License

What this screen is for

The License screen shows the deployment licence of the installation, one per deployment and never per tenant. It is where you download the activation request a licence is issued from, and where the signed licence file is imported. Its banner states the posture, TRIAL, LICENSED, IN GRACE or EXPIRED, with the days remaining; below it the installation, the imported licence's details, capability modules, compliance packs and commercial terms are listed. The decisions here are requesting a licence and importing it. What the licence decides on this installation is narrower than the screen suggests, and the sections below say exactly what.

What must exist first

The screen is offered in system context only; opening it while a tenant is assumed returns you to that tenant's dashboard. Most of its labels are shown in English whatever language the console is set to; the Installation card and the licence ID, issue and signing-key labels follow the console language.

The permission to read the platform licence shows the screen and Download activation request; without it the screen says so and names the permission.
The permission to import a licence shows Import license.
The permission to list tenants fills the capacity bar; without it the bar shows usage unavailable.
The licence service must answer; when it does not, the screen says The license service did not respond and offers Retry.
The permission to read the platform algorithm catalogue resolves the compliance pack chips into their titles and links. The roles that read the licence hold it.

Decisions you make here

Reading the posture

The installation starts on a 30-day trial written when it is created, and the banner reads Trial · N day(s) left · no license imported. Once a licence is imported, the banner names its edition and the days to renewal. A licence stays in force through its grace period: after its end date the posture becomes IN GRACE and counts the days left in that window, and only when the grace period has also elapsed does it become EXPIRED. An expired trial reads EXPIRED with no licence to show.

The licence in force is the imported licence whose start date is the latest among those whose window covers today. A renewal imported early is inert until its own start date; a shorter licence starting today outranks a longer one that started earlier.

Reading the installation

The Installation card shows the Installation ID and the Environment name in every posture. The installation ID is generated when the environment is created, and a licence is issued for it: a licence issued for another installation is refused at import. A backup restore keeps the ID, so a restored installation keeps its licence; recreating the environment creates a new ID, and the new installation needs a new licence. The environment name is only a label, so renaming the environment changes nothing.

The copy control beside the ID copies it. When the card says the ID is Unavailable, the licence service could not verify the installation's identity: no licence is in force, and no activation request can be downloaded. The remedy is to restore the environment's trial sentinel from its backup; ask your platform operator.

Requesting a licence

Download activation request saves the file ankasecure-activation-request-<installationId>.json exactly as the server sends it. Send it to ANKATech to have a licence issued, or renewed, for this installation. The file names the installation ID, the environment name and the release; it is not signed and holds nothing secret. The download is offered only while the installation ID is available.

Knowing what changes at expiry

While the posture is EXPIRED, or no licence and no trial is in effect, the installation is in cryptographic read-only mode. The crypto service refuses every operation that creates new protection or new key material with 402 and the problem type deployment-license-expired: encrypt, sign, sign-encrypt, re-encrypt and re-sign, their streaming forms, key generation, rotation and import, keystore migration and PKCS#7 to JOSE conversion. Its detail reads The deployment license has expired. Contact your platform administrator to renew it.

Decrypt, verify and decrypt-verify, their streaming forms, key reads and listings, key revocation, the algorithm catalogue and the rotation-admissibility preview continue, as does everything on this console that is not a cryptographic operation. The crypto service re-reads the licence state within a minute, so an import restores the refused operations without a restart. The console's own banner and the modal say that cryptographic operations are refused; the operations above are the ones that are.

Reading the licence notice elsewhere in the console

The platform plane shows a licence strip to a viewer holding the permission to read platform alerts: a warning from 60 days before the end date, 15 on a trial; a critical band from 15 days, 5 on a trial; a grace band while in grace; and a read-only band once expired. Only the warning band can be dismissed. Review licence on any band leads here.

Importing a licence

Import license opens a dialog that takes a .ankalic file of at most 64 KB. The console reads it and shows the licence ID, issue date, installation ID, environment, customer, edition, validity and modules it declares before you confirm. It does not compare the installation ID with this installation's: the check that counts is the server's.

An import is refused when the signature does not verify, when the file is signed under a key this release does not trust, when it was issued for another installation, when this licence was already imported, when the installation's own identity cannot be verified, when its validity plus grace has already passed, when it declares a schema version this installation does not admit, or when it names a compliance pack this release does not define. The refusal is shown inside the dialog, which stays open with the file still selected.

After a successful import the dialog reports the installation licensed and the screen re-reads the posture; a licence whose start date has not come is stored and stays inert until that date.

Reading the operation usage

Operation usage summarises the billable operations of the whole installation for this month to date, from the first UTC day of the month through today, and states that period. It shows Total operations, Streaming operations and Non-streaming operations, the same names the Usage screen gives them, a bar whose legend names each part and its count, and Total payload bytes as a size, with the exact byte count when you point at it.

When nothing was recorded, the panel says No usage was recorded in this period; when the summary cannot be read, it says The usage summary could not be read and offers Retry.

It is a summary, not a day-by-day table: View detailed usage, at the foot of the panel, opens the Usage screen on the same month by day, where you can also choose any other range and grain.

Knowing what the licence decides here

Edition is the one value the platform reads to select what it offers. On a customer-operated installation it decides nothing: a customer's key-material backends are its own, so the edition-tiered backends of the service offering, which the edition would select among, are not offered here. The capability modules, listed as Included or Not included, are informational; nothing reads them. The capacity bar compares the licence's committed key baseline with the active keys of every tenant and states the headroom or over baseline; exceeding it blocks nothing.

The compliance packs decide which packs the platform evaluates your tenants against: every pack of the catalogue during a trial, the packs the licence names while it is in force, grace period included, and none once it has expired. A pack outside them is listed as not included in the licence, its history and remediation plan turn read-only, and evidence already issued for it still verifies but new evidence cannot be issued; no key or crypto operation is allowed or refused because of them.

Reading the compliance packs

The licence lists the compliance packs it was issued with. Each identifier is looked up in this release's pack catalogue: a resolved chip shows the pack's title and opens its definition. On a trial, with no licence imported, every pack of the catalogue is listed, each opening its definition, and the screen states: No license imported yet — this deployment runs on a trial. During the trial every capability module is available and every compliance pack in this release's catalogue is evaluated.

A chip that shows a raw identifier, labelled as not in this release's catalogue and with no link, names a pack this release does not define, typically from a licence issued under an earlier release. The licence stays valid and keeps its state. If the pack catalogue cannot be read, every chip shows its raw identifier with no link, and the screen offers a retry.

To have such a pack resolve, import a licence re-issued with the current pack identifiers, whose start date is not earlier than the current licence's. No environment is recreated and nothing is deleted: the earlier licence stays in history, no longer selected. Importing a licence that names an identifier this release does not define is refused.

How it relates to other screens

The operations an expired licence refuses are the ones the Key Inventory and the crypto API perform; a tenant administrator sees the refusal there, and this is the one screen that ends it.