keygen-openapi.yml

openapi: 3.1.0
info:
  title: Keygen API
  summary: Keygen is an open, source-available software licensing and distribution API, built for developers, by developers.
  version: 1.0.0
  termsOfService: https://keygen.sh/terms
  contact:
    name: Keygen
    url: https://keygen.sh
    email: support@keygen.sh
  license:
    name: Elastic License v2.0
    url: https://keygen.sh/license
  description: |
    The Keygen API is organized around REST principles. All requests **must** be made over TLS/SSL. We only support
    **TLS 1.2**, for security reasons. All API request and response bodies, including errors, are encoded in **JSON**
    format.

    The API has predictable, resource-oriented URLs, and uses standard HTTP response codes to indicate API errors. We
    use built-in HTTP features, like authentication and HTTP verbs, which are understood by off-the-shelf HTTP clients.
    We support cross-origin resource sharing, allowing you to interact securely with our API from any client-facing
    software application.
servers:
  - url: https://api.keygen.sh/v1
    description: The official Keygen API server.
paths:
  /accounts/{account}/tokens:
    post:
      tags:
        - Tokens
      operationId: generateToken
      summary: Generate a token
      description: |
        Generate a new token resource for a user, using the user's email and password. Keygen does not store your tokens
        for security reasons. After a token is generated, it cannot be recovered if lost. The token will need to be
        revoked if lost, and a new token should be generated. Alternatively, the existing token can be regenerated
        (rolled).

        By default, user tokens expire in 2 weeks, and admin tokens do not expire. A custom expiry may be provided in
        the token generate request. If the user does not have a password, a token must be generated via
        [the user's token relationship](https://keygen.sh/docs/api/users/#users-tokens)

        To generate a token for a product, see the [product token relationship](https://keygen.sh/docs/api/products/#products-tokens).

        To generate a license token, see the [license token relationship](https://keygen.sh/docs/api/licenses/#licenses-relationships-activation-tokens).
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: GenerateTokenRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [tokens]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: An optional name for the token.
                        expiry:
                          type: string
                          format: date-time
                          description: The timestamp for when the token expires.
                        meta:
                          type: object
                          properties:
                            otp:
                              type: string
                              description: |
                                When the user has [a second factor](https://keygen.sh/docs/api/users/#second-factors)
                                enabled, an OTP code will be required. The expected format is a six-digit string, e.g.
                                `000000`.
                  required:
                    - type
                    - attributes
      responses:
        "201":
          description: Token generated successfully
          content:
            application/vnd.api+json:
              schema:
                title: GenerateTokenResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Token"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
      security:
        - BasicAuth: []
    get:
      tags:
        - Tokens
      operationId: listTokens
      summary: List all tokens
      description: |
        Returns a list of tokens. The tokens are returned sorted by creation date, with the most recent tokens appearing
        first. Resources are automatically scoped to the authenticated bearer e.g. when authenticated as a product, only
        tokens that belong to the specific product will be listed.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of tokens to be returned.
        - name: bearer
          in: query
          description: Object containing the bearer's type and ID.
          required: false
          style: deepObject
          explode: true
          schema:
            title: ListTokensBearerParameter
            type: object
            properties:
              type:
                type: string
                enum:
                  - products
                  - licenses
                  - users
              id:
                type: string
            required:
              - type
              - id
      responses:
        "200":
          description: Tokens retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListTokensResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Token"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/tokens/{token}:
    get:
      tags:
        - Tokens
      operationId: retrieveToken
      summary: Retrieve a token
      description: Retrieves the details of an existing token.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: token
          in: path
          description: The identifier (UUID) of the token to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Token retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveTokenResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Token"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    put:
      tags:
        - Tokens
      operationId: regenerateToken
      summary: Regenerate a token
      description: |
        Regenerate an existing token resource. This will replace the token attribute with a new secure token, and extend
        the token's expiry by 2 weeks from the current time.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: token
          in: path
          description: The identifier (UUID) of the token to be regenerated.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Token regenerated successfully
          content:
            application/vnd.api+json:
              schema:
                title: RegenerateTokenResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Token"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Tokens
      operationId: revokeToken
      summary: Revoke a token
      description: |
        Permanently revokes a token. It cannot be undone. This action also immediately invalidates all sessions using
        the given token.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: token
          in: path
          description: The identifier (UUID) of the token to be revoked.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: Token revoked successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/products:
    post:
      tags:
        - Products
      operationId: createProduct
      summary: Create a product
      description: Creates a new product resource.
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: CreateProductRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [products]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the product.
                        url:
                          type:
                            - string
                            - "null"
                          format: uri
                          description: A related URL for the product.
                        distributionStrategy:
                          type: string
                          enum:
                            - LICENSED
                            - OPEN
                            - CLOSED
                          default: LICENSED
                          description: The strategy for distributing releases.
                        platforms:
                          type: array
                          items:
                            type: string
                          description: An array of platforms the product supports.
                        metadata:
                          type: object
                          description: Object containing product metadata.
                          additionalProperties: true
                      required:
                        - name
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "201":
          description: Product created successfully
          content:
            application/vnd.api+json:
              schema:
                title: CreateProductResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Product"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Products
      operationId: listProducts
      summary: List all products
      description: |
        Returns a list of products. The products are returned sorted by creation date, with the most recent products
        appearing first.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of products to be returned.
      responses:
        "200":
          description: Products retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListProductsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Product"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/products/{product}:
    get:
      tags:
        - Products
      operationId: retrieveProduct
      summary: Retrieve a product
      description: Retrieves the details of an existing product.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: product
          in: path
          description: The identifier (UUID) of the product to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Product retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveProductResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Product"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Products
      operationId: updateProduct
      summary: Update a product
      description: |
        Updates the specified product resource by setting the values of the parameters passed. Any parameters not
        provided will be left unchanged.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: product
          in: path
          description: The identifier (UUID) of the product to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: UpdateProductRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [products]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the product.
                        url:
                          type: string
                          format: uri
                          description: A related URL for the product e.g. the marketing website, company website, etc.
                        distributionStrategy:
                          type: string
                          enum:
                            - LICENSED
                            - OPEN
                            - CLOSED
                          default: LICENSED
                          description: The strategy for distributing releases.
                        platforms:
                          type: array
                          items:
                            type: string
                          description: An array of platforms the product supports.
                        metadata:
                          type: object
                          description: Object containing product metadata.
                          additionalProperties: true
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "200":
          description: Product updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateProductResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Product"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Products
      operationId: deleteProduct
      summary: Delete a product
      description: |
        Permanently deletes a product. It cannot be undone. This action also immediately deletes any policies, licenses
        and machines that the product is associated with.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: product
          in: path
          description: The identifier (UUID) of the product to be deleted.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: Product deleted successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/products/{product}/tokens:
    post:
      tags:
        - Products
      operationId: generateProductToken
      summary: Generate a product token
      description: Generates a new product token resource. Product tokens do not expire.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: product
          in: path
          description: The identifier (UUID) of the product to generate a token for.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: GenerateProductTokenRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [tokens]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: An optional name for the token.
                        expiry:
                          type: string
                          format: date-time
                          description: The timestamp for when the token expires.
                  required:
                    - type
                    - attributes
      responses:
        "200":
          description: Product token generated successfully
          content:
            application/vnd.api+json:
              schema:
                title: GenerateProductTokenResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Token"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/entitlements:
    post:
      tags:
        - Entitlements
      operationId: createEntitlement
      summary: Create an entitlement
      description: Creates a new entitlement resource.
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: CreateEntitlementRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [entitlements]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the entitlement.
                        code:
                          type: string
                          description: The unique code for the entitlement.
                        metadata:
                          type: object
                          description: Object containing entitlement metadata.
                          additionalProperties: true
                      required:
                        - name
                        - code
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "201":
          description: Entitlement created successfully
          content:
            application/vnd.api+json:
              schema:
                title: CreateEntitlementResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Entitlement"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Entitlements
      operationId: listEntitlements
      summary: List all entitlements
      description: |
        Returns a list of entitlements. The entitlements are returned sorted by creation date, with the most recent
        entitlements appearing first. Resources are automatically scoped to the authenticated bearer e.g. when
        authenticated as a license, only entitlements attached to that specific license will be listed.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of entitlements to be returned.
      responses:
        "200":
          description: Entitlements retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListEntitlementsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Entitlement"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/entitlements/{entitlement}:
    get:
      tags:
        - Entitlements
      operationId: retrieveEntitlement
      summary: Retrieve an entitlement
      description: Retrieves the details of an existing entitlement.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: entitlement
          in: path
          description: The identifier (UUID) of the entitlement to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Entitlement retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveEntitlementResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Entitlement"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Entitlements
      operationId: updateEntitlement
      summary: Update an entitlement
      description: |
        Updates the specified entitlement resource by setting the values of the parameters passed. Any parameters not
        provided will be left unchanged.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: entitlement
          in: path
          description: The identifier (UUID) of the entitlement to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: UpdateEntitlementRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [entitlements]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the entitlement.
                        code:
                          type: string
                          description: The unique code for the entitlement.
                        metadata:
                          type: object
                          description: Object containing entitlement metadata.
                          additionalProperties: true
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "200":
          description: Entitlement updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateEntitlementResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Entitlement"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Entitlements
      operationId: deleteEntitlement
      summary: Delete an entitlement
      description: |
        Permanently deletes an entitlement. The entitlement will immediately be removed from all licenses and policies.
        It cannot be undone.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: entitlement
          in: path
          description: The identifier (UUID) of the entitlement to be deleted.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: Entitlement deleted successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/groups:
    post:
      tags:
        - Groups
      operationId: createGroup
      summary: Create a group
      description: Creates a new group resource.
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: CreateGroupRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [groups]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the group.
                        maxUsers:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of users the group can have, collectively.
                        maxLicenses:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of licenses the group can have, collectively.
                        maxMachines:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of machines the group can have, collectively.
                        metadata:
                          type: object
                          description: Object containing group metadata.
                          additionalProperties: true
                      required:
                        - name
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "201":
          description: Group created successfully
          content:
            application/vnd.api+json:
              schema:
                title: CreateGroupResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Group"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Groups
      operationId: listGroups
      summary: List all groups
      description: |
        Returns a list of groups. This will include all groups associated with the authenticated bearer, including
        groups they are an owner of, as well as groups they are a member of. The groups are returned sorted by creation
        date, with the most recent groups appearing first.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of groups to be returned.
      responses:
        "200":
          description: Groups retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListGroupsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Group"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/groups/{group}:
    get:
      tags:
        - Groups
      operationId: retrieveGroup
      summary: Retrieve a group
      description: Retrieves the details of an existing group.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: group
          in: path
          description: The identifier (UUID) of the group to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Group retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveGroupResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Group"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Groups
      operationId: updateGroup
      summary: Update a group
      description: |
        Updates the specified group resource by setting the values of the parameters passed. Any parameters not provided
        will be left unchanged.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: group
          in: path
          description: The identifier (UUID) of the group to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: UpdateGroupRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [groups]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the group.
                        maxUsers:
                          type: integer
                          format: int64
                          description: The maximum number of users the group can have, collectively.
                        maxLicenses:
                          type: integer
                          format: int64
                          description: The maximum number of licenses the group can have, collectively.
                        maxMachines:
                          type: integer
                          format: int64
                          description: The maximum number of machines the group can have, collectively.
                        metadata:
                          type: object
                          description: Object containing group metadata.
                          additionalProperties: true
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "200":
          description: Group updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateGroupResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Group"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Groups
      operationId: deleteGroup
      summary: Delete a group
      description: |
        Permanently deletes a group. The group will immediately be removed from all users, licenses and machines. It
        cannot be undone.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: group
          in: path
          description: The identifier (UUID) of the group to be deleted.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: Group deleted successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/policies:
    post:
      tags:
        - Policies
      operationId: createPolicy
      summary: Create a policy
      description: Creates a new policy resource.
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: CreatePolicyRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum:
                        - policies
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the policy.
                        duration:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The duration for the policy in seconds.
                        scheme:
                          type:
                            - string
                            - "null"
                          enum:
                            - ED25519_SIGN
                            - RSA_2048_PKCS1_PSS_SIGN_V2
                            - RSA_2048_PKCS1_SIGN_V2
                            - RSA_2048_PKCS1_ENCRYPT
                            - RSA_2048_JWT_RS256
                        strict:
                          type: boolean
                          default: false
                          description: |
                            When enabled, a license that implements the policy will be considered invalid if its machine
                            limit, machine core limit, or processes limit is surpassed.
                        floating:
                          type: boolean
                          default: false
                          description: |
                            When enabled, a license that implements the policy will be valid across multiple machines.
                        requireProductScope:
                          type: boolean
                          default: false
                          description: |
                            When enabled, validating a license that implements the policy will require a product scope
                            that matches the licenses's product relationship by its identifier (UUID).
                        requirePolicyScope:
                          type: boolean
                          default: false
                          description: |
                            When enabled, validating a license that implements the policy will require a policy scope
                            that matches the licenses's policy relationship by its identifier (UUID).
                        requireMachineScope:
                          type: boolean
                          default: false
                          description: |
                            When enabled, validating a license that implements the policy will require a machine scope
                            that matches at least 1 of the licenses's machine relationships by its identifier (UUID).
                        requireFingerprintScope:
                          type: boolean
                          default: false
                          description: |
                            When enabled, validating a license that implements the policy will require a fingerprint
                            scope that matches at least 1 of the licenses's machine relationships by its fingerprint.
                        requireUserScope:
                          type: boolean
                          default: false
                          description: |
                            When enabled, validating a license that implements the policy will require a user scope that
                            matches the license's user relationship.
                        requireChecksumScope:
                          type: boolean
                          default: false
                          description: |
                            When enabled, validating a license that implements the policy will require a checksum scope
                            to be provided, matching an accessible artifact for the license.
                        requireVersionScope:
                          type: boolean
                          default: false
                          description: |
                            When enabled, validating a license that implements the policy will require a version scope
                            to be provided, matching an accessible release for the license.
                        requireCheckIn:
                          type: boolean
                          default: false
                          description: |
                            When enabled, a license that implements the policy will require check-in at a predefined
                            interval to continue to pass validation i.e. if a license misses a check-in, it will be
                            invalidated.
                        checkInInterval:
                          type:
                            - string
                            - "null"
                          enum:
                            - day
                            - week
                            - month
                            - year
                          description: The frequency at which a license should check-in.
                        checkInIntervalCount:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: |
                            The number of intervals (specified in the check-in interval property) between each required
                            check-in.
                        usePool:
                          type: boolean
                          default: false
                          description: Whether or not to pull license keys from a finite pool of pre-determined keys.
                        maxMachines:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: |
                            The maximum number of machines a license implementing the policy can have associated with
                            it.
                        maxProcesses:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: |
                            The maximum number of machine processes a license implementing the policy can have
                            associated with it, also depending on the policy's leasing strategy.
                        maxCores:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: |
                            The maximum number of machine CPU cores a license implementing the policy can have
                            associated with it.
                        maxUses:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of uses a license implementing the policy can have.
                        protected:
                          type: boolean
                          description: Whether or not the policy is protected.
                        requireHeartbeat:
                          type: boolean
                          default: false
                          description: Whether or not the policy requires its machines to maintain a heartbeat.
                        heartbeatDuration:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The heartbeat duration for the policy, in seconds.
                        heartbeatCullStrategy:
                          type: string
                          enum:
                            - DEACTIVATE_DEAD
                            - KEEP_DEAD
                          default: DEACTIVATE_DEAD
                          description: The strategy used for culling dead machines and processes.
                        heartbeatResurrectionStrategy:
                          type: string
                          enum:
                            - NO_REVIVE
                            - 1_MINUTE_REVIVE
                            - 2_MINUTE_REVIVE
                            - 5_MINUTE_REVIVE
                            - 10_MINUTE_REVIVE
                            - 15_MINUTE_REVIVE
                            - ALWAYS_REVIVE
                          default: NO_REVIVE
                          description: |
                            The strategy used for controlling whether or not dead machines and processes can be
                            resurrected shortly after death.
                        heartbeatBasis:
                          type: string
                          enum:
                            - FROM_CREATION
                            - FROM_FIRST_PING
                          description: Control when a machine's initial heartbeat is started.
                        machineUniquenessStrategy:
                          type: string
                          enum:
                            - UNIQUE_PER_ACCOUNT
                            - UNIQUE_PER_PRODUCT
                            - UNIQUE_PER_POLICY
                            - UNIQUE_PER_LICENSE
                          default: UNIQUE_PER_LICENSE
                          description: The uniqueness validation strategy for machine fingerprints.
                        machineMatchingStrategy:
                          type: string
                          enum:
                            - MATCH_ANY
                            - MATCH_TWO
                            - MATCH_MOST
                            - MATCH_ALL
                          default: MATCH_ANY
                          description: |
                            The matching strategy for machine fingerprints supplied during a license validation.
                        componentUniquenessStrategy:
                          type: string
                          enum:
                            - UNIQUE_PER_ACCOUNT
                            - UNIQUE_PER_PRODUCT
                            - UNIQUE_PER_POLICY
                            - UNIQUE_PER_LICENSE
                            - UNIQUE_PER_MACHINE
                          default: UNIQUE_PER_MACHINE
                          description: |
                            The uniqueness validation strategy for component fingerprints.
                        componentMatchingStrategy:
                          type: string
                          enum:
                            - MATCH_ANY
                            - MATCH_TWO
                            - MATCH_MOST
                            - MATCH_ALL
                          default: MATCH_ANY
                          description: |
                            The matching strategy for component fingerprints supplied during a license validation.
                        expirationStrategy:
                          type: string
                          enum:
                            - RESTRICT_ACCESS
                            - REVOKE_ACCESS
                            - MAINTAIN_ACCESS
                            - ALLOW_ACCESS
                          default: RESTRICT_ACCESS
                          description: |
                            The strategy for expired licenses during a license validation and when accessing releases.
                        expirationBasis:
                          type: string
                          enum:
                            - FROM_CREATION
                            - FROM_FIRST_VALIDATION
                            - FROM_FIRST_ACTIVATION
                            - FROM_FIRST_DOWNLOAD
                            - FROM_FIRST_USE
                          default: FROM_CREATION
                          description: Control when a license's initial expiry is set.
                        transferStrategy:
                          type: string
                          enum:
                            - RESET_EXPIRY
                            - KEEP_EXPIRY
                          default: KEEP_EXPIRY
                          description: Control whether a license's expiration is reset when transferred to this policy.
                        authenticationStrategy:
                          type: string
                          enum:
                            - TOKEN
                            - LICENSE
                            - MIXED
                            - NONE
                          default: TOKEN
                          description: The strategy used for authenticating as a license, for client-side integrations.
                        machineLeasingStrategy:
                          type: string
                          enum:
                            - PER_LICENSE
                            - PER_USER
                          description: |
                            The strategy used for leasing machines.

