Developers
Licence and entitlement API
These endpoints are what the WordPress plugin will use to activate, check its entitlement, and download the site's approved fix rules.
Key format
Keys use the prefix AA followed by four groups of four characters. Ambiguous characters (0, O, 1, I, L) are excluded. Keys are case-insensitive.
AA-XXXX-XXXX-XXXX-XXXX
Validate a licence key
POST/api/public/licence/validate
Checks a key's status and entitlements. Pass site_url to also confirm the key belongs to that domain.
Request
curl -X POST https://your-app-domain/api/public/licence/validate \
-H "Content-Type: application/json" \
-d '{"key":"AA-XXXX-XXXX-XXXX-XXXX","site_url":"https://example.com"}'Example response
{
"valid": true,
"status": "active",
"tier": "pro-5",
"sites_allowed": 5,
"site_url": "https://example.com",
"domain_match": true,
"activated": true
}| 200 | Key active (and domain matches, if given) |
| 400 | Malformed key or body |
| 403 | Key revoked or domain mismatch — see error |
| 404 | Unknown key |
Register a site against a key
POST/api/public/licence/register
Called by the plugin on activation. Binds the WordPress install to the key; site_url must match the domain registered in the dashboard (www. is ignored).
Request
curl -X POST https://your-app-domain/api/public/licence/register \
-H "Content-Type: application/json" \
-d '{"key":"AA-XXXX-XXXX-XXXX-XXXX","site_url":"https://www.example.com"}'Example response
{
"ok": true,
"site_url": "https://example.com",
"tier": "pro-5",
"sites_allowed": 5,
"activated_at": "2026-01-01T12:00:00.000Z"
}| 200 | Registered (idempotent) |
| 403 | revoked or domain_mismatch |
| 404 | Unknown key |
Revoke a key
POST/api/public/licence/revoke
Owner-only. Requires the account owner's signed-in session as a Bearer token. Owners can also revoke and reissue keys from the dashboard.
Request
curl -X POST https://your-app-domain/api/public/licence/revoke \
-H "Authorization: Bearer <owner session token>" \
-H "Content-Type: application/json" \
-d '{"key":"AA-XXXX-XXXX-XXXX-XXXX"}'Example response
{
"ok": true,
"status": "revoked"
}| 200 | Revoked |
| 401 | Missing or invalid owner session |
| 404 | Key not found for this account |
Fetch the active rule set
GET/api/public/licence/rules
Polled by the plugin. Returns the latest published rule-set version for the key's site, filtered to the rule types the account's plan allows. Send the key in the X-Licence-Key header.
Request
curl https://your-app-domain/api/public/licence/rules \
-H "X-Licence-Key: AA-XXXX-XXXX-XXXX-XXXX"
Example response
{
"site_url": "https://example.com",
"tier": "pro-5",
"version": 4,
"published_at": "2026-01-01T12:00:00.000Z",
"rules": [
{
"id": "6f1c…",
"fix_type": "alt_text",
"selector": "img[src=\"/logo.png\"]",
"attribute": "alt",
"value": "Company logo",
"url_pattern": "*"
}
]
}| 200 | Rule set (may be empty, version 0 if never published) |
| 403 | Key revoked |
| 404 | Unknown key |
Try validation
Paste a key from your dashboard.
