Release this installation device seat.
What you will learn
- Send this exact operation with its required credentials and fields.
- Interpret success, refusal, side effects and retry risks.
Prerequisites
- Complete the Sandbox quickstart.
- Read API conventions and authentication.
- Keep customer credentials private and management keys on your trusted backend.
Method and path
POST /api/v1/licenses/deactivate
When to use it
Release this installation's active device seat when the user signs out or transfers the license to another device. Only the installation activation token is required.
Authentication and environment
Use Authorization: Bearer YOUR_ACTIVATION_TOKEN. The token fixes the installation/product/environment; X-Environment cannot override it.
Request headers
| Header | Required | Description | Example |
|---|---|---|---|
| Accept | recommended | JSON responses | application/json |
| Content-Type | for JSON body | Use the documented JSON object | application/json |
| Authorization | yes | Installation token | Bearer YOUR_ACTIVATION_TOKEN |
Path and query parameters
No path parameters are accepted.
No pagination, filtering, sorting or list query parameters are implemented. Use JSON rather than relying on alternate form/query parsing.
Request body
No body fields are consumed. Omit the body or send an empty object.
Full request JSON
{}
The schemas describe supported recommended input types. Current PHP parsing trims/casts strings and may ignore unknown fields; it is not strict JSON-schema validation. Invalid optional descriptive fields can become empty/null. Conventions describes malformed JSON and alternate parsing.
Success response
HTTP 200. The following is a real isolated Sandbox capture; secret values are replaced with explicit placeholders.
{
"success": true,
"deactivated": true,
"request_id": "req_29039d899dd3655d7ada1c89"
}
Response fields
| Field | Type | Required | Constraints | Description | Example |
|---|---|---|---|---|---|
| success | boolean | yes | const=true | The operation succeeded. | true |
| deactivated | boolean | yes | const=true | Device seat released; cumulative count is unchanged. | true |
| request_id | string | yes | pattern="^req_[a-f0-9]{24}$" | Request correlation ID. Replay bodies can retain an earlier ID. | "req_29039d899dd3655d7ada1c89" |
Response headers
X-Request-ID identifies the current request. No limiter headers are returned by this endpoint.
Errors omit those rate headers and Retry-After. See the complete rate-limit reference.
Error responses
| Code | HTTP | Cause | Fix | Retryable? |
|---|---|---|---|---|
| INVALID_TOKEN | 401 | Missing/non-act_/unknown/revoked/deactivated activation token | Reactivate eligible installation | No blind retry; apply the correction |
| INTERNAL_ERROR | 500 | Uncaught exception at global boundary | Safe retry only for idempotent operation; preserve request_id | Only safe reads after backoff; reconcile mutations |
An unregistered path or wrong method is handled by the global router as NOT_FOUND (HTTP 404), not405. Every licensing error has success=false, error.code, error.message and request_id. Errors keeps SDK-local and operational namespaces separate.
Side effects
Marks the bound device DEACTIVATED and its active tokens DEACTIVATED, releasing the concurrent seat. Does not decrease activation_count. Audit/webhook license.deactivated are emitted; no email is sent directly. Other installations remain active. It does not require an otherwise usable license, but the supplied token must still be active.
Authenticated requests can consume the organization monthly API usage counter once tenant context is established, including some failures. This usage counter is currently warning-only, not a monthly API rejection gate. Developer-key authentication can update last_used_at before a later failure. No request body or Authorization value is saved by the API metadata logger.
Idempotency and concurrency
Idempotency-Key is ignored. The first accepted call returns 200; the same token subsequently returns 401 INVALID_TOKEN, not a successful replay. A lost response therefore requires inspecting the application's saved state and, if necessary, developer support. Do not treat every unknown token as proof that this particular deactivation succeeded.
Rate limits
No dedicated deactivation endpoint limiter is currently implemented. Do not invent an unlimited-service promise; use reasonable client throttling and avoid loops.
Fixed windows begin with the first hit after expiry. Attempted calls consume every bucket they reach, even if later business validation fails.
Runnable examples
These are complete native HTTP transport programs, not full SDK clients or entitlement verifiers. JSON request bodies and credentials come from KDP_* environment variables. They print raw responses to a private terminal; do not send their stdout to application/CI logs. Use the P5 verification guides before granting access.
C
Save every file shown below. Install the exact runtime/dependencies from the complete example archive README. Set the endpoint request JSON in KDP_BODY_JSON and the documented KDP_* credential variables in your private process environment.
Run ./request-c deactivate. Expected: full JSON, exit 0 for success, exit 1 for an API rejection; exit 2 for setup/transport failure. The cURL sample checks HTTP status; parse JSON before use. Never authorize a feature from transport output alone.
