Licence

The licence endpoint is what premium GroupeZ plugins call at start-up to ask whether they are allowed to run.

On the current platform (v2), IP-bound licences no longer exist. There is no licence table, no licence model and no licence management screen. The route is kept only because plugins already installed on servers call it when they start and refuse to boot without a positive answer.

For the legacy behaviour, with key lookup, unique_id check and IP allow-list, see the v1 licence page.

Common behaviourCopy Anchor Link

These rules come from the /api/v1 route group and apply to this endpoint:

• Base URL: https://groupez.dev/api/v1/
• No session, no CSRF, no cookies: the route uses the api middleware group, not web. A X-CSRF-TOKEN / X-XSRF-TOKEN header or a session cookie is ignored, and no Set-Cookie is ever returned.
• Version header: every answer carries X-GroupeZ-Api-Version: 1. This includes 404, 405 and 429 answers, which get the header from the exception handler in bootstrap/app.php.
• JSON errors: errors on api/* are always rendered as JSON. The Accept header does not change this.

POST /api/v1/licence/{key}Copy Anchor Link

Checks a licence key. On v2 the answer is a constant.

Path parametersCopy Anchor Link

Query / body parametersCopy Anchor Link

None are read. On v1 the plugin sent a unique_id body field. You can still send it, but v2 ignores it, along with any other body field and any query string.

ResponsesCopy Anchor Link

200 OK: returned for every key.

{
    "status": "success",
    "message": "The license is valid"
}

Headers include Content-Type: application/json and X-GroupeZ-Api-Version: 1.

429 Too Many Requests: one of the limiters was exceeded.

{
    "message": "Too many requests."
}

The body is fixed by bootstrap/app.php. It replaces the framework's Too Many Attempts. and never includes a stack trace. The response keeps the throttle headers Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset when the throttle set them. When the per-key window (60/min) is exhausted, X-RateLimit-Limit is 60.

404 Not Found: the URI does not match the route, for example POST /api/v1/licence with no key, or a key that contains a /.

{
    "message": "Not found."
}

405 Method Not Allowed: any method other than POST, for example GET /api/v1/licence/ABC. The body is the framework's default JSON for a MethodNotAllowedHttpException, built by the router from the request path:

{
    "message": "The GET method is not supported for route api/v1/licence/ABC. Supported methods: POST."
}

Unlike 404 and 429, the platform does not normalise this body, so do not depend on its exact text. With APP_DEBUG on, the framework would also add exception, file, line and trace keys. The X-GroupeZ-Api-Version: 1 header is still set.

This endpoint never returns 401, 403 or 422. It has no authentication, no authorisation and no validation.

ExampleCopy Anchor Link

curl -X POST "https://groupez.dev/api/v1/licence/aB3dE5fG7hI9jK1" \
  -H "Accept: application/json" \
  -d "unique_id=GROUPEZ_0123456789abcde"

{"status":"success","message":"The license is valid"}

NotesCopy Anchor Link

• Rate limiting. Two limiters apply in sequence: the group-wide api limiter (120/min, keyed on the IP since no user is authenticated) and the route's own licence limiter (60/min keyed on {key}, and 240/min keyed on the IP). In practice the api limiter caps a single IP at 120/min before the 240/min ceiling of licence is reached. Because one limit is keyed per key, a plugin retrying in a loop with one key cannot exhaust the endpoint for other keys behind other IPs. The limiters protect the web server, not a database.
• Migrating plugins. A plugin that treats status == "success" as "allowed" keeps booting on v2. A plugin that previously handled status == "error" answers will never see one from v2.
• Source files: routes/api.php, app/Http/Controllers/Api/V1/CheckLicenceController.php, app/Providers/RateLimitServiceProvider.php, bootstrap/app.php. Behaviour is pinned by tests/Feature/Api/V1/LicenceCheckTest.php, ApiRateLimitTest.php, ApiRoutingTest.php, ApiRoutingOrderTest.php and ApiSessionlessTest.php.