Verify checks a license token online: signature, schema, expiry, app_id and the…
Verify checks a license token online: signature, schema, expiry, app_id and the revocation list.
POST /v1/licensing/verify
| Address | https://api.hanzo.ai/v1/licensing/verify |
| Method | POST |
| Operation | post_licensing_verify |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Verify checks a license token online: signature, schema, expiry, app_id and the revocation list.
It is UNAUTHENTICATED and always answers 200 — a bad token is valid:false
with a reason rather than an error status, because "is this token good" is a
question anyone may ask about a credential they already hold and the answer is
the same either way. It is also OPTIONAL: the engine verifies OFFLINE against
the published public key (GET /v1/licensing/pubkey) and needs this endpoint
only to learn about revocation, so an outage here never stops a paid customer
working.
Request
2 fields, body application/json (required).
| Field | In | Type | Required | Description |
|---|---|---|---|---|
app | body | string | — | App overrides the app_id the token is expected to carry. |
token | body | string | yes | Token is the license token to check. |
Response
| Status | Body | Meaning |
|---|---|---|
200 | licensing.VerifyResponse | ok |
200 body — 9 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
app_id | body | string | — | AppID is the brand the token runs under. |
exp | body | integer | — | Exp is the token's expiry, Unix seconds. |
features | body | string[] | — | Features are the capability grants the token carries. |
fingerprint_bound | body | boolean | — | Bound reports that the token carries a device binding. |
holder | body | string | — | Holder is who the token was issued to. |
nonce | body | string | — | Nonce uniquely identifies the token. |
reason | body | string | — | Reason says why an invalid token was rejected. |
revoked | body | boolean | — | Revoked reports that the signature was good but the token has been revoked. |
valid | body | boolean | — | Valid is the single answer: signature, schema, expiry, app and revocation all passed. |
Failure carries the platform error shape — see Errors.
Examples
hanzo licensing verify --token <token>import { Configuration, LicensingApi } from 'hanzoai';
const api = new LicensingApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postLicensingVerify({ token: "<token>" });from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import LicensingApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = LicensingApi(client).post_licensing_verify(token="<token>")cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.LicensingAPI.PostLicensingVerify(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, licensing_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = licensing_api::post_licensing_verify(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.LicensingApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new LicensingApi(client).postLicensingVerify();curl -X POST https://api.hanzo.ai/v1/licensing/verify \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"token": "<token>"
}'The door reaches licensing through the licensing tool, which names its 11 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "get_licensing_download"
}
}
}'How is this guide?