body | string | — | ID is the release identifier, e.g. "engine-rocm-0.4.2-linux-amd64". |
min_features | body | string[] | — | MinFeatures, when set, are features the license must include to download. |
platform | body | string | — | Platform is "<os>/<arch>", e.g. |
product | body | string | — | Product is the licensed product this artifact belongs to (commerce SKU): "engine" for every one of those builds. |
sha256 | body | string | — | SHA256 is the hex digest of the artifact (integrity + cosign subject). |
version | body | string | — | Version is the semantic version of the binary. |
yanked | body | boolean | — | Yanked marks a pulled release (download refused; tokens may be revoked release-scoped too). |
Response
| Status | Body | Meaning |
|---|---|---|
201 | licensing.Release | created |
201 body — 12 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
app_id | body | string | — | AppID scopes the release to an app build ("hanzo" | "lux" | "zoo"). |
artifact_ref | body | string | — | ArtifactRef is where the binary lives (object-store key / OCI ref / path). |
cosign_cert | body | string | — | CosignCert is the cosign/Fulcio cert (keyless) or public key ref used to verify CosignSignature. |
cosign_signature | body | string | — | CosignSignature is the base64 cosign signature over the artifact digest. |
created_at | body | integer | — | |
id | body | string | — | ID is the release identifier, e.g. "engine-rocm-0.4.2-linux-amd64". |
min_features | body | string[] | — | MinFeatures, when set, are features the license must include to download. |
platform | body | string | — | Platform is "<os>/<arch>", e.g. |
product | body | string | — | Product is the licensed product this artifact belongs to (commerce SKU): "engine" for every one of those builds. |
sha256 | body | string | — | SHA256 is the hex digest of the artifact (integrity + cosign subject). |
version | body | string | — | Version is the semantic version of the binary. |
yanked | body | boolean | — | Yanked marks a pulled release (download refused; tokens may be revoked release-scoped too). |
Failure carries the platform error shape — see Errors.
Examples
hanzo licensing releases createimport { Configuration, LicensingApi } from 'hanzoai';
const api = new LicensingApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postLicensingReleases({ app_id: "<app_id>", artifact_ref: "<artifact_ref>" });from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import LicensingApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = LicensingApi(client).post_licensing_releases(app_id="<app_id>", artifact_ref="<artifact_ref>")cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.LicensingAPI.PostLicensingReleases(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, licensing_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = licensing_api::post_licensing_releases(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.LicensingApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new LicensingApi(client).postLicensingReleases();curl -X POST https://api.hanzo.ai/v1/licensing/releases \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"app_id": "<app_id>",
"artifact_ref": "<artifact_ref>"
}'The door reaches licensing through the licensing tool, which names its 11 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "get_licensing_download"
}
}
}'How is this guide?