                            Please note that a nil owner is significant for a PER_USER leasing strategy. When a machine's owner is nil (or null), the sum of all machines with a nil owner will be counted towards the license's machine limit. Please make sure that you're assigning an owner to machines if you utilize this leasing strategy.

                            This defines how machines are leased and counted, especially i.r.t. the policy's max machines limit.

                            ### Options

                            - **`PER_LICENSE`**:
                              Machines are counted per-license. For example, with a max machines value of 2, each license could have 2 machines. This is the default.
                            - **`PER_USER`**:
                              Machines are counted per-user, per-license. For example, with a max machines value of 2, each user could have 2 machines per-license.
                        processLeasingStrategy:
                          type: string
                          enum:
                            - PER_MACHINE
                            - PER_LICENSE
                            - PER_USER
                          description: |
                            The strategy used for leasing machine processes.

                            Please note that a nil owner is significant for a PER_USER leasing strategy. When a machine's owner is nil (or null), the sum of all processes belonging to a machine with a nil owner will be counted towards the license's process limit. Please make sure that you're assigning an owner to machines if you utilize this leasing strategy.

                            This defines how processes are leased and counted, especially i.r.t. the policy's max processes limit.

                            ### Options

                            - **`PER_MACHINE`**:
                              Processes are counted per-machine. For example, given a policy with a max processes value of 5, each license could have up to 5 processes for each machine. This is the default.
                            - **`PER_LICENSE`**:
                              Processes are counted per-license. For example, with a max processes value of 5, each license could have up to 5 processes combined across all machines.
                            - **`PER_USER`**:
                              Processes are counted per-user, per-license. For example, with a max processes value of 5, each user could have up to 5 processes combined across all owned machines per-license.
                        overageStrategy:
                          type: string
                          enum:
                            - ALWAYS_ALLOW_OVERAGE
                            - ALLOW_1_25X_OVERAGE
                            - ALLOW_1_5X_OVERAGE
                            - ALLOW_2X_OVERAGE
                            - NO_OVERAGE
                          default: NO_OVERAGE
                          description: The strategy used for allowing machine, core and process overages.
                        metadata:
                          type: object
                          description: Object containing policy metadata.
                          additionalProperties: true
                      required:
                        - name
                    relationships:
                      type: object
                      properties:
                        product:
                          type: object
                          description: The product the policy is for.
                          properties:
                            data:
                              type: object
                              properties:
                                type:
                                  type: string
                                  enum: [products]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                      required:
                        - product
                  required:
                    - type
                    - attributes
                    - relationships
              required:
                - data
      responses:
        "201":
          description: Policy created successfully
          content:
            application/vnd.api+json:
              schema:
                title: CreatePolicyResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Policy"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Policies
      operationId: listPolicies
      summary: List all policies
      description: |
        Returns a list of policies. The policies are returned sorted by creation date, with the most recent policies
        appearing first. Resources are automatically scoped to the authenticated bearer e.g. when authenticated as a
        product, only policies of that specific product will be listed.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of policies to be returned.
        - name: product
          in: query
          description: The identifier (UUID) of the product to filter by.
          required: false
          schema:
            type: string
      responses:
        "200":
          description: Policies retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListPoliciesResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Policy"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/policies/{policy}:
    get:
      tags:
        - Policies
      operationId: retrievePolicy
      summary: Retrieve a policy
      description: Retrieves the details of an existing policy.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: policy
          in: path
          description: The identifier (UUID) of the policy to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Policy retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrievePolicyResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Policy"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Policies
      operationId: updatePolicy
      summary: Update a policy
      description: |
        Updates the specified policy resource by setting the values of the parameters passed. Any parameters not
        provided will be left unchanged. For example, if the `maxMachines` property is not provided, then the policy's
        `maxMachines` value will be left unchanged. However, if the `maxMachines` property is provided with a value of
        `null`, then the policy's `maxMachines` value will be updated to `null`.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: policy
          in: path
          description: The identifier (UUID) of the policy to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: UpdatePolicyRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum:
                        - policies
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the policy.
                        duration:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The duration for the policy in seconds.
                        scheme:
                          type:
                            - string
                            - "null"
                          enum:
                            - ED25519_SIGN
                            - RSA_2048_PKCS1_PSS_SIGN_V2
                            - RSA_2048_PKCS1_SIGN_V2
                            - RSA_2048_PKCS1_ENCRYPT
                            - RSA_2048_JWT_RS256
                        strict:
                          type: boolean
                          description: |
                            When enabled, a license that implements the policy will be considered invalid if its machine
                            limit, machine core limit, or processes limit is surpassed.
                        floating:
                          type: boolean
                          description: |
                            When enabled, a license that implements the policy will be valid across multiple machines.
                        requireProductScope:
                          type: boolean
                          description: |
                            When enabled, validating a license that implements the policy will require a product scope
                            that matches the licenses's product relationship by its identifier (UUID).
                        requirePolicyScope:
                          type: boolean
                          description: |
                            When enabled, validating a license that implements the policy will require a policy scope
                            that matches the licenses's policy relationship by its identifier (UUID).
                        requireMachineScope:
                          type: boolean
                          description: |
                            When enabled, validating a license that implements the policy will require a machine scope
                            that matches at least 1 of the licenses's machine relationships by its identifier (UUID).
                        requireFingerprintScope:
                          type: boolean
                          description: |
                            When enabled, validating a license that implements the policy will require a fingerprint
                            scope that matches at least 1 of the licenses's machine relationships by its fingerprint.
                        requireUserScope:
                          type: boolean
                          description: |
                            When enabled, validating a license that implements the policy will require a user scope that
                            matches the license's user relationship.
                        requireChecksumScope:
                          type: boolean
                          description: |
                            When enabled, validating a license that implements the policy will require a checksum scope
                            to be provided, matching an accessible artifact for the license.
                        requireVersionScope:
                          type: boolean
                          description: |
                            When enabled, validating a license that implements the policy will require a version scope
                            to be provided, matching an accessible release for the license.
                        requireCheckIn:
                          type: boolean
                          default: false
                          description: |
                            When enabled, a license that implements the policy will require check-in at a predefined
                            interval to continue to pass validation i.e. if a license misses a check-in, it will be
                            invalidated.
                        checkInInterval:
                          type:
                            - string
                            - "null"
                          enum:
                            - day
                            - week
                            - month
                            - year
                          description: The frequency at which a license should check-in.
                        checkInIntervalCount:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: |
                            The number of intervals (specified in the check-in interval property) between each required
                            check-in.
                        maxMachines:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: |
                            The maximum number of machines a license implementing the policy can have associated with
                            it.
                        maxProcesses:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: |
                            The maximum number of machine processes a license implementing the policy can have
                            associated with it, also depending on the policy's leasing strategy.
                        maxCores:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: |
                            The maximum number of machine CPU cores a license implementing the policy can have
                            associated with it.
                        maxUses:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of uses a license implementing the policy can have.
                        protected:
                          type: boolean
                          description: Whether or not the policy is protected.
                        requireHeartbeat:
                          type: boolean
                          description: Whether or not the policy requires its machines to maintain a heartbeat.
                        heartbeatDuration:
                          type: integer
                          format: int64
                          description: The heartbeat duration for the policy, in seconds.
                        heartbeatCullStrategy:
                          type: string
                          enum:
                            - DEACTIVATE_DEAD
                            - KEEP_DEAD
                          description: The strategy used for culling dead machines and processes.
                        heartbeatResurrectionStrategy:
                          type: string
                          enum:
                            - NO_REVIVE
                            - 1_MINUTE_REVIVE
                            - 2_MINUTE_REVIVE
                            - 5_MINUTE_REVIVE
                            - 10_MINUTE_REVIVE
                            - 15_MINUTE_REVIVE
                            - ALWAYS_REVIVE
                          description: |
                            The strategy used for controlling whether or not dead machines and processes can be
                            resurrected shortly after death.
                        heartbeatBasis:
                          type: string
                          enum:
                            - FROM_CREATION
                            - FROM_FIRST_PING
                          description: Control when a machine's initial heartbeat is started.
                        machineUniquenessStrategy:
                          type: string
                          enum:
                            - UNIQUE_PER_ACCOUNT
                            - UNIQUE_PER_PRODUCT
                            - UNIQUE_PER_POLICY
                            - UNIQUE_PER_LICENSE
                          description: The uniqueness validation strategy for machine fingerprints.
                        machineMatchingStrategy:
                          type: string
                          enum:
                            - MATCH_ANY
                            - MATCH_TWO
                            - MATCH_MOST
                            - MATCH_ALL
                          description: |
                            The matching strategy for machine fingerprints supplied during a license validation.
                        expirationStrategy:
                          type: string
                          enum:
                            - RESTRICT_ACCESS
                            - REVOKE_ACCESS
                            - MAINTAIN_ACCESS
                            - ALLOW_ACCESS
                          description: |
                            The strategy for expired licenses during a license validation and when accessing releases.
                        expirationBasis:
                          type: string
                          enum:
                            - FROM_CREATION
                            - FROM_FIRST_VALIDATION
                            - FROM_FIRST_ACTIVATION
                            - FROM_FIRST_DOWNLOAD
                            - FROM_FIRST_USE
                          description: Control when a license's initial expiry is set.
                        transferStrategy:
                          type: string
                          enum:
                            - RESET_EXPIRY
                            - KEEP_EXPIRY
                          description: Control whether a license's expiration is reset when transferred to this policy.
                        authenticationStrategy:
                          type: string
                          enum:
                            - TOKEN
                            - LICENSE
                            - MIXED
                            - NONE
                          description: The strategy used for authenticating as a license, for client-side integrations.
                        machineLeasingStrategy:
                          type: string
                          enum:
                            - PER_LICENSE
                            - PER_USER
                          description: |
                            The strategy used for leasing machines.

                            Please note that a nil owner is significant for a PER_USER leasing strategy. When a machine's owner is nil (or null), the sum of all machines with a nil owner will be counted towards the license's machine limit. Please make sure that you're assigning an owner to machines if you utilize this leasing strategy.

                            This defines how machines are leased and counted, especially i.r.t. the policy's max machines limit.

                            ### Options

                            - **`PER_LICENSE`**:
                              Machines are counted per-license. For example, with a max machines value of 2, each license could have 2 machines. This is the default.
                            - **`PER_USER`**:
                              Machines are counted per-user, per-license. For example, with a max machines value of 2, each user could have 2 machines per-license.
                        processLeasingStrategy:
                          type: string
                          enum:
                            - PER_MACHINE
                            - PER_LICENSE
                            - PER_USER
                          description: |
                            The strategy used for leasing machine processes.

