--- title: "Dart REST client" description: "Build a complete Dart Sandbox licensing client with verified signatures, persistent identity, private state, offline policy and safe feature gating." slug: "/docs/v1/sdks/dart" section: "SDKs and languages" order: 55 audience: "all" level: "intermediate" last_updated: "2026-10-17" version: "v1" related: ["/docs/v1/api/activate", "/docs/v1/security/offline-mode"] draft: false --- Use the real API v1 from a trusted Dart process with explicit signature and policy checks before enabling [features](/docs/v1/start/glossary#feature). This REST sample is not an additional [official SDK](/docs/v1/start/glossary#official-sdk). ## What you will learn - Activate, validate and deactivate one stable [Sandbox](/docs/v1/start/glossary#sandbox) installation. - Preserve signed bytes and verify the trusted Ed25519 key before policy. - Handle cache, [offline grace](/docs/v1/start/glossary#offline-grace), explicit rejection and safe user messages. ## Prerequisites - Complete [the Sandbox quickstart](/docs/v1/start/quickstart). - Read [authentication](/docs/v1/start/authentication) and [signed responses](/docs/v1/security/signed-responses). - Have the [product](/docs/v1/start/glossary#product) App ID, a Sandbox [license](/docs/v1/start/glossary#license) and its matching [customer](/docs/v1/start/glossary#customer) email when supplied. - Obtain the actual [public-key document](/docs/v1/api/public-key) over independently trusted HTTPS and distribute/pin it through controlled application configuration, not from an untrusted envelope. ## Runtime and application type Dart3.7+, cryptography2.9.0 with pubspec.lock. Dart VM CLI or trusted backend; not browser Dart. Native Dart file locks serialize a namespace. On POSIX this sample calls the fixed /bin/chmod tool to set permissions; Windows needs application ACL review. Flutter mobile/desktop UI integration and platform vaults are separate app responsibilities. ## Complete project and integrity The complete project archive contains every client/verifier source and the exact build/dependency metadata needed by this language. Extract it with its original directory layout. Dependencies/locks are included where this runtime uses them; no hidden helper or test-only clock is required. [kdpika-dart-rest-example-1.0.0.zip](/docs/downloads/kdpika-dart-rest-example-1.0.0.zip) · 8942 bytes · version 1.0.0 SHA-256: 729a44db23dcf31fab34ab9cd2cc17b89f74d6f83d477c7ca9e70d7eabaa2742 Extract the entire project, preserving its samples/sdks and samples/security layout. The archive includes all first-party client/verifier sources and pinned manifests/locks; dependency downloads are development-time restoration, never extra services needed by the PHP host. Do not flatten the tree or replace the verification helper with a generic JSON reserializer. ## Install and build 1. Verify the archive SHA-256 against the current table. Expected: exact digest match; otherwise stop. 2. Extract into a clean private development directory. Expected: complete samples tree with the language project. 3. Enter samples/sdks/dart. Expected: the main client and build/dependency files are present. 4. Install the stated runtime/native libraries, then run the full build command below. Expected: successful syntax check or native executable, not a registry SDK download. ```bash dart pub get --enforce-lockfile dart analyze session.dart dart compile exe session.dart -o session ``` The source scripts compile the exact files and validate third-party download checksums where applicable. Compiler toolchains are development dependencies, not tools to install on KDPika shared hosting. macOS is the actual tested runtime; other targets require their own build/permission/TLS-root checks. ## Application configuration | Variable | Required | Meaning | | --- | --- | --- | | KDP_APP_ID | Yes | [Public App ID](/docs/v1/start/glossary#public-app-id), not internal product ID or [developer](/docs/v1/start/glossary#developer) key | | KDP_BASE_URL | No | HTTPS API base ending /api/v1; default https://licensing.kdpika.com/api/v1 | | KDP_STATE_DIR | Yes | Absolute private application state root; keep it stable | | KDP_TRUSTED_KEY_FILE | Yes | Absolute path to an independently trusted public-key document | | KDP_LICENSE_KEY | [Activation](/docs/v1/start/glossary#activation) | Sandbox key beginning TEST; never embedded in distributed source | | KDP_CUSTOMER_EMAIL | Optional | Actual matching customer email for email-bound activation | | KDP_ALLOW_LOOPBACK | Local testing only | 1 permits explicit