API overview
| Base URL | https://api.sunlicense.com |
| Format | JSON over HTTPS |
| Versioning | In the path (/api/v1/…); /api/v2/license/validate is the SDK endpoint |
Authentication
There are two kinds of credentials, for two different jobs:
| Credential | Where you get it | Works on |
|---|---|---|
API key (slk_…) | Dashboard → API keys | Validation API only. Safe to ship inside your app: it cannot read or change licenses |
| Session token (JWT) | POST /api/v1/auth/login | Management API, with the permissions of your role |
Send either as Authorization: Bearer <token>.
Errors
Errors use RFC 9457 problem details:
json
{ "type": "about:blank", "title": "Forbidden", "status": 403, "detail": "Your Free plan allows 1 products. Upgrade to add more." }| Status | Meaning |
|---|---|
| 400 | Invalid request (on /api/v2/license/validate: license rejected) |
| 401 | Missing, invalid or expired credentials |
| 403 | Your role lacks the permission, or your plan does not include it |
| 404 | Not found (also for resources that belong to another organization) |
| 409 | Conflict, for example reinstating a revoked license |
| 429 | Rate limited (20 requests/second per API key, bursts of 40) |
| 503 | Temporarily unavailable; use the offline license |
Health
GET /api/v1/system/health (no authentication) returns each component's status. The public status page is status.sunlicense.com.