                            Please note that a nil owner is significant for a PER_USER leasing strategy. When a machine's owner is nil (or null), the sum of all processes belonging to a machine with a nil owner will be counted towards the license's process limit. Please make sure that you're assigning an owner to machines if you utilize this leasing strategy.

                            This defines how processes are leased and counted, especially i.r.t. the policy's max processes limit.

                            ### Options

                            - **`PER_MACHINE`**:
                              Processes are counted per-machine. For example, given a policy with a max processes value of 5, each license could have up to 5 processes for each machine. This is the default.
                            - **`PER_LICENSE`**:
                              Processes are counted per-license. For example, with a max processes value of 5, each license could have up to 5 processes combined across all machines.
                            - **`PER_USER`**:
                              Processes are counted per-user, per-license. For example, with a max processes value of 5, each user could have up to 5 processes combined across all owned machines per-license.
                        overageStrategy:
                          type: string
                          enum:
                            - ALWAYS_ALLOW_OVERAGE
                            - ALLOW_1_25X_OVERAGE
                            - ALLOW_1_5X_OVERAGE
                            - ALLOW_2X_OVERAGE
                            - NO_OVERAGE
                          description: The strategy used for allowing machine, core and process overages.
                        metadata:
                          type: object
                          description: Object containing policy metadata.
                          additionalProperties: true
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "200":
          description: Policy updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdatePolicyResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Policy"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Policies
      operationId: deletePolicy
      summary: Delete a policy
      description: |
        Permanently deletes a policy. It cannot be undone. This action also immediately deletes any licenses that the
        policy is associated with.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: policy
          in: path
          description: The identifier (UUID) of the policy to be deleted.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: Policy deleted successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/policies/{policy}/pool:
    delete:
      tags:
        - Policies
      operationId: popKeyFromPolicyPool
      summary: Pop key from pool
      description: |
        Pop off (delete) a key from the policy's pool of pre-determined keys. The returned key is only available
        directly after a pop, similar to authentication tokens. This cannot be undone.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: policy
          in: path
          description: The identifier (UUID) of the policy to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: Policy pool key popped successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/policies/{policy}/entitlements:
    post:
      tags:
        - Policies
      operationId: attachPolicyEntitlements
      summary: Attach policy entitlements
      description: |
        Attach entitlements to a policy. This will immediately be taken into effect for all future license validations.
        Any license that implements the given policy will automatically possess all the policy's entitlements.

        **Below are the limitations to attaching an entitlement:**

        - You cannot attach an already attached entitlement.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: policy
          in: path
          description: The identifier (UUID) of the policy to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: AttachPolicyEntitlementsRequest
              type: object
              properties:
                data:
                  type: array
                  items:
                    type: object
                    properties:
                      type:
                        type: string
                        enum:
                          - entitlements
                      id:
                        type: string
                    required:
                      - type
                      - id
              required:
                - data
      responses:
        "201":
          description: Policy entitlements attached successfully
          content:
            application/vnd.api+json:
              schema:
                title: AttachPolicyEntitlementsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/PolicyEntitlement"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Policies
      operationId: detachPolicyEntitlements
      summary: Detach policy entitlements
      description: |
        Detach entitlements from a policy. This will immediately be taken into effect for all future license
        validations.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: policy
          in: path
          description: The identifier (UUID) of the policy to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: DetachPolicyEntitlementsRequest
              type: object
              properties:
                data:
                  type: array
                  items:
                    type: object
                    properties:
                      type:
                        type: string
                        enum:
                          - entitlements
                      id:
                        type: string
                    required:
                      - type
                      - id
              required:
                - data
      responses:
        "204":
          description: Policy entitlements detached successfully
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Policies
      operationId: listPolicyEntitlements
      summary: List policy entitlements
      description: |
        Returns a list of entitlements attached to the policy. The entitlements are returned sorted by creation date,
        with the most recent entitlements appearing first.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of entitlements to be returned.
        - name: policy
          in: path
          description: The identifier (UUID) of the policy to list entitlements for.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Policy entitlements retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListPolicyEntitlementsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Entitlement"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users:
    post:
      tags:
        - Users
      operationId: createUser
      summary: Create a user
      description: |
        Creates a new user resource. Users may be created with only an email address — no name or password is
        necessarily required. This can act as a way to associate an email address with a license, which can later be
        claimed and turned into a full user profile, if needed, using the password reset flow. This is particularly
        great for custom license recovery flows, where you may need to email a user their lost license keys.
      security:
        - {}
        - BearerToken: []
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: CreateUserRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [users]
                    attributes:
                      type: object
                      properties:
                        firstName:
                          type: string
                          description: The first name of the user.
                        lastName:
                          type: string
                          description: The last name of the user.
                        email:
                          type: string
                          description: The unique email of the user.
                        password:
                          type: string
                          description: The password for the user.
                        role:
                          type: string
                          default: user
                          enum:
                            - user
                            - support-agent
                            - sales-agent
                            - developer
                            - read-only
                            - admin
                          description: The role of the user.
                        metadata:
                          type: object
                          description: Object containing user metadata.
                          additionalProperties: true
                      required:
                        - email
                    relationships:
                      type: object
                      properties:
                        group:
                          type: object
                          description: The group the user belongs to.
                          properties:
                            data:
                              type:
                                - object
                                - "null"
                              properties:
                                type:
                                  type: string
                                  enum: [groups]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "201":
          description: User created successfully
          content:
            application/vnd.api+json:
              schema:
                title: CreateUserResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Users
      operationId: listUsers
      summary: List all users
      description: |
        Returns a list of users. The users are returned sorted by creation date, with the most recent users appearing
        first. Resources are automatically scoped to the authenticated bearer e.g. when authenticated as a product, only
        users associated with the specific product, through a license, will be listed in the results.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of users to be returned.
        - name: status
          in: query
          description: The status of the user to filter by.
          required: false
          schema:
            type: string
            enum:
              - ACTIVE
              - INACTIVE
              - BANNED
        - name: assigned
          in: query
          description: Only show users assigned a license.
          required: false
          schema:
            type: boolean
        - name: product
          in: query
          description: The identifier (UUID) of the product to filter by.
          required: false
          schema:
            type: string
        - name: group
          in: query
          description: The identifier (UUID) of the group to filter by.
          required: false
          schema:
            type: string
        - name: roles
          in: query
          description: Array containing role names to filter by.
          required: false
          schema:
            type: array
            items:
              type: string
              enum:
                - user
                - support-agent
                - sales-agent
                - developer
                - read-only
                - admin
        - name: metadata
          in: query
          description: The metadata object to filter by.
          required: false
          style: deepObject
          explode: true
          schema:
            type: object
            additionalProperties: true
      responses:
        "200":
          description: Users retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListUsersResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/User"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}:
    get:
      tags:
        - Users
      operationId: retrieveUser
      summary: Retrieve a user
      description: |
        Retrieves the details of an existing user.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: User retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveUserResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Users
      summary: Update a user
      operationId: updateUser
      description: |
        Updates the specified user resource by setting the values of the parameters passed. Any parameters not provided
        will be left unchanged.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: UpdateUserRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [users]
                    attributes:
                      type: object
                      properties:
                        firstName:
                          type: string
                          description: The first name of the user.
                        lastName:
                          type: string
                          description: The last name of the user.
                        email:
                          type: string
                          description: The unique email of the user.
                        password:
                          type: string
                          description: The password for the user.
                        role:
                          type: string
                          default: user
                          enum:
                            - user
                            - support-agent
                            - sales-agent
                            - developer
                            - read-only
                            - admin
                          description: The role of the user.
                        metadata:
                          type: object
                          description: Object containing user metadata.
                          additionalProperties: true
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "200":
          description: User updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateUserResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Users
      operationId: deleteUser
      summary: Delete a user
      description: |
        Permanently deletes a user. It cannot be undone. This action also immediately deletes any licenses and machines
        that the user is associated with.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to be deleted.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: User deleted successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}/actions/update-password:
    post:
      tags:
        - Users
      operationId: updateUserPassword
      summary: Update password
      description: |
        Action to update the user's password. A user's password can **only** be updated when authenticated as the given
        user. To update the user's password as an admin, use the [update user endpoint](https://keygen.sh/docs/api/users/#users-update).
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to be retrieved.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: UpdateUserPasswordRequest
              type: object
              properties:
                meta:
                  type: object
                  properties:
                    oldPassword:
                      type: string
                      description: The current password for the user.
                    newPassword:
                      type: string
                      minLength: 8
                      description: The new password for the user.
                  required:
                    - oldPassword
                    - newPassword
              required:
                - meta
      responses:
        "200":
          description: Password updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateUserPasswordResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}/actions/reset-password:
    post:
      tags:
        - Users
      operationId: resetUserPassword
      summary: Reset password
      description: |
        Fulfill a user's password reset request. Password reset tokens expire 24 hours after [requesting the reset](https://keygen.sh/docs/api/passwords/#passwords-forgot).
        For an example of self-hosting your password reset flow, please [see this repo](https://github.com/keygen-sh/example-password-reset-fulfillment).
        Alternatively, you can use [our Zapier integration](https://zapier.com/apps/keygen/integrations).

        When the account is protected, and the user does not yet have a password set, they will not be able to set their
        initial password. Only admins may set the password for a passwordless user, unless the account is unprotected.
      security:
        - {}
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to be retrieved.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ResetUserPasswordRequest
              type: object
              properties:
                meta:
                  type: object
                  properties:
                    passwordResetToken:
                      type: string
                      description: The password reset token emailed to the user.
                    newPassword:
                      type: string
                      minLength: 8
                      description: The new password for the user.
                  required:
                    - passwordResetToken
                    - newPassword
              required:
                - meta
      responses:
        "200":
          description: Password reset successfully
          content:
            application/vnd.api+json:
              schema:
                title: ResetUserPasswordResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}/actions/ban:
    post:
      tags:
        - Users
      operationId: banUser
      summary: Ban user
      description: |
        Action to ban a user. Banned users cannot authenticate with the API, and all licenses the user owns will have a
        `BANNED` status.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: User banned successfully
          content:
            application/vnd.api+json:
              schema:
                title: BanUserResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}/actions/unban:
    post:
      tags:
        - Users
      operationId: unbanUser
      summary: Unban user
      description: Action to unban a user.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: User unbanned successfully
          content:
            application/vnd.api+json:
              schema:
                title: UnbanUserResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}/tokens:
    post:
      tags:
        - Users
      operationId: generateUserToken
      summary: Generate a user token
      description: |
        Generates a new user token resource. User tokens, by default, expire after 2 weeks. Though this can be adjusted
        via the `expiry` attribute. Typically, you'd want to generate a token using [the tokens resource](https://keygen.sh/docs/api/tokens/#tokens-generate),
        using the user's email and password. But this endpoint can be used by admins to generate a token on a user's behalf.

        This endpoint is particularly useful for generating tokens for a user without a password, or if you want to
        manage logins another way, e.g. server-side.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to generate a token for.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: GenerateUserTokenRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [tokens]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: An optional name for the token.
                        expiry:
                          type: string
                          format: date-time
                          description: The timestamp for when the token expires.
                  required:
                    - type
                    - attributes
      responses:
        "200":
          description: User token generated successfully
          content:
            application/vnd.api+json:
              schema:
                title: GenerateUserTokenResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Token"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}/group:
    put:
      tags:
        - Users
      operationId: changeUserGroup
      summary: Change group
      description: |
        Change a user's group relationship. This will immediately transfer the user resource to the new group. Changing
        the user's group will not retroactively change the group of its licenses or of its machines.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ChangeUserGroupRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [groups]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
      responses:
        "200":
          description: Group changed successfully
          content:
            application/vnd.api+json:
              schema:
                title: ChangeUserGroupResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses:
    post:
      tags:
        - Licenses
      operationId: createLicense
      summary: Create a license
      description: Creates a new license resource.
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: CreateLicenseRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [licenses]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the license.
                        key:
                          type: string
                          description: A unique pre-determined key for the license.
                        expiry:
                          type:
                            - string
                            - "null"
                          format: date-time
                          description: When the license will expire.
                        maxMachines:
                          type: integer
                          format: int64
                          description: The maximum number of machines the license can have associated with it.
                        maxProcesses:
                          type: integer
                          format: int64
                          description: The maximum number of machine processes the license can have associated with it.
                        maxUsers:
                          type: integer
                          format: int64
                          description: |
                            The maximum number of users the license can have associated with it. This is by default inherited from the policy, but can be overridden on a per-license basis.
                        maxCores:
                          type: integer
                          format: int64
                          description: The maximum number of machine CPU cores the license can have associated with it.
                        maxUses:
                          type: integer
                          format: int64
                          description: The maximum number of uses the license is allowed to have.
                        protected:
                          type: boolean
                          description: Whether or not the license is protected.
                        suspended:
                          type: boolean
                          description: Whether or not the license is suspended.
                        metadata:
                          type: object
                          description: Object containing license metadata.
                          additionalProperties: true
                    relationships:
                      type: object
                      properties:
                        policy:
                          type: object
                          description: The policy that the license implements.
                          properties:
                            data:
                              type: object
                              properties:
                                type:
                                  type: string
                                  enum: [policies]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                        owner:
                          type: object
                          description: The user that owns the license.
                          properties:
                            data:
                              type:
                                - object
                                - "null"
                              properties:
                                type:
                                  type: string
                                  enum: [users]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                        group:
                          type: object
                          description: The group that the license belongs to.
                          properties:
                            data:
                              type:
                                - object
                                - "null"
                              properties:
                                type:
                                  type: string
                                  enum: [groups]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                      required:
                        - policy
                  required:
                    - type
                    - relationships
              required:
                - data
      responses:
        "201":
          description: License created successfully
          content:
            application/vnd.api+json:
              schema:
                title: CreateLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Licenses
      operationId: listLicenses
      summary: List all licenses
      description: |
        Returns a list of licenses. The licenses are returned sorted by creation date, with the most recent licenses
        appearing first. Resources are automatically scoped to the authenticated bearer e.g. when authenticated as a
        user, only licenses of that specific user will be listed.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of licenses to be returned.
        - name: expires
          in: query
          description: Object containing `in`, `before`, or `after` filters.
          required: false
          style: deepObject
          explode: true
          schema:
            title: ListLicensesExpiresParameter
            type: object
            properties:
              in:
                type: string
                description: |
                  The duration in seconds or ISO8601 duration to query licenses expiring within. Accepts a duration in
                  seconds e.g. 2629746, or an ISO8601 duration e.g. 30d.
              before:
                type: string
                format: date-time
                description: The ISO8601 timestamp to query licenses expiring before.
              after:
                type: string
                format: date-time
                description: The ISO8601 timestamp to query licenses expiring after.
        - name: status
          in: query
          description: The status of the license to filter by.
          required: false
          schema:
            type: string
            enum:
              - ACTIVE
              - INACTIVE
              - EXPIRING
              - EXPIRED
              - SUSPENDED
              - BANNED
        - name: unassigned
          in: query
          description: The user-relationship status of the license to filter by.
          required: false
          schema:
            type: boolean
        - name: product
          in: query
          description: The identifier (UUID) of the product to filter by.
          required: false
          schema:
            type: string
        - name: policy
          in: query
          description: The identifier (UUID) of the policy to filter by.
          required: false
          schema:
            type: string
        - name: user
          in: query
          description: The identifier (UUID) or email of the user to filter by.
          required: false
          schema:
            type: string
        - name: group
          in: query
          description: The identifier (UUID) of the group to filter by.
          required: false
          schema:
            type: string
        - name: machine
          in: query
          description: The identifier (UUID) of the machine to filter by.
          required: false
          schema:
            type: string
        - name: metadata
          in: query
          description: The metadata object to filter by.
          required: false
          style: deepObject
          explode: true
          schema:
            type: object
            additionalProperties: true
      responses:
        "200":
          description: Licenses retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListLicensesResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/License"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}:
    get:
      tags:
        - Licenses
      operationId: retrieveLicense
      summary: Retrieve a license
      description: Retrieves the details of an existing license.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: |
            The identifier (UUID) or URL-safe key of the license to be retrieved.
            key.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Licenses
      operationId: updateLicense
      summary: Update a license
      description: |
        Updates the specified license resource by setting the values of the parameters passed. Any parameters not
        provided will be left unchanged.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or URL-safe key of the license to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: UpdateLicenseRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [licenses]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the license.
                        expiry:
                          type:
                            - string
                            - "null"
                          format: date-time
                          description: When the license will expire.
                        maxMachines:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of machines the license can have associated with it.
                        maxProcesses:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of machine processes the license can have associated with it.
                        maxCores:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of machine CPU cores the license can have associated with it.
                        maxUses:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The maximum number of uses the license is allowed to have.
                        protected:
                          type: boolean
                          description: Whether or not the license is protected.
                        suspended:
                          type: boolean
                          description: Whether or not the license is suspended.
                        metadata:
                          type: object
                          description: Object containing license metadata.
                          additionalProperties: true
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "200":
          description: License updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Licenses
      operationId: deleteLicense
      summary: Delete a license
      description: |
        Permanently deletes a license. It cannot be undone. This action also immediately deletes any machines that the
        license is associated with.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or URL-safe key of the license to be deleted.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: License deleted successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/validate:
    post:
      tags:
        - Licenses
      operationId: validateLicense
      summary: Validate by license ID
      description: |
        Action to validate a license. This will check the following: if the license is suspended, if the license is
        expired, if the license is overdue for check-in, and if the license meets its machine requirements
        (if [strict](https://keygen.sh/docs/api/policies/#policies-object-attrs-strict)).