/* C11 entry point. Build with client_http.c include, yyjson0.13.0 and libcurl7.76+.
* Run request public-key; expected JSON, exit0 success/1 rejection/2 unavailable. */
#include "client_http.c"
int main(int argc,char **argv){return kdpika_example_main(argc,argv);}
/* Purpose: shared native libcurl transport for C11 and C++17 Sandbox examples.
* Requires libcurl7.76+, yyjson0.13.0. Build commands are in the sample README.
* Run request public-key. JSON stdout; exit0 success/1 rejection/2 setup/transport.
* Credentials/body: KDP_* environment. Private terminal only; output may contain secrets.
* Transport inspection only: verify signed state and policy before authorizing access.
*/
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <curl/curl.h>
#include "yyjson.h"
static const char *kdp_contract="{\"public-key\":{\"method\":\"GET\",\"path\":\"/public-key\",\"auth\":\"public\"},\"activate\":{\"method\":\"POST\",\"path\":\"/licenses/activate\",\"auth\":\"publicApp\"},\"validate\":{\"method\":\"POST\",\"path\":\"/licenses/validate\",\"auth\":\"activation\"},\"deactivate\":{\"method\":\"POST\",\"path\":\"/licenses/deactivate\",\"auth\":\"activation\"}}";
typedef struct {char *data;size_t size;} kdp_buffer;
static size_t kdp_receive(char *data,size_t size,size_t count,void *context){
kdp_buffer *b=(kdp_buffer *)context;
if(size && count>SIZE_MAX/size)return 0;
size_t n=size*count;if(n>1048576-b->size)return 0;
char *p=(char *)realloc(b->data,b->size+n+1);if(!p)return 0;
b->data=p;memcpy(p+b->size,data,n);b->size+=n;p[b->size]=0;return n;
}
static const char *kdp_env(const char *name){const char *v=getenv(name);return v?v:"";}
static const char *kdp_required(const char *name){const char *v=kdp_env(name);return *v&&!strchr(v,'\r')&&!strchr(v,'\n')?v:NULL;}
static int kdp_header(struct curl_slist **headers,const char *name,const char *value){
if(!value)return 0;size_t n=strlen(name)+strlen(value)+3;char *line=(char *)malloc(n);if(!line)return 0;
snprintf(line,n,"%s: %s",name,value);struct curl_slist *next=curl_slist_append(*headers,line);free(line);
if(!next)return 0;*headers=next;return 1;
}
static int kdpika_example_main(int argc,char **argv){
int code=2;CURL *curl=NULL;CURLU *url=NULL;struct curl_slist *headers=NULL;
yyjson_doc *ops=NULL,*bodydoc=NULL,*result=NULL;char *scheme=NULL,*host=NULL,*path=NULL,*part=NULL,*target=NULL;
kdp_buffer buffer={NULL,0};const char *base=kdp_env("KDP_BASE_URL"),*body=kdp_env("KDP_BODY_JSON");
const char *method=NULL,*route=NULL,*auth=NULL;yyjson_val *op=NULL;long status=0;
if(argc!=2)goto cleanup;
if(!*base)base="https://licensing.kdpika.com/api/v1";
if(!*body)body="{}";
ops=yyjson_read(kdp_contract,strlen(kdp_contract),0);if(!ops)goto cleanup;
op=yyjson_obj_get(yyjson_doc_get_root(ops),argv[1]);if(!op)goto cleanup;
method=yyjson_get_str(yyjson_obj_get(op,"method"));route=yyjson_get_str(yyjson_obj_get(op,"path"));auth=yyjson_get_str(yyjson_obj_get(op,"auth"));
if(!method||!route||!auth||curl_global_init(CURL_GLOBAL_DEFAULT)!=0)goto cleanup;
url=curl_url();if(!url||curl_url_set(url,CURLUPART_URL,base,0)!=CURLUE_OK)goto cleanup;
if(curl_url_get(url,CURLUPART_SCHEME,&scheme,0)||curl_url_get(url,CURLUPART_HOST,&host,0)||curl_url_get(url,CURLUPART_PATH,&path,0))goto cleanup;
if(strcmp(path,"/api/v1")!=0)goto cleanup;
if(strcmp(scheme,"https")!=0 && !(strcmp(scheme,"http")==0 && (!strcmp(host,"localhost")||!strcmp(host,"127.0.0.1")) && !strcmp(kdp_env("KDP_ALLOW_LOOPBACK"),"1")))goto cleanup;
{CURLUPart forbidden[]={CURLUPART_USER,CURLUPART_PASSWORD,CURLUPART_QUERY,CURLUPART_FRAGMENT};
for(size_t i=0;i<sizeof(forbidden)/sizeof(forbidden[0]);i++){if(curl_url_get(url,forbidden[i],&part,0)==CURLUE_OK)goto cleanup;}}
