License API reference

All endpoints live under /api/v1 and accept/return JSON. Errors use machine-readable codes: invalid_key, seat_limit_reached, license_expired, license_revoked, invalid_site_url, rate_limited.

POST /api/v1/licenses/activate

{ "key": "MDK-XXXX-XXXX-XXXX-XXXX", "site_url": "https://example.com" }

Claims a seat for the site. Re-activating from the same site is idempotent. Site URLs are normalized (scheme, www., trailing slashes ignored) so the same install never counts twice.

POST /api/v1/licenses/deactivate

Frees the seat for that site. Safe to call repeatedly.

POST /api/v1/licenses/validate

Read-only status check. The plugin caches the response for 12 hours and tolerates 14 days of server unreachability before degrading.

GET /api/v1/updates/manifest?key=...

Update metadata for the WordPress updater. Valid licenses get a short-lived download URL; expired ones see the release notes and a renewal notice.