        Additional scopes can also be applied, and may be required by the license's policy, e.g. a policy may set
        `requireFingerprintScope=true`, which will require that you specify a `scope.fingerprint` within the validation
        request in order to pass validation.

        The scoping feature allows you to easily set up a node-locked or floating licensing model without additional
        logic on your end.

        ### Validation codes

        Below are the possible values for the `meta.code` key within the validation response. This can be used to better
        communicate failures to end-users and to handle specific failures within your application code.

        | Code                       | Meaning                                                                         |
        |----------------------------|---------------------------------------------------------------------------------|
        | VALID                      | License is valid.                                                               |
        | SUSPENDED                  | License is suspended.                                                           |
        | EXPIRED                    | License is expired.                                                             |
        | OVERDUE                    | License is not found.                                                           |
        | NO_MACHINE                 | License is overdue for check-in.                                                |
        | NO_MACHINES                | License has reached its max machine limit.                                      |
        | TOO_MANY_MACHINES          | License has reached its max process limit.                                      |
        | TOO_MANY_CORES             | License has reached its max core limit.                                         |
        | TOO_MANY_PROCESSES         | License has reached its max use limit.                                          |
        | FINGERPRINT_SCOPE_REQUIRED | License does not have a scope.                                                  |
        | FINGERPRINT_SCOPE_MISMATCH | License scope does not match request scope.                                     |
        | FINGERPRINT_SCOPE_EMPTY    | License scope is invalid.                                                       |
        | COMPONENTS_SCOPE_REQUIRED  | License scope is invalid.                                                       |
        | COMPONENTS_SCOPE_MISMATCH  | None or not enough of the validated license's machine components match the      |
        |                            | provided components scope.                                                      |
        | USER_SCOPE_REQUIRED        | The validated license requires a yser scope to be provided during validation.   |
        | USER_SCOPE_MISMATCH        | The validated license's user relationship does not match the provided user      |
        |                            | scope.                                                                          |
        | HEARTBEAT_NOT_STARTED      | The validated machine or fingerprint scope requires a heartbeat but one is not  |
        |                            | started.                                                                        |
        | HEARTBEAT_DEAD             | The validated machine or fingerprint scope belongs to a dead machine.           |
        | BANNED                     | The user that owns the validated license has been banned.                       |
        | PRODUCT_SCOPE_REQUIRED     | The validated license requires a product scope to be provided during            |
        |                            | validation.                                                                     |
        | PRODUCT_SCOPE_MISMATCH     | The validated license's product relationship does not match the provided        |
        |                            | product scope.                                                                  |
        | POLICY_SCOPE_REQUIRED      | The validated license requires a policy scope to be provided during validation. |
        | POLICY_SCOPE_MISMATCH      | The validated license's policy relationship does not match the provided policy  |
        |                            | scope.                                                                          |
        | MACHINE_SCOPE_REQUIRED     | The validated license requires a machine scope to be provided during            |
        |                            | validation.                                                                     |
        | MACHINE_SCOPE_MISMATCH     | None of the validated license's machine relationships match the provided        |
        |                            | machine scope.                                                                  |
        | ENTITLEMENTS_MISSING       | The validated license's entitlement relationship is missing one or more of the  |
        |                            | entitlement scope assertions.                                                   |
        | ENTITLEMENTS_SCOPE_EMPTY   | An entitlements scope was supplied but it has an empty value.                   |
        | VERSION_SCOPE_REQUIRED     | The validated license requires a version scope to be provided during            |
        |                            | validation.                                                                     |
        | VERSION_SCOPE_MISMATCH     | None of the validated license's accessible releases match the provided version  |
        |                            | scope, i.e. the release does not exist or it is inaccessible.                   |
        | CHECKSUM_SCOPE_REQUIRED    | The validated license requires a checksum scope to be provided during           |
        |                            | validation.                                                                     |
        | CHECKSUM_SCOPE_MISMATCH    | None of the validated license's accessible artifacts match the provided         |
        |                            | checksum scope, i.e. a matching artifact does not exist or it is inaccessible.  |
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: |
            The identifier (UUID) or URL-safe key of the license to be validated.
            key.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: ValidateLicenseRequest
              type: object
              properties:
                meta:
                  type: object
                  properties:
                    nonce:
                      type: string
                      description: |
                        An arbitrary numerical nonce value that will be echoed back within the signed response body.
                    scope:
                      type: object
                      description: |
                        Scope to validate the license against i.e. if a license's key is associated with product X,
                        but the validation request is scoped to product Y, it will fail validation because a
                        matching license doesn't exist for that product.
                      properties:
                        product:
                          type: string
                          description: The identifier (UUID) of the product to validate against.
                        policy:
                          type: string
                          description: The identifier (UUID) of the policy to validate against.
                        fingerprints:
                          type: array
                          description: An array of machine fingerprints to validate against.
                          items:
                            type: string
                        fingerprint:
                          type: string
                          description: A single fingerprint of a machine to validate against.
                        machine:
                          type: string
                          description: The identifier (UUID) of the machine to validate against.
                        user:
                          type: string
                          description: The identifier (UUID) or email of the user to validate against.
                        entitlements:
                          type: array
                          description: An array of entitlement codes to validate against.
                          items:
                            type: string
                        checksum:
                          type: string
                          description: The checksum of an artifact to validate against.
                        version:
                          type: string
                          description: The version of a release to validate against.
      responses:
        "200":
          description: License validated successfully
          content:
            application/vnd.api+json:
              schema:
                title: ValidateLicenseResponse
                type: object
                properties:
                  meta:
                    type: object
                    properties:
                      ts:
                        type: string
                        format: date-time
                      valid:
                        type: boolean
                      detail:
                        type: string
                      code:
                        type: string
                      nonce:
                        type: integer
                      scope:
                        type: object
                        properties:
                          product:
                            type: string
                          policy:
                            type: string
                          fingerprints:
                            type: array
                            items:
                              type: string
                          fingerprint:
                            type: string
                          machine:
                            type: string
                          user:
                            type: string
                          entitlements:
                            type: array
                            items:
                              type: string
                          checksum:
                            type: string
                          version:
                            type: string
                    required:
                      - ts
                      - valid
                      - detail
                      - code
                      - nonce
                      - scope
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - meta
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/actions/validate-key:
    post:
      tags:
        - Licenses
      operationId: validateLicenseKey
      summary: Validate by license key
      description: |
        Action to validate a license key. This will look up the license by its key and check the following: if the license
        is suspended, if the license is expired, if the license is overdue for check-in, and if the license meets its
        machine requirements (if [strict](https://keygen.sh/docs/api/policies/#policies-object-attrs-strict)).

        Additional scopes can also be applied, and may be required by the license's policy, e.g. a policy may set
        `requireFingerprintScope=true`, which will require that you specify a `scope.fingerprint` within the validation
        request in order to pass validation.

        The scoping feature allows you to easily set up a node-locked or floating licensing model without additional logic
        on your end.
      parameters:
        - $ref: "#/components/parameters/Account"
      security:
        - {}
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: ValidateLicenseKeyRequest
              type: object
              properties:
                meta:
                  type: object
                  properties:
                    nonce:
                      type: string
                      description: |
                        An arbitrary numerical nonce value that will be echoed back within the signed response body.
                    scope:
                      type: object
                      description: |
                        Scope to validate the license against i.e. if a license's key is associated with product X,
                        but the validation request is scoped to product Y, it will fail validation because a
                        matching license doesn't exist for that product.
                      properties:
                        product:
                          type: string
                          description: The identifier (UUID) of the product to validate against.
                        policy:
                          type: string
                          description: The identifier (UUID) of the policy to validate against.
                        fingerprints:
                          type: array
                          description: An array of machine fingerprints to validate against.
                          items:
                            type: string
                        fingerprint:
                          type: string
                          description: A single fingerprint of a machine to validate against.
                        machine:
                          type: string
                          description: The identifier (UUID) of the machine to validate against.
                        user:
                          type: string
                          description: The identifier (UUID) or email of the user to validate against.
                        entitlements:
                          type: array
                          description: An array of entitlement codes to validate against.
                          items:
                            type: string
                        checksum:
                          type: string
                          description: The checksum of an artifact to validate against.
                        version:
                          type: string
                          description: The version of a release to validate against.
      responses:
        "200":
          description: License validated successfully
          content:
            application/vnd.api+json:
              schema:
                title: ValidateLicenseKeyResponse
                type: object
                properties:
                  meta:
                    type: object
                    properties:
                      ts:
                        type: string
                        format: date-time
                      valid:
                        type: boolean
                      detail:
                        type: string
                      code:
                        type: string
                      nonce:
                        type: integer
                      scope:
                        type: object
                        properties:
                          product:
                            type: string
                          policy:
                            type: string
                          fingerprints:
                            type: array
                            items:
                              type: string
                          fingerprint:
                            type: string
                          machine:
                            type: string
                          user:
                            type: string
                          entitlements:
                            type: array
                            items:
                              type: string
                          checksum:
                            type: string
                          version:
                            type: string
                    required:
                      - ts
                      - valid
                      - detail
                      - code
                      - nonce
                      - scope
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - meta
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/suspend:
    post:
      tags:
        - Licenses
      operationId: suspendLicense
      summary: Suspend a license
      description: |
        Action to temporarily suspend (ban) a license. This will cause the license to fail validation until reinistated.
        To permanently revoke a license, see the [revoke action](https://keygen.sh/docs/api/licenses/#licenses-actions-revoke).
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: |
            The identifier (UUID) or URL-safe key of the license to suspend.
            key.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License suspended successfully
          content:
            application/vnd.api+json:
              schema:
                title: SuspendLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/reinstate:
    post:
      tags:
        - Licenses
      operationId: reinstateLicense
      summary: Reinstate a license
      description: Action to reinstate a suspended license.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: |
            The identifier (UUID) or URL-safe key of the license to reinstate.
            key.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License reinstated successfully
          content:
            application/vnd.api+json:
              schema:
                title: ReinstateLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/renew:
    post:
      tags:
        - Licenses
      operationId: renewLicense
      summary: Renew a license
      description: Action to renew a license. Extends license expiry by the policy's duration.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: |
            The identifier (UUID) or URL-safe key of the license to renew.
            key.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License renewed successfully
          content:
            application/vnd.api+json:
              schema:
                title: RenewLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/revoke:
    post:
      tags:
        - Licenses
      operationId: revokeLicense
      summary: Revoke a license
      description: |
        Action to revoke (delete) a license. This cannot be undone. This action also immediately deletes any machines
        that the license is associated with.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: |
            The identifier (UUID) or URL-safe key of the license to revoke.
            key.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License revoked successfully
          content:
            application/vnd.api+json:
              schema:
                title: RevokeLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/check-out:
    post:
      tags:
        - Licenses
      operationId: checkOutLicense
      summary: Check-out license
      description: |
        Action to check-out a license. This will generate a snapshot of the license at time of checkout, encoded into a
        license file certificate that can be decoded and used for licensing offline and air-gapped environments. The
        algorithm will depend on the policy's `scheme`.

        License files can be distributed using email or USB drives to air-gapped devices.