localhost/127.0.0.1 HTTP, not arbitrary HTTP hosts | Environment is fixed to SANDBOX in this example. Unsafe URL credentials/query/fragment and nonlocal HTTP are rejected. Official SDK constructors expect the site origin; these REST programs expect /api/v1. Store state and trusted keys outside public web roots. Do not ship lmp_ developer management keys. ## Complete runnable client ```dart // Complete Sandbox REST CLI. Dart3.7+, cryptography2.9.0, dart:io. // Run dart run session.dart status|activate|check|validate|deactivate. // Uses exact published P5 verifier in verifier.dart; output safe decisions only. import 'dart:convert'; import 'dart:io'; import 'dart:math'; import 'package:cryptography/cryptography.dart'; import 'verifier.dart' as signature; class Refusal implements Exception {final String code;final String? requestId;Refusal(this.code,[this.requestId]);} class Unreachable implements Exception {} String required(String name){final value=Platform.environment[name]??'';if(value.isEmpty||value.contains('\r')||value.contains('\n'))throw StateError('configuration');return value;} Map object(List raw){final value=signature.Parser(raw).parse();if(value is! Map)throw Refusal('INVALID_RESPONSE');return value;} Future hash(String text)async{final value=await Sha256().hash(utf8.encode(text));return value.bytes.map((b)=>b.toRadixString(16).padLeft(2,'0')).join();} String randomHex(int length){final random=Random.secure();return List.generate(length,(_)=>random.nextInt(256).toRadixString(16).padLeft(2,'0')).join();} DateTime instant(dynamic value){if(value is! String||!RegExp(r'^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?(?:Z|[+-]\d\d:\d\d)$').hasMatch(value))throw Refusal('INVALID_TIME');try{return DateTime.parse(value).toUtc();}catch(_){throw Refusal('INVALID_TIME');}} Future> readPrivate(String path)async{final type=await FileSystemEntity.type(path,followLinks:false);if(type!=FileSystemEntityType.file||await File(path).length()>1048576)throw StateError('unsafe file');return File(path).readAsBytes();} Future chmod(String path,String mode)async{if(!Platform.isWindows){final result=await Process.run('/bin/chmod',[mode,path]);if(result.exitCode!=0)throw StateError('permissions');}} class Session { late String app,base,directory,installation;late List trusted; RandomAccessFile? lock;String? lockPath; final HttpClient http=HttpClient()..connectionTimeout=const Duration(seconds:5); static Future open()async{ final client=Session();try{await client.initialize();return client;}catch(_){await client.close();rethrow;} } Future initialize()async{ app=required('KDP_APP_ID');if(!RegExp(r'^[A-Za-z0-9_-]{3,160}$').hasMatch(app))throw StateError('app ID'); base=(Platform.environment['KDP_BASE_URL']??'https://licensing.kdpika.com/api/v1').replaceFirst(RegExp(r'/+$'),'');final uri=Uri.parse(base); final local=uri.scheme=='http'&&['localhost','127.0.0.1'].contains(uri.host)&&Platform.environment['KDP_ALLOW_LOOPBACK']=='1'; if(uri.host.isEmpty||(uri.scheme!='https'&&!local)||uri.userInfo.isNotEmpty||uri.hasQuery||uri.hasFragment||uri.path!='/api/v1')throw StateError('URL'); final root=required('KDP_STATE_DIR'),key=required('KDP_TRUSTED_KEY_FILE');if(!Directory(root).isAbsolute||!File(key).isAbsolute)throw StateError('absolute paths'); trusted=await readPrivate(key);final pub=object(trusted);if(pub['algorithm']!='Ed25519'||pub['encoding']!='base64url')throw StateError('trusted key'); await Directory(root).create(recursive:true);if(await FileSystemEntity.type(root,followLinks:false)!=FileSystemEntityType.directory)throw StateError('root symlink'); directory='$root/${(await hash('$base|$app|SANDBOX|dart-rest-v1')).substring(0,20)}';await Directory(directory).create(recursive:true); if(await FileSystemEntity.type(directory,followLinks:false)!=FileSystemEntityType.directory)throw StateError('namespace symlink');await chmod(directory,'700'); // OS lock stays on one stable lock file; do not unlink it while another // process may wait on its inode. An active owner fails immediately. lockPath='$directory/.lock';if(await FileSystemEntity.type(lockPath!,followLinks:false)==FileSystemEntityType.link)throw StateError('lock symlink'); lock=await File(lockPath!).open(mode:FileMode.append);await chmod(lockPath!,'600');await lock!.lock(FileLock.exclusive); final identity='$directory/installation.json'; if(await FileSystemEntity.type(identity,followLinks:false)==FileSystemEntityType.notFound){final hex=randomHex(16);await write('installation.json',{'installation_id':'lmp-install-${hex.substring(0,8)}-${hex.substring(8,12)}-${hex.substring(12,16)}-${hex.substring(16,20)}-${hex.substring(20)}'});} final value=object(await readPrivate(identity));installation=value['installation_id'] as String; if(!RegExp(r'^lmp-install-[a-f0-9-]{36}$').hasMatch(installation))throw StateError('invalid identity; do not reset automatically'); } Future close()async{http.close(force:true);if(lock!