target=(char *)malloc(strlen(base)+strlen(route)+1);if(!target)goto cleanup;strcpy(target,base);strcat(target,route);
if(!kdp_header(&headers,"Accept","application/json")||!kdp_header(&headers,"User-Agent","KDPikaDocsExample/1.0 Native"))goto cleanup;
if(!strcmp(auth,"publicApp")&&(!kdp_header(&headers,"X-App-ID",kdp_required("KDP_APP_ID"))||!kdp_header(&headers,"X-Environment","SANDBOX")))goto cleanup;
if(!strcmp(auth,"activation")){
const char *token=kdp_required("KDP_ACTIVATION_TOKEN");if(!token)goto cleanup;
char *bearer=(char *)malloc(strlen(token)+8);if(!bearer)goto cleanup;strcpy(bearer,"Bearer ");strcat(bearer,token);
int ok=kdp_header(&headers,"Authorization",bearer);free(bearer);if(!ok)goto cleanup;
}
if(!strcmp(argv[1],"validate")&&!kdp_header(&headers,"X-Installation-ID",kdp_required("KDP_INSTALLATION_ID")))goto cleanup;
curl=curl_easy_init();if(!curl)goto cleanup;
curl_easy_setopt(curl,CURLOPT_URL,target);curl_easy_setopt(curl,CURLOPT_CUSTOMREQUEST,method);
curl_easy_setopt(curl,CURLOPT_FOLLOWLOCATION,0L);curl_easy_setopt(curl,CURLOPT_CONNECTTIMEOUT,5L);curl_easy_setopt(curl,CURLOPT_TIMEOUT,15L);
curl_easy_setopt(curl,CURLOPT_SSL_VERIFYPEER,1L);curl_easy_setopt(curl,CURLOPT_SSL_VERIFYHOST,2L);
curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,kdp_receive);curl_easy_setopt(curl,CURLOPT_WRITEDATA,&buffer);
if(!strcmp(method,"POST")){
bodydoc=yyjson_read(body,strlen(body),0);if(!bodydoc||!yyjson_is_obj(yyjson_doc_get_root(bodydoc)))goto cleanup;
if(!kdp_header(&headers,"Content-Type","application/json"))goto cleanup;
curl_easy_setopt(curl,CURLOPT_POSTFIELDS,body);
}
curl_easy_setopt(curl,CURLOPT_HTTPHEADER,headers);if(curl_easy_perform(curl)!=CURLE_OK)goto cleanup;
curl_easy_getinfo(curl,CURLINFO_RESPONSE_CODE,&status);
result=yyjson_read(buffer.data,buffer.size,0);if(!result||!yyjson_is_obj(yyjson_doc_get_root(result)))goto cleanup;
printf("%s\n",buffer.data);
code=status>=200&&status<300&&yyjson_is_true(yyjson_obj_get(yyjson_doc_get_root(result),"success"))?0:1;
cleanup:
if(code)fprintf(stderr,"Request rejected, unavailable or configuration invalid. Inspect JSON error.code/request_id when returned; do not blindly retry mutations.\n");
if(curl)curl_easy_cleanup(curl);if(url)curl_url_cleanup(url);curl_slist_free_all(headers);
curl_free(scheme);curl_free(host);curl_free(path);curl_free(part);free(target);free(buffer.data);
yyjson_doc_free(ops);yyjson_doc_free(bodydoc);yyjson_doc_free(result);return code;
}
Expected result
A correctly authenticated eligible request returns the documented HTTP status and schema. Check the actual success/error result and request IDs; a successful transport or unsigned management response does not grant a feature.
Common mistakes
- Mixing Public App IDs, internal product IDs and product-plan IDs.
- Assuming a mutation timeout means no work committed, or assuming Idempotency-Key protects every action.
- Logging raw responses that contain a newly issued license key or activation token.
Security notes
Keep lmp_ credentials out of shipped desktop/browser code. Verify signed payload bytes and product/environment/installation/status/time/feature policy. The examples do not fix the documented idempotency, cache canonicalization or current-key-only rotation limitations.
Troubleshooting
| Symptom | Cause | Action |
|---|---|---|
| INVALID_TOKEN (HTTP 401) | Missing/non-act_/unknown/revoked/deactivated activation token | Reactivate eligible installation |
| INTERNAL_ERROR (HTTP 500) | Uncaught exception at global boundary | Safe retry only for idempotent operation; preserve request_id |
Next steps
Read idempotency and signed responses before integrating a purchase-to-license workflow.