        For instructions on verifying a license file, please see [license file verification](https://keygen.sh/docs/api/cryptography/#cryptographic-lic).
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or URL-safe key of the license to check-out.
          required: true
          schema:
            type: string
        - name: ttl
          in: query
          description: The time-to-live (TTL) of the checked out license file, in seconds.
          required: false
          schema:
            type: integer
            format: int64
            minimum: 3600
            maximum: 31556952
            default: 2629746
        - name: include
          in: query
          description: Include relationship data in the license file.
          required: false
          schema:
            type: array
            items:
              type: string
              enum:
                - entitlements
                - product
                - policy
                - user
                - group
        - name: encrypt
          in: query
          description: Whether or not to encrypt the license file. The license file will be encrypted using AES-256-GCM, with a SHA256 digest of the license's key as the secret.
          required: false
          schema:
            type: boolean
            default: false
      responses:
        "200":
          description: License checked out successfully
          content:
            application/vnd.api+json:
              schema:
                title: CheckOutLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/LicenseFile"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/check-in:
    post:
      tags:
        - Licenses
      operationId: checkInLicense
      summary: Check-in a license
      description: |
        Action to check-in a license. Sets the license's `lastCheckIn` to the current time, and the license's
        `nextCheckIn` according to the policy's check-in interval.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or URL-safe key of the license to check-in.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License checked in successfully
          content:
            application/vnd.api+json:
              schema:
                title: CheckInLicenseResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/increment-usage:
    post:
      tags:
        - Licenses
      operationId: incrementLicenseUsage
      summary: Increment license usage
      description: |
        Action to increment a license's `uses` attribute in accordance with its policy's `maxUses` attribute. When the
        policy's `maxUses` limit is exceeded, the increment attempt will fail. When the policy's `maxUses` is set to
        `null`, there is no limit on usage.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or URL-safe key of the license to increment usage for.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: IncrementLicenseUsageRequest
              type: object
              properties:
                meta:
                  type: object
                  properties:
                    increment:
                      type: integer
                      format: int64
                      default: 1
      responses:
        "200":
          description: License usage incremented successfully
          content:
            application/vnd.api+json:
              schema:
                title: IncrementLicenseUsageResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/decrement-usage:
    post:
      tags:
        - Licenses
      operationId: decrementLicenseUsage
      summary: Decrement license usage
      description: Action to decrement a license's `uses` attribute in accordance with its policy's `maxUses` attribute.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or URL-safe key of the license to decrement usage for.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: DecrementLicenseUsageRequest
              type: object
              properties:
                meta:
                  type: object
                  properties:
                    decrement:
                      type: integer
                      format: int64
                      default: 1
      responses:
        "200":
          description: License usage decremented successfully
          content:
            application/vnd.api+json:
              schema:
                title: DecrementLicenseUsageResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/actions/reset-usage:
    post:
      tags:
        - Licenses
      operationId: resetLicenseUsage
      summary: Reset license usage
      description: Action to reset a license's `uses` attribute to `0`.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or URL-safe key of the license to reset usage for.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License usage reset successfully
          content:
            application/vnd.api+json:
              schema:
                title: ResetLicenseUsageResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/tokens:
    post:
      tags:
        - Licenses
      operationId: createLicenseToken
      summary: Generate a license token
      description: |
        Create a license token for a license. A license token has permission to activate and deactivate machines for the
        given license.

        An alternative to Token Authentication is [License Authentication](https://keygen.sh/docs/api/authentication/#license-authentication).
        Typically, we recommend using License Authentication where possible, as it very much simplifies an integration.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or key of the license the token is for.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: CreateLicenseTokenRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [tokens]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: An optional name for the token.
                        expiry:
                          type: string
                          format: date-time
                          description: The timestamp for when the token expires.
                        maxActivations:
                          type: integer
                          format: int64
                          description: The maximum number of machine activations the token is allowed to perform.
                        maxDeactivations:
                          type: integer
                          format: int64
                          description: The maximum number of machine deactivations the token is allowed to perform.
                  required:
                    - type
                    - attributes
      responses:
        "200":
          description: License token generated successfully
          content:
            application/vnd.api+json:
              schema:
                title: CreateLicenseTokenResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Token"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/entitlements:
    post:
      tags:
        - Licenses
      operationId: attachLicenseEntitlements
      summary: Attach license entitlements
      description: |
        Attach entitlements to a license. This will immediately be taken into effect for all future validations.

        **Below are the limitations to attaching an entitlement:**

        - You cannot attach an entitlement that is already attached through the policy.
        - You cannot attach an already attached entitlement.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or key of the license to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: AttachLicenseEntitlementsRequest
              type: object
              properties:
                data:
                  type: array
                  items:
                    type: object
                    properties:
                      type:
                        type: string
                        enum: [entitlements]
                      id:
                        type: string
                    required:
                      - type
                      - id
              required:
                - data
      responses:
        "201":
          description: License entitlements attached successfully
          content:
            application/vnd.api+json:
              schema:
                title: AttachLicenseEntitlementsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/LicenseEntitlement"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Licenses
      operationId: detachLicenseEntitlements
      summary: Detach license entitlements
      description: |
        Detach entitlements from a license. This will immediately be taken into effect for all future validations.

        **Below are the limitations to detaching an entitlement:**

        - You cannot detach an entitlement that is attached through the policy.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or key of the license to be updated.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License entitlements detached successfully
          content:
            application/vnd.api+json:
              schema:
                title: DetachLicenseEntitlementsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Entitlement"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Licenses
      operationId: listLicenseEntitlements
      summary: List license entitlements
      description: |
        Returns a list of entitlements attached to the license. The entitlements are returned sorted by creation date,
        with the most recent entitlements appearing first. The listed entitlements include all entitlements attached to
        the license's policy, in addition to the entitlements attached to the particular license.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of entitlements to be returned.
        - name: license
          in: path
          description: The identifier (UUID) or key of the license to list entitlements for.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: License entitlements retreived successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListLicenseEntitlementsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Entitlement"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/policy:
    put:
      tags:
        - Licenses
      operationId: changeLicensePolicy
      summary: Change policy
      description: |
        Change a license's policy relationship. This will immediately be taken into effect for all future validations.
        The license's expiry may be changed, according to the new policy's transfer strategy.

        **Below are the limitations to changing a license's policy:**

        - You cannot change from an encrypted policy to an unencrypted policy (or vice-versa).
        - You cannot change from a pooled policy to an unpooled policy (or vice-versa).
        - You cannot change to a policy that has a less strict fingerprint strategy.
        - You cannot change to a policy that has a different cryptographic scheme.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or key of the license to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ChangeLicensePolicyRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [policies]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
      responses:
        "200":
          description: Policy changed successfully
          content:
            application/vnd.api+json:
              schema:
                title: ChangeLicensePolicyResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/user:
    post:
      tags:
        - Licenses
      operationId: attachUsers
      summary: Attach Users
      description: |
        Attach users to a license. This will immediately be taken into effect for all future validations. Attaching a user to a license allows that user access to the license, and depending on permissions, the ability to perform actions for the license, such as machine activation and deactivation.

        Below are the limitations to attaching a user:
          You cannot attach a user that is already attached as the owner.
          You cannot attach an already attached user.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or key of the license to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ChangeLicenseUserRequest
              type: object
              properties:
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [users]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
      responses:
        "200":
          description: User attached successfully
          content:
            application/vnd.api+json:
              schema:
                title: ChangeLicenseUserResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Licenses
      operationId: detachUsers
      summary: Detach Users
      description: |
        Detach users from a license. This will immediately be taken into effect for all future validations and the user will no longer have access to the license or its machines. In addition, any machines that the user owns for the license will be detached from the user, i.e. the machine's owner will be nullified, but the machine will remain activated.

        Below are the limitations to attaching a user:
          You cannot attach a user that is already attached as the owner.
          You cannot attach an already attached user.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or key of the license to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ChangeLicenseUserRequest
              type: object
              properties:
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [users]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
      responses:
        "200":
          description: User detached successfully
          content:
            application/vnd.api+json:
              schema:
                title: ChangeLicenseUserResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/users:
    get:
      tags:
        - Licenses
      operationId: getLicenseUsers
      summary: List users for a license
      description: |
        Returns a list of users attached to the license. The users are returned sorted by creation date, with the most recent users appearing first. The listed users include all users attached to the license, in addition to the license's owner.
      parameters:
        - name: license
          in: path
          description: The identifier (UUID) or key of the license to list users for.
          required: true
          schema:
            type: string
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of users to be returned. Limit must be a number between 1 and 100.
      responses:
        "200":
          description: Users retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListLicenseUsersResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/User"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/licenses/{license}/group:
    put:
      tags:
        - Licenses
      operationId: changeLicenseGroup
      summary: Change group
      description: |
        Change a license's group relationship. This will immediately transfer the license resource to the new group.
        Changing the license's group will not retroactively change the group of its user or of its machines.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: license
          in: path
          description: The identifier (UUID) or key of the license to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ChangeLicenseGroupRequest
              type: object
              properties:
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [groups]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
      responses:
        "200":
          description: Group changed successfully
          content:
            application/vnd.api+json:
              schema:
                title: ChangeLicenseGroupResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/License"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/machines:
    post:
      tags:
        - Machines
      operationId: activateMachine
      summary: Activate a machine
      description: Creates, or activates, a new machine resource for a license.
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ActivateMachineRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [machines]
                    attributes:
                      type: object
                      properties:
                        fingerprint:
                          type: string
                          description: The fingerprint of the machine.
                        cores:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The number of CPU cores for the machine.
                        name:
                          type:
                            - string
                            - "null"
                          description: The human-readable name of the machine.
                        ip:
                          type:
                            - string
                            - "null"
                          description: The IP of the machine.
                        hostname:
                          type:
                            - string
                            - "null"
                          description: The hostname of the machine.
                        platform:
                          type:
                            - string
                            - "null"
                          description: The platform of the machine.
                        metadata:
                          type: object
                          description: Object containing machine metadata.
                      required:
                        - fingerprint
                    relationships:
                      type: object
                      properties:
                        license:
                          type: object
                          description: The license the machine is for.
                          properties:
                            data:
                              type: object
                              properties:
                                type:
                                  type: string
                                  enum: [licenses]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                        owner:
                          type: object
                          description: The user the machine belongs to. If authenticated as a license user, this relationship is required and must be the authenticated user.
                          properties:
                            data:                              
                              type:
                                - object
                                - "null"
                              properties:
                                type:
                                  type: string
                                  enum: [users]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                        group:
                          type: object
                          description: The group the machine belongs to.
                          properties:
                            data:
                              type:
                                - object
                                - "null"
                              properties:
                                type:
                                  type: string
                                  enum: [groups]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                        components:
                          type: array
                          description: The components that the machine is entitled to.
                          items:
                            $ref: "#/components/schemas/Component"
                      required:
                        - license
                  required:
                    - type
                    - attributes
                    - relationships
              required:
                - data
      responses:
        "200":
          description: Machine activated successfully
          content:
            application/vnd.api+json:
              schema:
                title: ActivateMachineResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Machine"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Machines
      operationId: listMachines
      summary: List all machines
      description: |
        Returns a list of machines. The machines are returned sorted by creation date, with the most recent machines
        appearing first. Resources are automatically scoped to the authenticated bearer e.g. when authenticated as a
        user, only machines for that specific user will be listed.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of machines to be returned.
        - name: fingerprint
          in: query
          description: The machine fingerprint to filter by.
          required: false
          schema:
            type: string
        - name: ip
          in: query
          description: The machine IP address to filter by.
          required: false
          schema:
            type: string
        - name: hostname
          in: query
          description: The machine hostname to filter by.
          required: false
          schema:
            type: string
        - name: product
          in: query
          description: The identifier (UUID) of the product to filter by.
          required: false
          schema:
            type: string
        - name: policy
          in: query
          description: The identifier (UUID) of the policy to filter by.
          required: false
          schema:
            type: string
        - name: license
          in: query
          description: The identifier (UUID) or key of the license to filter by.
          required: false
          schema:
            type: string
        - name: key
          in: query
          description: The license key to filter by.
          required: false
          schema:
            type: string
        - name: user
          in: query
          description: The identifier (UUID) of the user to filter by.
          required: false
          schema:
            type: string
        - name: group
          in: query
          description: The identifier (UUID) of the group to filter by.
          required: false
          schema:
            type: string
        - name: metadata
          in: query
          description: The metadata object to filter by.
          required: false
          style: deepObject
          explode: true
          schema:
            type: object
            additionalProperties: true
      responses:
        "200":
          description: Machines retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListMachinesResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Machine"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/machines/{machine}:
    get:
      tags:
        - Machines
      operationId: retrieveMachine
      summary: Retrieve a machine
      description: Retrieves the details of an existing machine.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: machine
          in: path
          description: The identifier (UUID) or URL-safe fingerprint of the machine to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Machine retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveMachineResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Machine"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Machines
      operationId: updateMachine
      summary: Update a machine
      description: |
        Updates the specified machine resource by setting the values of the parameters passed. Any parameters not
        provided will be left unchanged.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: machine
          in: path
          description: The identifier (UUID) or URL-safe fingerprint of the machine to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: UpdateMachineRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [machines]
                    attributes:
                      type: object
                      properties:
                        name:
                          type:
                            - string
                            - "null"
                          description: The human-readable name of the machine.
                        ip:
                          type:
                            - string
                            - "null"
                          description: The IP of the machine.
                        hostname:
                          type:
                            - string
                            - "null"
                          description: The hostname of the machine.
                        platform:
                          type:
                            - string
                            - "null"
                          description: The platform of the machine.
                        cores:
                          type:
                            - integer
                            - "null"
                          format: int64
                          description: The number of CPU cores for the machine.
                        metadata:
                          type: object
                          description: Object containing machine metadata.
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "200":
          description: Machine updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateMachineResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Machine"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Machines
      operationId: deactivateMachine
      summary: Deactivate a machine
      description: |
        Permanently deletes, or deactivates, a machine. It cannot be undone. This will immediately delete all processes
        associated with the machine.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: machine
          in: path
          description: The identifier (UUID) or URL-safe fingerprint of the machine to be deleted.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Machine deactivated successfully
          content:
            application/vnd.api+json:
              schema:
                title: DeactivateMachineResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Machine"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/machines/{machine}/actions/check-out:
    post:
      tags:
        - Machines
      operationId: checkOutMachine
      summary: Check-out machine
      description: |
        Action to check-out a machine. This will generate a snapshot of the machine at time of checkout, encoded into a
        machine file certificate that can be decoded and used for licensing offline and air-gapped environments. The
        algorithm will depend on the license policy's `scheme`.

        Machine files can be distributed using email or USB drives to air-gapped devices.