=null){try{await lock!.unlock();}catch(_){}await lock!.close();lock=null;}} Future write(String name,dynamic value)async{final temporary=File('$directory/write-${randomHex(12)}');await temporary.create(exclusive:true);await chmod(temporary.path,'600');await temporary.writeAsString(jsonEncode(value),flush:true);await temporary.rename('$directory/$name');} Future?> state()async{final file='$directory/session.json';if(await FileSystemEntity.type(file,followLinks:false)==FileSystemEntityType.notFound)return null; final raw=await readPrivate(file);object(raw);final value=jsonDecode(utf8.decode(raw)) as Map; if(value['token'] is! String||!RegExp(r'^act_[A-Za-z0-9_-]+$').hasMatch(value['token'])||(value['envelope']!=null&&value['envelope'] is! String))throw StateError('stored session');instant(value['checkpoint']);return value; } Future clear()async{final file=File('$directory/session.json');if(await file.exists())await file.delete();} Future<(Map,String?)> request(String endpoint,Map body,[String? token])async{ late HttpClientResponse response;final raw=[]; try{ final request=await http.postUrl(Uri.parse(base+endpoint)).timeout(const Duration(seconds:15));request.followRedirects=false; request.headers.set('Accept','application/json');request.headers.set('Content-Type','application/json');request.headers.set('User-Agent','KDPika-REST-Dart-example/1.0'); if(token==null){request.headers.set('X-App-ID',app);request.headers.set('X-Environment','SANDBOX');}else{request.headers.set('Authorization','Bearer $token');request.headers.set('X-Installation-ID',installation);} final encoded=utf8.encode(jsonEncode(body));request.contentLength=encoded.length;request.add(encoded);response=await request.close().timeout(const Duration(seconds:15)); await for(final bytes in response.timeout(const Duration(seconds:15))){raw.addAll(bytes);if(raw.length>1048576)throw Refusal('INVALID_RESPONSE');} }on Refusal{rethrow;}catch(_){throw Unreachable();} late Map value;try{value=object(raw);}catch(_){throw Refusal('INVALID_RESPONSE');} var id=value['request_id'] as String?;if(id!=null&&!RegExp(r'^req_[A-Za-z0-9_-]{1,120}$').hasMatch(id))id=null; if(response.statusCode<200||response.statusCode>=300||value['success']!=true){final error=value['error'];final candidate=error is Map?error['code']:null;throw Refusal(candidate is String&&RegExp(r'^[A-Z0-9_]{1,64}$').hasMatch(candidate)?candidate:'HTTP_ERROR',id);} return(value,id); } Map accepted(String source,[String? id])=>{'valid':true,'source':source,'signature_valid':false,'error_code':null,'request_id':id,'pdf_export_allowed':false,'seat_count':null,'message':'Your license is ready.'}; Future> verify(String envelope,String source,String? checkpoint,[String? id])async{ if(!await signature.verifyEnvelope(trusted,utf8.encode(envelope)))throw Refusal('SIGNATURE_INVALID',id); final payload=(jsonDecode(envelope) as Map)['payload'] as Map; if(payload['product_id']!=app||payload['environment']!='sandbox'||payload['device'] is! Map||payload['device']['installation_hash']!=await hash(installation))throw Refusal('BINDING_MISMATCH',id); final server=instant(payload['server_time']),next=instant(payload['next_validation_at']),grace=instant(payload['offline_grace_until']); if(next.isBefore(server)||grace.isBefore(server))throw Refusal('INVALID_TIME',id);var latest=server;if(checkpoint!=null&&instant(checkpoint).isAfter(latest))latest=instant(checkpoint);final now=DateTime.now().toUtc(); if(now.add(const Duration(seconds:300)).isBefore(latest))throw Refusal('CLOCK_ROLLBACK_DETECTED',id); if(payload['status']!='active')throw Refusal('LICENSE_NOT_ACTIVE',id); if(payload['starts_at']!=null&&now.isBefore(instant(payload['starts_at'])))throw Refusal('LICENSE_NOT_STARTED',id); if(payload['expires_at']!=null&&!now.isBefore(instant(payload['expires_at'])))throw Refusal('LICENSE_EXPIRED',id); if(source!='online'&&now.isAfter(grace))throw Refusal('OFFLINE_GRACE_EXPIRED',id); final features=payload['features'];if(features is! Map)throw Refusal('INVALID_RESPONSE',id);final value=accepted(source,id);value['signature_valid']=true;value['pdf_export_allowed']=features['pdf_export']==true; final count=features['seat_count'];if(count is int&&count>=0&&count<=9007199254740991)value['seat_count']=count;return value; } Future> run(String action)async{ final saved=await state();if(action=='status')return {'activated':saved!