---
title: "Activate an on-prem license and return a signed entitlement JWT"
method: POST
path: "/onprem/v1/activate"
tags: ["onprem", "onprem", "__public__"]
---

# Activate an on-prem license and return a signed entitlement JWT

`POST /onprem/v1/activate`

## Request body

- ActivateRequest
  - `license_key` string, required — Raw license key issued to the customer
  - `deployment_id` string, required — Stable uuid string self-generated by the install on first boot
  - `version` string, nullable — On-prem build version, for bookkeeping
  - `deployment_mode` 'self_hosted' | 'definite_hosted', nullable — self_hosted for customer infra, definite_hosted for Definite-operated infra; omitted means preserve existing mode or default first activation to self_hosted
  - `cloud_provider` string, nullable — Cloud provider for hosted deployments
  - `broker_public_key` string, nullable — Ed25519 public key (PEM) the deployment uses to sign OAuth-broker calls. Optional and backward-compatible; re-activation rotates it (contract §3).
  - `upgrade_policy` string, nullable — Remote-upgrade consent policy the deployment runs under (manual|notify|auto). Observability only.
  - `release_channel` string, nullable — Release channel the deployment follows (e.g. stable/canary/pinned). Non-pinned channels are advertised the blessed release.

## Response `200`

Success

- SuccessResponseActivateResponse
  - `success` true, required — Flag for it request was successful
  - `data` ActivateResponse, required
    - `entitlement` string, required — Signed Ed25519 entitlement JWT
    - `expires_at` string, date-time, required — When the entitlement JWT expires
    - `release` string, nullable — Signed Ed25519 release manifest JWT, or null when no newer release is advertised.
  - `meta` ResponseMeta
    - `requestId` string — Unique request identifier for tracing
    - `timestamp` string, date-time — Response timestamp (UTC)
    - `durationMs` integer, nullable — Request processing time in milliseconds

## Other responses

- `401` — Auth Invalid Token
- `403` — Forbidden Insufficient Permissions
- `409` — Resource Conflict
- `422` — Validation Failed
- `426` — Business Quota Exceeded
- `429` — Rate Limit Exceeded
- `500` — Internal Error

---

[API](https://skmtc.dev/definite/apis/defapi.md) · [All operations](https://skmtc.dev/definite/apis/defapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/definite/defapi/revisions/3943d8deb3be/schema)