        For instructions on verifying a machine file, please see [machine file verification](https://keygen.sh/docs/api/cryptography/#cryptographic-lic).
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: machine
          in: path
          description: The identifier (UUID) or URL-safe fingerprint of the machine to check-out.
          required: true
          schema:
            type: string
        - name: ttl
          in: query
          description: The time-to-live (TTL) of the checked out machine file, in seconds.
          required: false
          schema:
            type: integer
            format: int64
            minimum: 3600
            maximum: 31556952
            default: 2629746
        - name: include
          in: query
          description: Include relationship data in the machine file.
          required: false
          schema:
            type: array
            items:
              type: string
              enum:
                - license.entitlements
                - license.product
                - license.policy
                - license.user
                - license
                - components
                - environment
                - group
        - name: encrypt
          in: query
          description: Whether or not to encrypt the machine file. The machine file will be encrypted using AES-256-GCM, with a SHA256 digest of the license's key concatenated with the machine's fingerprint as the secret.
          required: false
          schema:
            type: boolean
            default: false
      responses:
        "200":
          description: Machine checked out successfully
          content:
            application/vnd.api+json:
              schema:
                title: CheckOutMachineResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/MachineFile"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/machines/{machine}/actions/ping:
    post:
      tags:
        - Machines
      operationId: pingMachine
      summary: Ping heartbeat
      description: |
        Action to begin or maintain a machine heartbeat monitor. When a machine has not performed a heartbeat ping
        within the monitor window, it will automatically be deactivated. This can be utilized for machine leasing, where
        a license has a limited number of machines allowed, and each machine must maintain heartbeat pings in order to
        remain active.

        To illustrate further, consider a rather common scenario when dealing with leasing VMs:

        - The machine is activated for a new device using a unique VM GUID as a "fingerprint."
        - The machine sends their first heartbeat ping, starting the monitor.
        - The machine sends further heartbeat pings, within the heartbeat monitor window, to indicate that it is still alive.
        - The machine/software crashes. Normal machine deactivation fails to occur before the software program exits. This is now a "zombie" machine.
        - The heartbeat monitor detects that the machine has not sent a ping within the window, and subsequently deactivates the machine.

        **The default heartbeat monitor window is 10 minutes from time of last ping.** This can be configured via the
        license policy's `heartbeatDuration` attribute.

        Machines will be culled according to the policy's heartbeat cull strategy, after the machine's resurrection
        period has passed, if set.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: machine
          in: path
          description: The identifier (UUID) or URL-safe fingerprint of the machine to ping.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Heartbeat pinged successfully
          content:
            application/vnd.api+json:
              schema:
                title: PingMachineResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Machine"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/machines/{machine}/actions/reset:
    post:
      tags:
        - Machines
      operationId: resetMachine
      summary: Reset heartbeat
      description: Action to reset and stop the machine's heartbeat monitor. This will not deactivate the machine.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: machine
          in: path
          description: The identifier (UUID) or URL-safe fingerprint of the machine to reset.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Heartbeat reset successfully
          content:
            application/vnd.api+json:
              schema:
                title: ResetMachineResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Machine"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/machines/{machine}/group:
    put:
      tags:
        - Machines
      operationId: changeMachineGroup
      summary: Change group
      description: |
        Change a machine's group relationship. This will immediately transfer the machine resource to the new group.
        Changing the machine's group will not retroactively change the group of its user or license.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: machine
          in: path
          description: The identifier (UUID) or key of the machine to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ChangeMachineGroupRequest
              type: object
              properties:
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [groups]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
      responses:
        "200":
          description: Group changed successfully
          content:
            application/vnd.api+json:
              schema:
                title: ChangeMachineGroupResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Machine"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/components:
    post:
      tags:
        - Components
      operationId: createComponent
      summary: Add a component
      description: Adds a new component resource for a machine.
      parameters:
        - $ref: "#/components/parameters/Account"
      security:
        - BearerToken: []
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: CreateComponentRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [components]
                    attributes:
                      type: object
                      properties:
                        fingerprint:
                          type: string
                          description: The unique fingerprint of the component, e.g. a motherboard serial number. Must be unique within the scope of the machine it belongs to.
                        name:
                          type: string
                          description: The human readable-name of the component.
                        metadata:
                          type: object
                          additionalProperties: true
                          description: Object containing component metadata.
                      required:
                        - fingerprint
                        - name
                    relationships:
                      type: object
                      properties:
                        machine:
                          type: object
                          description: The machine the component is for.
                          properties:
                            data:
                              type: object
                              properties:
                                type:
                                  type: string
                                  enum: [machines]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                      required:
                        - machine
                  required:
                    - type
                    - attributes
                    - relationships
              required:
                - data
      responses:
        "201":
          description: Component created successfully
          content:
            application/vnd.api+json:
              schema:
                title: CreateComponentResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Component"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Components
      operationId: listComponents
      summary: List all components
      description: |
        Returns a list of components. The components are returned sorted by creation date,
        with the most recent components appearing first. Resources are automatically
        scoped to the authenticated bearer e.g. when authenticated as a user,
        only components for that specific user will be listed.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of components to be returned.
        - name: machine
          in: query
          description: The identifier (UUID) of the machine to filter by.
          schema:
            type: string
            format: uuid
        - name: license
          in: query
          description: The identifier (UUID) of the license to filter by.
          schema:
            type: string
            format: uuid
        - name: owner
          in: query
          description: The identifier (UUID) of the owner to filter by.
          schema:
            type: string
            format: uuid
        - name: user
          in: query
          description: The identifier (UUID) of the user to filter by.
          schema:
            type: string
            format: uuid
        - name: product
          in: query
          description: The identifier (UUID) of the product to filter by.
          schema:
            type: string
            format: uuid
      security:
        - BearerToken: []
      responses:
        "200":
          description: Components retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Component"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/components/{id}:
    get:
      tags:
        - Components
      operationId: retrieveComponent
      summary: Retrieve a component
      description: Retrieves the details of an existing component.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: id
          in: path
          description: The identifier (UUID) of the component to be retrieved.
          required: true
          schema:
            type: string
      security:
        - BearerToken: []
      responses:
        "200":
          description: Component retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Component"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Components
      operationId: updateComponent
      summary: Update a component
      description: |
        Updates the specified component resource by setting the values of the parameters
        passed. Any parameters not provided will be left unchanged.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: id
          in: path
          description: The identifier (UUID) of the component to be updated.
          required: true
          schema:
            type: string
      security:
        - BearerToken: []
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [components]
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The human readable-name of the component.
                        metadata:
                          type: object
                          additionalProperties: true
                          description: Object containing component metadata.
                          x-protected: true
                  required:
                    - type
              required:
                - data
      responses:
        "200":
          description: Component updated successfully
          content:
            application/vnd.api+json:
              schema:
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Component"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Components
      operationId: deleteComponent
      summary: Remove a component
      description: Permanently removes a component. It cannot be undone.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: id
          in: path
          description: The identifier (UUID) of the component to be deleted.
          required: true
          schema:
            type: string
      security:
        - BearerToken: []
      responses:
        "204":
          description: Component deleted successfully
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/processes:
    post:
      tags:
        - Processes
      operationId: spawnProcess
      summary: Spawn a process
      description: Spawns (creates) a new process resource for a machine.
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: SpawnProcessRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [processes]
                    attributes:
                      type: object
                      properties:
                        pid:
                          type: integer
                          format: int64
                          description: The process ID.
                        metadata:
                          type: object
                          description: Object containing process metadata.
                          additionalProperties: true
                      required:
                        - pid
                    relationships:
                      type: object
                      properties:
                        machine:
                          type: object
                          description: The machine the process is for.
                          properties:
                            data:
                              type: object
                              properties:
                                type:
                                  type: string
                                  enum: [machines]
                                id:
                                  type: string
                              required:
                                - type
                                - id
                          required:
                            - data
                        owner:
                          type: object
                          description: The user that owns the process.
                          properties:
                            links:
                              $ref: "#/components/schemas/RelatedLinks"
                            data:
                              type: object
                              properties:
                                type:
                                  type: string
                                  enum: [users]
                                id:
                                  type: string
                      required:
                        - machine
                        - owner
                  required:
                    - type
                    - attributes
                    - relationships
              required:
                - data
      responses:
        "201":
          description: Process spawned successfully
          content:
            application/vnd.api+json:
              schema:
                title: SpawnProcessResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Process"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Processes
      operationId: listProcesses
      summary: List all processes
      description: |
        Returns a list of processes. The processes are returned sorted by creation date, with the most recent processes
        appearing first. Resources are automatically scoped to the authenticated bearer e.g. when authenticated as a
        user, only processes for that specific user will be listed.
      parameters:
        - $ref: "#/components/parameters/Account"
        - $ref: "#/components/parameters/Page"
        - $ref: "#/components/parameters/Limit"
          description: A limit on the number of processes to be returned.
        - name: machine
          in: query
          description: The identifier (UUID) of the machine to filter by.
          required: false
          schema:
            type: string
        - name: license
          in: query
          description: The identifier (UUID) of the license to filter by.
          required: false
          schema:
            type: string
        - name: owner
          in: query
          description: The identifier (UUID) of the owner to filter by.
          required: false
          schema:
            type: string
        - name: user
          in: query
          description: The identifier (UUID) of the user to filter by.
          required: false
          schema:
            type: string
        - name: product
          in: query
          description: The identifier (UUID) of the product to filter by.
          required: false
          schema:
            type: string
      responses:
        "200":
          description: Processes retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListProcessesResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Process"
                  links:
                    $ref: "#/components/schemas/PaginationLinks"
                required:
                  - data
                  - links
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/processes/{process}:
    get:
      tags:
        - Processes
      operationId: retrieveProcess
      summary: Retrieve a process
      description: Retrieves the details of an existing process.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: process
          in: path
          description: The identifier (UUID) of the process to be retrieved.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Process retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveProcessResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Process"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Processes
      operationId: updateProcess
      summary: Update a process
      description: |
        Updates the specified process resource by setting the values of the parameters passed. Any parameters not
        provided will be left unchanged.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: process
          in: path
          description: The identifier (UUID) of the process to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: UpdateProcessRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [processes]
                    attributes:
                      type: object
                      properties:
                        metadata:
                          type: object
                          description: Object containing process metadata.
                          additionalProperties: true
                  required:
                    - type
                    - attributes
              required:
                - data
      responses:
        "200":
          description: Process updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateProcessResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Process"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Processes
      operationId: killProcess
      summary: Kill a process
      description: Permanently kills (deletes) a process. It cannot be undone.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: process
          in: path
          description: The identifier (UUID) of the process to be deleted.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Process killed successfully
          content:
            application/vnd.api+json:
              schema:
                title: KillProcessResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Process"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/processes/{process}/actions/ping:
    post:
      tags:
        - Processes
      operationId: pingProcess
      summary: Ping
      description: |
        Action to maintain a process heartbeat ping frequency. When a process has not performed a heartbeat ping within
        the monitor window, it will be considered dead and queued for deletion. This can be utilized for process
        leasing, where a license or machine has a maximum number of allowed processes, and each process must maintain
        heartbeat pings in order to remain active. This can be used in combination with machine heartbeats.

        Consider this common process leasing scenario:

        - One or more processes are spawned during application initialization, after the license has been validated and
          the underlying machine has been activated.
        - Each process sends their first ping and maintains a heartbeat ping frequency, according to the required
          heartbeat monitor window, to indicate that it is still alive.
        - The application crashes. The normal process kill-on-exit procedure fails to occur before the application
          exits. There are now one or more "zombie" processes.
        - The heartbeat monitor detects that the process has not sent a ping within the window, and subsequently kills
          the process.

        **The default heartbeat monitor window is 10 minutes.** This can be configured to a different value via the
        license policy's heartbeat duration attribute.

        Processes will be culled according to the policy's heartbeat cull strategy, after the process's resurrection
        period has passed, if set.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: process
          in: path
          description: The identifier (UUID) of the process to ping.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Ping successful
          content:
            application/vnd.api+json:
              schema:
                title: PingProcessResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/Process"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/me:
    get:
      tags:
        - Profiles
      operationId: retrieveProfile
      summary: Who Am I?
      description: |
        Retrieves the details of the currently authenticated bearer i.e. the resource who the current API token belongs
        to. Utilize this to determine who the current user is, what token they used, to retrieve information on who made
        the API request.
      parameters:
        - $ref: "#/components/parameters/Account"
      responses:
        "200":
          description: Profile retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveProfileResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/User"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/passwords:
    post:
      tags:
        - Passwords
      operationId: forgotPassword
      summary: Forgot password
      description: |
        Request a password reset for a user. When the user does not already have a password, they will be invited to set
        a password. This will send an email to the user, if it is a valid email address that exists in our system. The
        email will contain a link leading to a password reset form securely hosted by Keygen. To send a customized
        email, see below.

        When the account is protected, and the user does not yet have a password set, they will not be able to set their
        initial password. Passwordless users are considered "managed" users, and depending on whether or not the account
        is protected, they may not have permission to set a password.

        To work around this, you may do one of the following:

        - Set a temporary password on the user. You can do this when creating the user, or you can do this after the
          fact. Once a password has been set, the user is no longer considered "managed" and may reset their password
          normally.
        - Set the account to unprotected. Though note what this entails — you may want to set all policies to protected
          to ensure certain actions can't be taken by users, such as license creation.