=null,'installation_hash':await hash(installation),'storage_security':'permission-protected-file'}; if(action=='activate'){final license=required('KDP_LICENSE_KEY');if(!license.startsWith('TEST'))throw StateError('Sandbox key');if(saved!=null)throw Refusal('ALREADY_ACTIVATED'); final body={'license_key':license,'device_id':installation,'device_name':'Dart REST example','platform':Platform.operatingSystem,'app_version':'1.0.0'};if((Platform.environment['KDP_CUSTOMER_EMAIL']??'').isNotEmpty)body['email']=required('KDP_CUSTOMER_EMAIL'); final(reply,id)=await request('/licenses/activate',body);final token=reply['activation_token'];if(token is! String||!RegExp(r'^act_[A-Za-z0-9_-]+$').hasMatch(token))throw Refusal('INVALID_RESPONSE',id); try{final envelope=signature.canonical(reply['license']);final value=await verify(envelope,'online',null,id);await write('session.json',{'token':token,'envelope':envelope,'checkpoint':DateTime.now().toUtc().toIso8601String()});return value;} catch(_){try{await request('/licenses/deactivate',{},token);}catch(_){}rethrow;}} if(saved==null)throw Refusal('NOT_ACTIVATED');final token=saved['token'] as String; if(action=='deactivate'){final(reply,id)=await request('/licenses/deactivate',{},token);if(reply['deactivated']!=true)throw Refusal('INVALID_RESPONSE',id);await clear();final value=accepted('online',id);value['message']='This installation has been deactivated.';return value;} if(action=='check'&&saved['envelope']!=null){try{final value=await verify(saved['envelope'],'cache',saved['checkpoint']);final payload=jsonDecode(saved['envelope'])['payload'];if(DateTime.now().toUtc().isBefore(instant(payload['next_validation_at']))){saved['checkpoint']=DateTime.now().toUtc().toIso8601String();await write('session.json',saved);return value;}} on Refusal{saved['envelope']=null;await write('session.json',saved);}} late Map value; try{final(reply,id)=await request('/licenses/validate',{},token);final envelope=signature.canonical(reply['license']);value=await verify(envelope,'online',saved['checkpoint'],id);saved['envelope']=envelope;} on Unreachable{if(saved['envelope']==null)throw Refusal('OFFLINE_CACHE_MISSING');value=await verify(saved['envelope'],'offline',saved['checkpoint']);} on Refusal catch(error){if(['INVALID_TOKEN','DEVICE_MISMATCH','LICENSE_REVOKED','LICENSE_EXPIRED','LICENSE_CANCELLED'].contains(error.code)){await clear();}else{saved['envelope']=null;await write('session.json',saved);}rethrow;} saved['checkpoint']=DateTime.now().toUtc().toIso8601String();await write('session.json',saved);return value; } } Future main(List args)async{Session? client;var code=2; try{if(args.length!=1||!['status','activate','check','validate','deactivate'].contains(args[0]))throw StateError('action');client=await Session.open(); try{print(jsonEncode(await client.run(args[0])));code=0;}on Refusal catch(error){final value=client.accepted('local',error.requestId);value['valid']=false;value['error_code']=error.code;value['message']='Your license could not be confirmed. Connect and try again, or contact your software provider.';print(jsonEncode(value));code=1;} on Unreachable{final value=client.accepted('local');value['valid']=false;value['error_code']='NETWORK_ERROR';value['message']='Connect to the internet and try again.';print(jsonEncode(value));code=1;} }catch(_){stderr.writeln('Check application settings and private storage. Contact your software provider if the problem continues.');}finally{await client?.close();}exitCode=code; } ``` ```yaml name: kdpika_dart_rest_example version: 1.0.0 publish_to: none environment: sdk: '>=3.7.0 <4.0.0' dependencies: cryptography: 2.9.0 ``` The complete project also contains the exact verification helper. Its source and all positive/negative vectors are available in the [security verifier archive](/docs/downloads/security-verifiers.zip). Derived reusable files remove only the original standalone CLI entry point/imports that became unused; they do not change the signature algorithm or canonicalization. ## Run the lifecycle Use ./session followed by exactly one action. Preserve the same App ID, state root and origin across processes. 1. Run status. Expected: activated=false for a new namespace and only an installation hash/storage category. Token presence is not a license validity decision. 