License verification

Operations of the License API. Paths are relative to your deployment's API host.

GET /api/license-api/.well-known/xema-license-keys.json

Publish the Ed25519 license verification key(s).

Public, unauthenticated and cacheable. Clients embed ALL of these keys to verify a license OFFLINE. Rotation is additive and the array is the mechanism, not a formality: a new kid appears here FIRST and both coexist across the rollover, because a verifier must know a key before the signer uses it, and an air-gapped box may not see a new build for weeks. The key currently being ISSUED under is always the first entry. Embedding only one key is what breaks at the next rotation.

Authentication: none