License and capabilities
The platform license is the commercial entitlement that makes this deployment legal and functional. It names the customer, the installation, the licensed products and modules, and (when reported) quota usage. Capabilities are what operators see and can turn on because of that entitlement: which protocol products appear in the rail, whether multi-instance issuer is allowed, whether sub-tenant management is on, and which options appear when you onboard a tenant.
These are not the same thing:
- The license is a signed platform artifact managed under Resources > License (platform tenant only).
- Capabilities are the runtime effect of that license (and product defaults) on the console and APIs. A missing module often means a rail entry is locked or hidden, not a blank form.
Audience: platform operator.
Prerequisites: platform management access (active tenant is the platform tenant). Initial license install is usually part of enterprise deployment. This guide covers review, contact maintenance, request generation, and bundle import after the platform is already running.
Reference: Current license, Contacts and request, Import license.
APIs: Platform Admin (/application/license), Platform Setup (license-management request and import).
How the license shapes the console
When the operator session loads, the console resolves a deployment context from the application license (and product bootstrap): enabled protocol services, resource products, instance caps, and tenant scope. That context decides:
| Effect | If the license (or product profile) allows it | If it does not |
|---|---|---|
| Protocol rail (Authorization Server, Issuer, Verifier) | Surface is open for tenant configuration | Surface is locked or omitted |
| Instance caps | Create instance stays available until the quota is reached | Create is disabled when used equals limit |
| Sub-tenant management | L1 Tenants list and Register tenant | Operator stays on a single tenant scope |
| Resource products (KMS, Secrets, Status Lists, ...) | Shown when licensed for this deployment | Hidden or locked |
Tenant registration capabilities (credential issuer, presentation verifier, keys and DIDs, sample data) are chosen per tenant during onboarding. They cannot invent modules the platform license does not allow. If issuer is not licensed, checking Issuer on the wizard will not produce a usable issuer later.
Quota numbers on the Current license page (for example max root tenants) explain why a Create action is greyed out even though the rail still shows the product.
Current license
Platform-only. Switch the tenant picker to the platform management tenant, then open License.
You see overall status (for example Active), expiry and days remaining, installation id, customer id, and issuer. Licensed products list each product and edition, optional modules (for example oid4vci, oid4vp), and quota projections when the backend reports them. The signing certificate fingerprint identifies the trust material used for the entitlement; operators copy it for support, not as a password.
Warnings appear when renewal is near or the projection reports a problem. Fix those before they become an outage: generate a request, obtain a new bundle, import it.
Navigation: Resources > License > Current license (platform tenant)
Deep link: #tenant=platform&resource=license&rarea=overview
- Admin Console
- REST API
Platform Admin on the platform origin:
- Overview
- Request
- Response
Get application license
Endpoint: GET /api/platform/admin/v1/application/license
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Contacts and license request
When you need a new or renewed license from the license provider, the platform builds a signed request that includes organization and contact data. Private keys for the request stay on this platform; you send only the signed JSON (and CSR material) outward.
Organization name, unit, base domains, and location fields are often read-only after first setup (organization renames may require a later product release). Technical contact and administrative contact are editable. Use Same as technical contact when one person covers both roles.
Save contacts persists the draft without generating a request. Generate license request creates the signed artifact: request id, CSR fingerprint, signature algorithm, and downloadable JSON. Deliver that file to the license provider through your commercial channel. Keep the private keys local; never paste them into tickets.
Navigation: Resources > License > Contacts & request
Deep link: #tenant=platform&resource=license&rarea=request
- Admin Console
- REST API
Load draft:
- Overview
- Request
- Response
Get license request draft
Endpoint: GET /api/platform/setup/v1/license-management/request
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Generate signed request:
- Overview
- Request
- Response
Generate signed license request
Endpoint: POST /api/platform/setup/v1/license-management/request/generate
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Import license
The license provider returns a protected ZIP bundle. Import is two-step so you can see overwrite impact before the platform applies it.
- Choose the ZIP (size limit applies; typically up to 50 MB).
- Preview contents inspects the bundle: recipient private key present or not, platform certificate, license root CA, customer party info, and a list of files.
- Read Will overwrite. Import replaces the active license and can replace security material listed there.
- Acknowledge the impact, then Import and activate.
After a successful import, return to Current license and confirm status, expiry, and modules. Then re-check tenant onboarding and any instance Create actions that were blocked by quotas.
Do not import a bundle meant for a different installation id or customer. Wrong recipient key material fails import or leaves the platform unable to prove entitlement.
Navigation: Resources > License > Import license
Deep link: #tenant=platform&resource=license&rarea=import
- Admin Console
- REST API
Preview and import use Platform Setup multipart endpoints under /license-management/import (and /preview). Prefer the console for operator workflows; automate only with the same preview-then-import sequence and operator credentials. See Platform Setup API.
Capabilities during tenant onboarding
When you register a tenant, the Capabilities step chooses what that tenant should receive on provision: credential issuer, presentation verifier, automatic keys and DIDs, sample data. Those flags are tenant provisioning choices constrained by the platform license.
| Capability on the wizard | Consequence if enabled | If disabled |
|---|---|---|
| Credential issuer | Issuer instance and OID4VCI paths for the tenant | No issuer product for that tenant until you add it later (if licensed) |
| Presentation verifier | Verifier instance and OID4VP paths | No verifier until added later |
| Keys and DIDs | Product-managed KMS and DID material during setup | Empty Key Management / DID until operators create them |
| Sample data | Lab designs, playground clients, demo fixtures | Clean tenant without sample catalog noise |
Use sample data for labs and demos. Avoid it for production customer tenants unless your product standard requires it.
Recommended order of work
- Confirm Current license is Active and expiry is acceptable.
- Keep contacts current before a commercial renewal cycle.
- Generate a request, send it to the license provider, import the returned bundle.
- Re-check rail products and instance Create affordances.
- Onboard tenants with capability flags that match the renewed modules.
After license and capabilities
- Onboard a tenant under the modules you licensed
- Secrets and KMS providers when credential stores must move or be shared
- Keys and DID for key and identifier lifecycle