        In most cases, we recommend #1.
      security:
        - {}
      parameters:
        - $ref: "#/components/parameters/Account"
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: ForgotPasswordRequest
              type: object
              properties:
                meta:
                  type: object
                  properties:
                    email:
                      type: string
                      format: email
                      description: The email of the user.
                    deliver:
                      type: boolean
                      default: true
                      description: Whether or not to email a password reset notification to the user.
                  required:
                    - email
              required:
                - meta
      responses:
        "202":
          description: Password reset request accepted
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}/second-factors:
    post:
      tags:
        - Second factors
      operationId: addSecondFactor
      summary: Add a second factor
      description: |
        Adds a new second factor for the user. After adding the second factor, it must be enabled via [an update](https://keygen.sh/docs/api/users/#second-factors-update).
        To enable the second factor, a valid OTP must be provided.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user the second factor is for.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              title: AddSecondFactorRequest
              type: object
              properties:
                meta:
                  type: object
                  properties:
                    password:
                      type: string
                      description: When the user does not have an existing second factor, the password of the user.
                    otp:
                      type: string
                      description: When the user has an existing second factor, the OTP code of the second factor.
      responses:
        "201":
          description: Second factor added successfully
          content:
            application/vnd.api+json:
              schema:
                title: AddSecondFactorResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/SecondFactor"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    get:
      tags:
        - Second factors
      operationId: listSecondFactors
      summary: List second factors
      description: |
        Returns a list of second factors. The second factors are returned sorted by creation date, with the most recent
        second factors appearing first.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of the user the second factors are for.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Second factors retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: ListSecondFactorsResponse
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/SecondFactor"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
  /accounts/{account}/users/{user}/second-factors/{second-factor}:
    get:
      tags:
        - Second factors
      operationId: retrieveSecondFactor
      summary: Retrieve a second factor
      description: Retrieves the details of an existing second factor.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of a user the second factor belongs to.
          required: true
          schema:
            type: string
        - name: second-factor
          in: path
          description: The identifier (UUID) of the second factor.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Second factor retrieved successfully
          content:
            application/vnd.api+json:
              schema:
                title: RetrieveSecondFactorResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/SecondFactor"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    patch:
      tags:
        - Second factors
      operationId: updateSecondFactor
      summary: Update a second factor
      description: |
        Update an existing second factor for the user. This can be used to enable and disable a second factor as-needed.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of a user the second factor belongs to.
          required: true
          schema:
            type: string
        - name: second-factor
          in: path
          description: The identifier (UUID) of the second factor to be updated.
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              title: UpdateSecondFactorRequest
              type: object
              properties:
                data:
                  type: object
                  properties:
                    attributes:
                      type: object
                      properties:
                        enabled:
                          type: boolean
                          description: Whether or not the second factor is enabled.
                meta:
                  type: object
                  properties:
                    otp:
                      type: string
                      description: |
                        The OTP code of the second factor, generated by an Authenticator app via the second factor's
                        secret.
                  required:
                    - otp
              required:
                - meta
      responses:
        "200":
          description: Second factor updated successfully
          content:
            application/vnd.api+json:
              schema:
                title: UpdateSecondFactorResponse
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/SecondFactor"
                required:
                  - data
        default:
          $ref: "#/components/responses/Error"
    delete:
      tags:
        - Second factors
      operationId: deleteSecondFactor
      summary: Delete a second factor
      description: Permanently deletes a second factor. It cannot be undone.
      parameters:
        - $ref: "#/components/parameters/Account"
        - name: user
          in: path
          description: The identifier (UUID) or email of a user the second factor belongs to.
          required: true
          schema:
            type: string
        - name: second-factor
          in: path
          description: The identifier (UUID) of the second factor to be deleted.
          required: true
          schema:
            type: string
      responses:
        "204":
          description: Second factor deleted successfully
        default:
          $ref: "#/components/responses/Error"
webhooks:
  event:
    post:
      summary: Process an event
      operationId: processEvent
      tags:
        - Webhooks
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              $ref: "#/components/schemas/WebhookEvent"
      parameters:
        - name: Keygen-Signature
          in: header
          description: The signature of the event payload.
          required: true
          schema:
            type: string
      responses:
        "200":
          description: Event processed successfully
components:
  parameters:
    Account:
      name: account
      in: path
      description: The identifier (UUID) or slug of your Keygen account.
      required: true
      schema:
        type: string
    Limit:
      name: limit
      in: query
      required: false
      schema:
        type: integer
        format: int64
        minimum: 1
        maximum: 100
        default: 10
    Page:
      name: page
      in: query
      description: Object containing page `size` and page `number`.
      required: false
      style: deepObject
      explode: true
      schema:
        type: object
        properties:
          size:
            type: integer
            format: int64
            minimum: 1
            maximum: 100
            default: 10
            description: The page size.
          number:
            type: integer
            format: int64
            default: 1
            minimum: 1
            description: The page number.
  responses:
    Error:
      description: An error occurred
      content:
        application/vnd.api+json:
          schema:
            type: object
            properties:
              errors:
                type: array
                items:
                  $ref: "#/components/schemas/Error"
            required:
              - errors
  schemas:
    Token:
      type: object
      summary: The token object
      description: |
        **Keygen authenticates your API requests using tokens.**

        Below you will find the various attributes for the token resource, as well as the token resource's
        relationships. The actual `token` string is hashed before being stored in our databases, thus is only available
        directly after generating/regenerating a token. Tokens with an expiry will automatically be deleted 90 days
        after their expiry, unless renewed.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [tokens]
        attributes:
          type: object
          properties:
            kind:
              type: string
              description: The kind of token, based on its bearer.
              enum:
                - activation-token
                - product-token
                - user-token
                - support-token
                - sales-token
                - developer-token
                - admin-token
            token:
              type: string
              description: |
                The raw token of the token. This attribute is only available to read directly after token generation.
                This is the value you will use to authenticate with when sending requests to our API.
            name:
              type:
                - string
                - "null"
              description: An optional name for the token. This can be used to easily identify tokens at a glance.
            expiry:
              type:
                - string
                - "null"
              format: date-time
              description: The timestamp for when the token expires. Requests using an expired token will be rejected.
            maxActivations:
              type: integer
              format: int64
              description: |
                The maximum amount of machine activations this token may perform. This attribute is only applicable to
                license tokens.
            activations:
              type: integer
              format: int64
              description: |
                The number of machine activations that have been performed by this token. This attribute is only
                applicable to license tokens.
            maxDeactivations:
              type: integer
              format: int64
              description: |
                The maximum amount of machine deactivations this token may perform. This attribute is only applicable to
                license tokens.
            deactivations:
              type: integer
              format: int64
              description: |
                The number of machine deactivations that have been performed by this token. This attribute is only
                applicable to license tokens.
            created:
              type: string
              format: date-time
              description: When the token was created.
            updated:
              type: string
              format: date-time
              description: When the token was last updated.
            permissions:
              type: array
              items:
                type: string
              description: An array of permissions the token has.
          required:
            - kind
            - token
            - expiry
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the token belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            bearer:
              type: object
              description: The bearer of the token.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum:
                        - users
                        - products
                        - licenses
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
            - bearer
      required:
        - id
        - type
        - attributes
        - relationships
    Product:
      type: object
      description: |
        Below you will find the various attributes for the product resource, as well as the product resource's
        relationships.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [products]
        attributes:
          type: object
          properties:
            name:
              type: string
              description: The name of the product.
            url:
              type:
                - string
                - "null"
              format: uri
              description: A related URL for the product e.g. the marketing website, company website, etc.
            distributionStrategy:
              type: string
              enum:
                - LICENSED
                - OPEN
                - CLOSED
              description: |
                The strategy for distributing releases.

                ### Options

                - **`LICENSED`**:
                  Only licensed users, with a valid license, can access releases and release artifacts. API
                  authentication is required.
                - **`OPEN`**:
                  Anybody can access releases. No API authentication required, so this is a great option for rendering
                  releases on a public downloads page, open source projects, or freemium products.
                - **`CLOSED`**: Only admins can access releases. Download links will need to be generated server-side.
                  API authentication is required.
            platforms:
              type:
                - array
                - "null"
              items:
                type: string
              description: An array of platforms the product supports.
            metadata:
              type: object
              description: Object containing product metadata.
              additionalProperties: true
            created:
              type: string
              format: date-time
              description: When the product was created.
            updated:
              type: string
              format: date-time
              description: When the product was last updated.
          required:
            - name
            - url
            - distributionStrategy
            - metadata
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the product belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            policies:
              type: object
              description: The policies that are associated with the product.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            licenses:
              type: object
              description: The licenses that are associated with the product.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            machines:
              type: object
              description: The machines that are associated with the product.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            users:
              type: object
              description: The users that own a license for the product.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            tokens:
              type: object
              description: The authentication tokens of the product.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
          required:
            - account
            - policies
            - licenses
            - machines
            - users
            - tokens
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    Entitlement:
      type: object
      summary: The entitlement object
      description: |
        Below you will find the various attributes for the entitlement resource. Entitlements can be attached to
        policies and to licenses to grant named "permissions" for things such as application features.

        Entitlements can be attached to the following resources:

        - **Policies:**
          Any entitlement attached to a policy will automatically be attached to all licenses which implement the given
          policy.
        - **Licenses:**
          Entitlements attached to a license are one-off and only apply to that specific license resource.
        - **Releases:**
          Entitlements can be attached to releases through [constraints](https://keygen.sh/docs/api/releases/#releases-relationships-attach-constraints),
          in order to assert that a given licensee possesses the necessary entitlements before being allowed to access a
          release's artifacts.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [entitlements]
        attributes:
          type: object
          properties:
            name:
              type: string
              description: The name of the entitlement.
            code:
              type: string
              description: |
                The unique code for the entitlement. This can be used within license validation requests to assert a
                license possesses a given entitlement.
            created:
              type: string
              format: date-time
              description: When the entitlement was created.
            updated:
              type: string
              format: date-time
              description: When the entitlement was last updated.
            metadata:
              type: object
              description: Object containing entitlement metadata.
              additionalProperties: true
          required:
            - name
            - code
            - created
            - updated
            - metadata
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the entitlement belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    Group:
      type: object
      summary: The group object
      description: |
        Groups can be used to associate multiple users, licenses and machines under a single group. This is great for
        setting up "Teams" or group licenses. For example, you use an "ACME Co." group for a team license package that
        belongs to the ACME customer, making sure all licenses are associated with eachother.

        How resources can be added into a group:

        1. By specifying a `group` relationship during creation of a new resource. For example, to add a new license to
           a group, [specify the `group` relationship](https://keygen.sh/docs/api/licenses/#licenses-create-relationships-group).
        2. By changing an existing resource's group relationship. For example, to add an existing license to a group,
           [change it's group relationship](https://keygen.sh/docs/api/licenses/#licenses-relationships-change-group).
        3. Through inheritance. For example, any machines created for a license in group "ACME" will automatically be
           included into the same group.

        Below you will find the various attributes for the group resource. Groups can be utilized to associate multiple
        resources with eachother, as well as to define collective resource limits.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [groups]
        attributes:
          type: object
          properties:
            name:
              type: string
              description: The name of the group.
            maxUsers:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of users the group can have, collectively. When `null`, an unlimited number of users
                may be in the group. Must be a number greater than 0.
            maxLicenses:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of licenses the group can have, collectively. When `null`, an unlimited number of
                licenses may be in the group. Must be a number greater than 0.
            maxMachines:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of machines the group can have, collectively. When `null`, an unlimited number of
                machines may be in the group. Must be a number greater than 0.
            created:
              type: string
              format: date-time
              description: When the group was created.
            updated:
              type: string
              format: date-time
              description: When the group was last updated.
            metadata:
              type: object
              description: Object containing group metadata.
              additionalProperties: true
          required:
            - name
            - maxUsers
            - maxLicenses
            - maxMachines
            - created
            - updated
            - metadata
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the group belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            owners:
              type: object
              description: The owners of the group.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            users:
              type: object
              description: The users that are in the group.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            licenses:
              type: object
              description: The licenses that are in the group.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            machines:
              type: object
              description: The machines that are in the group.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
          required:
            - account
            - owners
            - users
            - licenses
            - machines
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    Policy:
      type: object
      summary: The policy object
      description: |
        Below you will find the various attributes for the policy resource, as well as the policy resource's
        relationships. Your policies define the different types of licenses that a given product offers. For example,
        you may offer yearly licenses, as well as shorter time-limited free trial licenses that lack certain entitlements.

        Another example would be configuring a yearly software license that once expired, still functions normally, but
        is disallowed release upgrades after expiration. This is something you can accomplish using policies.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [policies]
        attributes:
          type: object
          properties:
            name:
              type: string
              description: The name of the policy.
            duration:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The duration for the policy in seconds. When a new license implements the policy, the license's expiry
                is calculated with this value (i.e. `time.now + policy.duration`). If `null`, licenses will never
                expire.
            strict:
              type: boolean
              description: |
                When enabled, a license that implements the policy will be considered invalid if its machine limit,
                machine core limit, or processes limit is surpassed. In addition, strict requires a license to have at
                least 1 machine associated with it in order to pass validation.
            floating:
              type: boolean
              description: |
                When enabled, a license that implements the policy will be valid across multiple machines. Though this
                is not enforced i.e. it does not invalidate a license if it's associated with more than 1 machine unless
                the policy is strict.
            scheme:
              type:
                - string
                - "null"
              enum:
                - ED25519_SIGN
                - RSA_2048_PKCS1_PSS_SIGN_V2
                - RSA_2048_PKCS1_SIGN_V2
                - RSA_2048_PKCS1_ENCRYPT
                - RSA_2048_JWT_RS256
              description: |
                The cryptographic encryption/signature scheme used on license keys. Can be used to implement offline
                licensing by storing tamper-proof data within a license's key. When `null` or omitted, the license's key
                will be stored unchanged.

                ### Options

                - **`ED25519_SIGN`**:
                  Sign license keys with your account's Ed25519 signing key, using elliptic curve cryptography and
                  SHA512. The given license key data will be base64url encoded and then prefixed with `key/` before
                  signing, and the signing data's signature will be base64url encoded and then appended onto the end of
                  the signing data, delimited by the `.` character, e.g.
                  `key/{URLBASE64URL_KEY}.{URLBASE64URL_SIGNATURE}`. This is our recommended signing scheme, but it may
                  not be supported in your preferred programming language.
                - **`RSA_2048_PKCS1_PSS_SIGN_V2**`:
                  Sign license keys with your account's 2048-bit RSA private key using RSA PKCS1-PSS padding, with a
                  SHA256 digest, max salt length, and a SHA256 MGF1. The provided embedded dataset will be base64url
                  encoded and then prefixed with `key/` before signing, and the signing data's signature will be
                  base64url encoded and then appended onto the end of the signing data, delimited by the `.` character,
                  e.g. `key/{URLBASE64URL_KEY}.{URLBASE64URL_SIGNATURE}`, resulting in the final key. This is our
                  recommended RSA scheme, but it may not be supported in your preferred programming language.
                - **`RSA_2048_PKCS1_SIGN_V2**`:
                  Sign license keys with your account's 2048-bit RSA private key using RSA PKCS1 v1.5 padding, with a
                  SHA256 digest. The provided embedded dataset will be base64url encoded and then prefixed with `key/`
                  before signing, and the signing data's signature will be base64url encoded and then appended onto the
                  end of the signing data, delimited by the `.` character, e.g.
                  `key/{URLBASE64URL_KEY}.{URLBASE64URL_SIGNATURE}`, resulting in the final key.
                - **`RSA_2048_PKCS1_ENCRYPT**`:
                  Encrypt license keys with your account's 2048-bit RSA private key using RSA PKCS1 v1.5 padding. The
                  provided dataset will be encrypted using your account's private key and then base64url encoded,
                  resulting in the final key. The key can be decrypted using your account's public key. The key must
                  contain no more than `245` bytes (please note this is *byte length* not *string length*).
                - **`RSA_2048_JWT_RS256**`:
                  Encode a license claims payload into a JWT using the RS256 algorithm. The license key must be a valid
                  JWT claims payload (i.e. a JSON encoded string). The JWT will be signed using your account's 2048-bit
                  RSA private key and can be verified using your account's public key. The resulting key will be a full
                  JSON Web Token. We do not modify your claims payload.
            requireProductScope:
              type: boolean
              description: |
                When enabled, validating a license that implements the policy will require a product scope that matches
                the licenses's product relationship by its identifier (UUID).
            requirePolicyScope:
              type: boolean
              description: |
                When enabled, validating a license that implements the policy will require a policy scope that matches
                the licenses's policy relationship by its identifier (UUID).
            requireMachineScope:
              type: boolean
              description: |
                When enabled, validating a license that implements the policy will require a machine scope that matches
                at least 1 of the licenses's machine relationships by its identifier (UUID).
              default: false
            requireFingerprintScope:
              type: boolean
              description: |
                When enabled, validating a license that implements the policy will require a fingerprint scope that
                matches at least 1 of the licenses's machine relationships by its fingerprint.
            requireUserScope:
              type: boolean
              description: |
                When enabled, validating a license that implements the policy will require a user scope that matches the
                license's user relationship.
            requireChecksumScope:
              type: boolean
              description: |
                When enabled, validating a license that implements the policy will require a checksum scope to be
                provided, matching an accessible artifact for the license.
            requireVersionScope:
              type: boolean
              description: |
                When enabled, validating a license that implements the policy will require a version scope to be
                provided, matching an accessible release for the license.
            requireCheckIn:
              type: boolean
              description: |
                When enabled, a license that implements the policy will require check-in at a predefined interval to
                continue to pass validation i.e. if a license misses a check-in, it will be invalidated.
            checkInInterval:
              type:
                - string
                - "null"
              enum:
                - day
                - week
                - month
                - year
              description: |
                One of `day`, `week`, `month` or `year`. The frequency at which a license should check-in.

