Hanzo
OpenapiLicensing

Publishes a signed binary release, answering 201 Created.

Publishes a signed binary release, answering 201 Created.

POST /v1/licensing/releases

Addresshttps://api.hanzo.ai/v1/licensing/releases
MethodPOST
Operationpost_licensing_releases
AuthAuthorization: Bearer $HANZO_API_KEY

Publishes a signed binary release, answering 201 Created.

Outside dev a release MUST carry its cosign signature: this is how a binary becomes downloadable, so accepting an unsigned one would let an unverifiable artifact into the distribution path. Org-admin only — publishing is an operator action, not something a licensee does.

Request

12 fields, body application/json (required).

FieldInTypeRequiredDescription
app_idbodystringAppID scopes the release to an app build ("hanzo" | "lux" | "zoo").
artifact_refbodystringArtifactRef is where the binary lives (object-store key / OCI ref / path).
cosign_certbodystringCosignCert is the cosign/Fulcio cert (keyless) or public key ref used to verify CosignSignature.
cosign_signaturebodystringCosignSignature is the base64 cosign signature over the artifact digest.
created_atbodyinteger
idbodystringID is the release identifier, e.g. "engine-rocm-0.4.2-linux-amd64".
min_featuresbodystring[]MinFeatures, when set, are features the license must include to download.
platformbodystringPlatform is "<os>/<arch>", e.g.
productbodystringProduct is the licensed product this artifact belongs to (commerce SKU): "engine" for every one of those builds.
sha256bodystringSHA256 is the hex digest of the artifact (integrity + cosign subject).
versionbodystringVersion is the semantic version of the binary.
yankedbodybooleanYanked marks a pulled release (download refused; tokens may be revoked release-scoped too).

Response

StatusBodyMeaning
201licensing.Releasecreated

201 body — 12 fields.

FieldInTypeAlwaysDescription
app_idbodystringAppID scopes the release to an app build ("hanzo" | "lux" | "zoo").
artifact_refbodystringArtifactRef is where the binary lives (object-store key / OCI ref / path).
cosign_certbodystringCosignCert is the cosign/Fulcio cert (keyless) or public key ref used to verify CosignSignature.
cosign_signaturebodystringCosignSignature is the base64 cosign signature over the artifact digest.
created_atbodyinteger
idbodystringID is the release identifier, e.g. "engine-rocm-0.4.2-linux-amd64".
min_featuresbodystring[]MinFeatures, when set, are features the license must include to download.
platformbodystringPlatform is "<os>/<arch>", e.g.
productbodystringProduct is the licensed product this artifact belongs to (commerce SKU): "engine" for every one of those builds.
sha256bodystringSHA256 is the hex digest of the artifact (integrity + cosign subject).
versionbodystringVersion is the semantic version of the binary.
yankedbodybooleanYanked marks a pulled release (download refused; tokens may be revoked release-scoped too).

Failure carries the platform error shape — see Errors.

Examples

hanzo licensing releases create

Licensing API · All Hanzo APIs · Interactive reference

How is this guide?

On this page