2. Set a Sandbox key and matching email, then run activate. Expected: valid=true and signature_valid=true, or a safe refusal. An existing token is not silently replaced. 3. Run check. Expected: eligible authenticated cache before next_validation_at, otherwise an online validation attempt. 4. Run validate. Expected: an online attempt; only transport failure can use an eligible verified offline cache. Explicit HTTP rejection never grants offline permission. 5. Run deactivate. Expected: server-confirmed release, token/cache removal and no feature grant. valid=true here means the release operation succeeded, not permission to run a protected feature. 6. Run status again. Expected: activated=false and the same installation hash. Cumulative activation_count is not reset. Exit0 means accepted operation/status, exit1 means refusal or connectivity denial, exit2 means unsafe configuration/state or unexpected failure. Output is safe decision metadata: never raw keys, tokens, Authorization headers or signed customer payloads. ## API contract and signature verification Activation sends X-App-ID and X-Environment: SANDBOX plus license_key/device_id and optional matching email. Validation uses Bearer act_ and X-Installation-ID. Deactivation releases that token. See the [endpoint reference](/docs/v1/api/conventions) for full field/response/error tables. The response parser preserves numeric lexemes, rejects duplicate/invalid JSON through the shared tested verifier, and authenticates the exact envelope. Only a verified payload enters policy. Key ID is derived from the independently trusted raw public key; wrong algorithm/key/signature is rejected. Never repair a mismatch by stripping signed fields or using JSON.stringify-style numeric normalization. ## Binding, features and fail-closed policy The client requires its actual product App ID, environment=sandbox, SHA-256 installation binding and active status. It checks starts_at when present, expiry when nonnull, signed validation/grace dates and the last accepted checkpoint. Invalid data, status or policy is a refusal even if the payload carries a true feature. pdf_export is allowed only for the boolean true on a fully accepted result. seat_count is exposed only as a nonnegative integer bounded by the shared safe-integer policy; otherwise it stays null. These example feature names must match your own product configuration. Constructing a result or reading token presence never authenticates a license. ## Offline grace and time checks Before next_validation_at, check can return a verified cache. After that instant it validates online. Only a transport failure may use the existing signed state within offline_grace_until and expires_at. An explicit HTTP refusal, bad signature, malformed success or binding mismatch cannot extend access. Selected token/revocation/[device](/docs/v1/start/glossary#device)/expiry/cancellation refusals clear the token; other refusals clear cached authorization. The last accepted checkpoint and signed server_time bound rollback with300 seconds tolerance. Grace is based on its signed deadline, not added to next_validation_at. Validating online does not promise permission if time/status/binding rules fail. No constructor flag creates an extra offline extension. These strict sample policies are not changes to existing SDK behavior. A person controlling the host can patch the program or restore full snapshots. Use server-side authorization for high-value online actions and do not promise absolute local anti-tamper protection. ## Private storage, concurrency and recovery The [installation ID](/docs/v1/start/glossary#installation-id) is random, persistent and independent of MAC/serial/hardware fingerprints. A namespaced private session stores the [activation token](/docs/v1/start/glossary#activation-token), lossless [signed envelope](/docs/v1/start/glossary#signed-envelope) and checkpoint. Writes are atomic and permissions are owner-only where supported; this is not automatic encryption or an OS-vault certification. The program serializes one namespace. Java/Kotlin, Dart, Rust and the POSIX native core use an OS lock on a stable file; Go/Ruby/Swift use exclusive lock-file ownership and require manual reconciliation after a crash. Never delete an active lock or regenerate identity to avoid a refusal. A new identity can consume another cumulative activation. Keep separate namespaces for unrelated buyers/tenants. Review [secure token storage](/docs/v1/security/secure-token-storage) for native vault adapters. POSIX modes do not replace Windows ACL review. Do not put state under public_html, bundle a populated cache, or expose raw SDK/client methods to a renderer/browser. ## Errors and uncertain mutations The client accepts only bounded safe error/request identifiers and shows plain user messages. Unknown errors fail closed. No automatic mutation retry is supplied. A lost activation response may already have consumed a server activation; reconcile before retrying. If a returned new token fails signature/policy acceptance, the client attempts best-effort release, which can itself remain uncertain. Read [the complete server error table](/docs/v1/api/errors). Local example identifiers such as BINDING_MISMATCH, ALREADY_ACTIVATED, SIGNATURE_INVALID and INVALID_TIME are client policy results, not invented server emissions. Never show raw stack traces, private paths or customer payloads to end users. ## Packaging and framework integration Dart VM CLI or trusted backend; not browser Dart. Native Dart file locks serialize a namespace. On POSIX this sample calls the fixed /bin/chmod tool to set permissions; Windows needs application ACL review. Flutter mobile/desktop UI integration and platform vaults are separate app responsibilities. Keep stable state outside executable extraction/install directories. Include the exact verification modules and required native/runtime libraries; never embed a developer key or populated token/cache. A web route still needs application authentication, tenant authorization and CSRF protection. A desktop renderer gets narrow safe decisions only, not arbitrary file paths or token access. Re-test real activation, cache reload, offline loss, explicit refusal and release after bundling or updating dependencies. macOS native source execution is not proof that every operating-system package, signing/notarization setup or framework UI has passed. ## Recorded verification and limits The exact native runtime executes the real isolated Sandbox lifecycle and21 negative/positive checks: wrong email, stable cross-process identity, cache without HTTP, online validation, injected network loss, modified offline cache, rollback, explicit HTTP503, modified signed response, no-follow307, recovery, release and unsafe setup guards. Refusal/outage/redirect injections are an explicit loopback test forwarder, not a claimed production outage. Build evidence records actual toolchain/dependency hashes. All ten fresh project archives build and the complete native clients execute real Sandbox lifecycles. All23 published signature vectors pass in every REST language. Signature authenticity is separate from current license authorization. Native Windows/Linux/mobile GUI execution is not inferred from this macOS run. ## Expected result Your application authenticates signed state, applies binding/time/status policy and enables only verified features. A refusal or successful seat release cannot accidentally unlock a feature. ## Common mistakes - Using the internal product ID instead of the Public App ID. - Losing numeric tokens before verifying the signature. - Treating a true feature or HTTP success as a validity proof. - Sharing one installation cache between unrelated tenants or deleting identity on failure. ## Security notes Keep HTTPS verification, independent key trust and fail-closed policy. This example does not change the platform contract, process payments or grant universal anti-tamper protection. Preserve real API/SDK boundaries and keep credentials off browser/renderer surfaces. ## Troubleshooting | Symptom | Cause | Action | | --- | --- | --- | | Exit2 at startup | Unsafe URL, missing private path, bad identity or busy lock | Correct trusted configuration; do not expose raw diagnostics to users | | INVALID_LICENSE | Key/email/App ID/environment mismatch | Use the actual matching Sandbox values | | SIGNATURE_INVALID | Wrong key, modified state or changed canonical bytes | Deny access and run the published vectors | | OFFLINE_CACHE_MISSING | No accepted signed state remains | Reconnect and validate; never manufacture a cache | | CLOCK_ROLLBACK_DETECTED | System time behind trusted time | Correct the device clock and reconnect | | Release uncertain | Lost response or network/server refusal | Preserve identity and reconcile the seat with your software provider | ## Next steps Review [offline mode](/docs/v1/security/offline-mode), [signed responses](/docs/v1/security/signed-responses) and [API errors](/docs/v1/api/errors). ## Related - [Activate](/docs/v1/api/activate) - [Validate](/docs/v1/api/validate) - [Deactivate](/docs/v1/api/deactivate) - [Signature test vectors](/docs/v1/security/test-vectors)