                ### Options

                - **`day`**:
                  Require a license implementing the policy to check-in at least once every day to remain valid.
                - **`week`**:
                  Require a license implementing the policy to check-in at least once every week to remain valid.
                - **`month`**:
                  Require a license implementing the policy to check-in at least once every month to remain valid.
                - **`year`**:
                  Require a license implementing the policy to check-in at least once every year to remain valid.
            checkInIntervalCount:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The number of intervals (specified in the check-in interval property) between each required check-in.
                For example, `checkInInterval=week` and `checkInIntervalCount=2` requires check-in every 2 weeks. Must
                be a number between 1 and 365 inclusive.
            usePool:
              type: boolean
              description: |
                Whether or not to pull license keys from a finite pool of pre-determined keys. This is useful for
                invite-only programs such as a private beta, when you need a limited set of licenses, or when you want
                to define the keys manually. This cannot be changed later on.
            maxMachines:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of machines a license implementing the policy can have associated with it. This is
                only enforced when the policy is strict. When `null`, an unlimited number of machines may be associated
                with a license if the policy is floating. Must be a number greater than 0, and must be equal to 1 for
                non-floating policies.
            maxProcesses:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of machine processes a license implementing the policy can have associated with it,
                also depending on the policy's leasing strategy. When `null`, an unlimited number of machine processes
                may be associated with a license. Must be a number greater than 0.
            maxCores:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of machine CPU cores a license implementing the policy can have associated with it.
                The count is the sum of all cores for the license's machines. This is inherited from the policy. When
                `null`, a license which implements the policy can have an unlimited number of CPU cores.
            maxUses:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of uses a license implementing the policy can have. Cannot exceed `2,147,483,647`,
                which is the maximum value of a 4 byte integer. When `null`, a license which implements the policy can
                have an unlimited number of uses. This attribute is not taken into account during license validation.
                See the license's usage-related actions for more details.
            protected:
              type: boolean
              description: |
                Whether or not the policy is protected. A protected policy disallows users the ability to create and
                manage licenses themselves, useful in situations where Keygen is only managed server-side or when you
                aren't listening for the appropriate user-initiated webhook events. If the account is protected, all
                policies automatically inherit that value when left blank.
            requireHeartbeat:
              type: boolean
              description: |
                Whether or not the policy requires its machines to maintain a heartbeat. When enabled, machines that do
                not have a heartbeat will fail validation with a `HEARTBEAT_NOT_STARTED` validation code. In addition,
                when enabled, new machines will automatically have their first heartbeat set upon creation. When
                disabled, heartbeats are optional.
            heartbeatDuration:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The heartbeat duration for the policy, in seconds. When a machine has an active heartbeat monitor, the
                machine must send heartbeat pings within this timeframe to remain activated. Must be greater than or
                equal to 1 minute (60).
            heartbeatCullStrategy:
              type: string
              enum:
                - DEACTIVATE_DEAD
                - KEEP_DEAD
              description: |
                The strategy used for culling dead machines and processes.

                ### Options

                - **`DEACTIVATE_DEAD`**:
                  Automatically deactivate machines that fail to maintain their heartbeat pings. This is the default.
                - **`KEEP_DEAD`**:
                  Mark machines that fail to maintain their heartbeat pings as dead, but do not deactivate.
            heartbeatResurrectionStrategy:
              type: string
              enum:
                - NO_REVIVE
                - 1_MINUTE_REVIVE
                - 2_MINUTE_REVIVE
                - 5_MINUTE_REVIVE
                - 10_MINUTE_REVIVE
                - 15_MINUTE_REVIVE
                - ALWAYS_REVIVE
              description: |
                The strategy used for controlling whether or not dead machines and processes can be resurrected shortly
                after death. A resurrection occurs when a heartbeat ping is sent to a dead machine or process that is
                within its resurrection window.

                ### Options

                - **`NO_REVIVE`**: Do not allow dead machines and processes to be revived. This is the default.
                - **`1_MINUTE_REVIVE`**:
                  A machine or process can be revived if it sends a ping within 1 minute from its time of death.
                - **`2_MINUTE_REVIVE`**:
                  A machine or process can be revived if it sends a ping within 2 minutes from its time of death.
                - **`5_MINUTE_REVIVE`**:
                  A machine or process can be revived if it sends a ping within 5 minutes from its time of death.
                - **`10_MINUTE_REVIVE`**:
                  A machine or process can be revived if it sends a ping within 10 minutes from its time of death.
                - **`15_MINUTE_REVIVE`**:
                  A machine or process can be revived if it sends a ping within 15 minutes from its time of death.
                - **`ALWAYS_REVIVE`**:
                  A machine or process can always be revived. Requires a cull strategy of `KEEP_DEAD`.
            heartbeatBasis:
              type: string
              enum:
                - FROM_CREATION
                - FROM_FIRST_PING
              description: |
                Control when a machine's initial heartbeat is started. By default, a machine's heartbeat is started on
                creation when its policy requires a heartbeat. Overwise, it is started on first ping.

                ### Options

                - **`FROM_CREATION`**: The heartbeat duration is calculated from the machine's creation time.
                - **`FROM_FIRST_PING`**: The heartbeat duration is calculated from the machine's first heartbeat ping.
            machineUniquenessStrategy:
              type: string
              enum:
                - UNIQUE_PER_ACCOUNT
                - UNIQUE_PER_PRODUCT
                - UNIQUE_PER_POLICY
                - UNIQUE_PER_LICENSE
              description: |
                The matching strategy for machine fingerprints supplied during a license validation.

                ### Options

                - **`UNIQUE_PER_ACCOUNT`**:
                  Machine fingerprints must be unique across the entire Keygen account. This will block all duplicate
                  fingerprints, regardless of whether or not the fingerprint belongs to another product, policy or
                  license.
                - **`UNIQUE_PER_PRODUCT`**:
                  Machine fingerprints must be unique across all licenses belonging to a product. This will block all
                  duplicate fingerprints of the same product, regardless of whether or not the fingerprint belongs to
                  another policy or license.
                - **`UNIQUE_PER_POLICY`**:
                  Machine fingerprints must be unique across all licenses for the policy. This will block all duplicate
                  fingerprints of the same policy, regardless of whether or not the fingerprint belongs to another
                  license.
                - **`UNIQUE_PER_LICENSE`**:
                  Machine fingerprints must be unique to the license. This will block all duplicate fingerprints for
                  same license, but the same fingerprint can exist across different licenses. This is the default.
            machineMatchingStrategy:
              type: string
              enum:
                - MATCH_ANY
                - MATCH_TWO
                - MATCH_MOST
                - MATCH_ALL
              description: |
                The matching strategy for machine fingerprints supplied during a license validation.

                ### Options

                - **`MATCH_ANY`**:
                  At least 1 of the supplied fingerprints must match a fingerprint for the license's associated
                  machines. E.g. if 3 fingerprints are supplied, at least 1 of them must match.
                - **`MATCH_TWO`**:
                  At least 2 of the supplied fingerprints must match a fingerprint for the license's associated
                  machines. E.g. if 4 fingerprints are supplied, at least 2 of them must match.
                - **`MATCH_MOST`**:
                  The majority of supplied fingerprints must match the fingerprints for the license's associated
                  machines. E.g. if 3 fingerprints are supplied, at least 2 of them must match.
                - **`MATCH_ALL`**:
                  All supplied fingerprints must match the fingerprints for the license's associated machines. E.g. if 3
                  fingerprints are supplied, all 3 of them must match.
            componentUniquenessStrategy:
                type: string
                enum:
                  - UNIQUE_PER_ACCOUNT
                  - UNIQUE_PER_PRODUCT
                  - UNIQUE_PER_POLICY
                  - UNIQUE_PER_LICENSE
                  - UNIQUE_PER_MACHINE
                default: UNIQUE_PER_MACHINE
                description: |
                  The uniqueness validation strategy for component fingerprints. You can utilize this to prevent duplicate fingerprints across a variety of scopes.

                  This is especially useful for disallowing trial licenses for specific hardware that had previously completed a trial evaluation using another trial machine
                  or license. You would set the trial policy to `UNIQUE_PER_POLICY`, and then set any non-trial policies to `UNIQUE_PER_LICENSE`. This would effectively block a
                  device from using multiple trials even if e.g. the operating system was reinstalled.

                  ### Options

                  - **`UNIQUE_PER_ACCOUNT`**:
                    Component fingerprints must be unique across the entire Keygen account. This will block all duplicate fingerprints, regardless of whether or
                    not the fingerprint belongs to another product, policy or license.
                  - **`UNIQUE_PER_PRODUCT`**:
                    Component fingerprints must be unique across all licenses belonging to a product. This will block all duplicate fingerprints of the same
                    product, regardless of whether or not the fingerprint belongs to another policy or license.
                  - **`UNIQUE_PER_POLICY`**:
                    Component fingerprints must be unique across all licenses for the policy. This will block all duplicate fingerprints of the same policy,
                    regardless of whether or not the fingerprint belongs to another license.
                  - **`UNIQUE_PER_LICENSE`**:
                    Component fingerprints must also be unique to the license. This will block all duplicate fingerprints for same license, but the same
                    fingerprint can exist across different licenses.
                  - **`UNIQUE_PER_MACHINE`**:
                    Component fingerprints must be unique to the machine. This will allow the same component to exist across multiple machines for the same
                    license. This is the default.
            componentMatchingStrategy:
                type: string
                enum:
                  - MATCH_ANY
                  - MATCH_TWO
                  - MATCH_MOST
                  - MATCH_ALL
                default: MATCH_ANY
                description: |
                  The matching strategy for component fingerprints supplied during a license validation.

                  This is especially useful for managing individual hardware components of a given device, e.g. HDD ID, mobo ID, MAC addresses, IP addresses, etc., and then
                  requiring that some, most, or all components match during a license validation. These can be managed through the components resource.

                  ### Options

                  - **`MATCH_ANY`**:
                    At least 1 of the supplied fingerprints must match a fingerprint for the machine's associated components. E.g. if 3 fingerprints are supplied, at
                    least 1 of them must match.
                  - **`MATCH_TWO`**:
                    At least 2 of the supplied fingerprints must match a fingerprint for the machine's associated components. E.g. if 4 fingerprints are supplied, at
                    least 2 of them must match.
                  - **`MATCH_MOST`**:
                    The majority of supplied fingerprints must match the fingerprints for the machine's associated components. E.g. if 3 fingerprints are supplied, at
                    least 2 of them must match.
                  - **`MATCH_ALL`**:
                    All supplied fingerprints must match the fingerprints for the machine's associated components. E.g. if 3 fingerprints are supplied, all 3 of them must
                    match.
            expirationStrategy:
              type: string
              enum:
                - RESTRICT_ACCESS
                - REVOKE_ACCESS
                - MAINTAIN_ACCESS
                - ALLOW_ACCESS
              description: |
                The strategy for expired licenses during a license validation and when accessing releases.

                ### Options

                - **`RESTRICT_ACCESS`**:
                  Expired licenses can continue to access releases published prior to their expiry, but automatic
                  upgrades are disabled. Validation scopes take precedence over expiry check during license validation.
                - **`REVOKE_ACCESS`**:
                  Expired licenses are no longer able to access any releases, including past releases and upgrades.
                  Expiry check takes precedence over scopes during license validation.
                - **`MAINTAIN_ACCESS`**:
                  Expired licenses can continue to access releases published prior to their expiry, but automatic
                  upgrades are disabled. Validation scopes take precedence over expiry check during license validation.
                  In addition, validations with an `EXPIRED` code will return `valid=true`.
                - **`ALLOW_ACCESS`**:
                  Expired licenses can access any releases, including past releases and future automatic upgrades.
                  Validation scopes take precedence over expiry check during license validation. In addition,
                  validations with an `EXPIRED` code will return `valid=true`.
            transferStrategy:
              type: string
              enum:
                - RESET_EXPIRY
                - KEEP_EXPIRY
              description: |
                Control whether a license's expiration is reset when transferred to this policy.

                ### Options

                - **`RESET_EXPIRY`**:
                  Reset the transferred license's expiry from the time of transfer. For example, if the license had an
                  expiry 3 months from now, and the new policy has a duration of 1 year, transferring would reset the
                  expiry to 1 year from the time of transfer. When the policy has no duration, the license's expiry is
                  removed.
                - **`KEEP_EXPIRY`**: Do not change the license's current expiry. This is the default.
            authenticationStrategy:
              type: string
              enum:
                - TOKEN
                - LICENSE
                - MIXED
                - NONE
              description: |
                The strategy used for authenticating as a license, for client-side integrations.

                ### Options

                - **`TOKEN`**:
                  Allow licenses to authenticate using [a license token](https://keygen.sh/docs/api/authentication/#license-tokens).
                  This is the default.
                - **`LICENSE`**: Allow licenses to authenticate using [a license key](https://keygen.sh/docs/api/authentication/#license-authentication).
                - **`MIXED`**: Allow both license token and license key authentication (each covered above).
                - **`NONE`**: Disable the ability for licenses to authenticate with the API.
            machineLeasingStrategy:
              type: string
              enum:
                - PER_LICENSE
                - PER_USER
              default: PER_LICENSE
              description: |
                The strategy used for leasing machines.

                Please note that a nil owner is significant for a PER_USER leasing strategy. When a machine's owner is nil (or null), the sum of all machines with a nil owner will be counted towards the license's machine limit. Please make sure that you're assigning an owner to machines if you utilize this leasing strategy.

                This defines how machines are leased and counted, especially i.r.t. the policy's max machines limit.

                ### Options

                - **`PER_LICENSE`**:
                  Machines are counted per-license. For example, with a max machines value of 2, each license could have 2 machines. This is the default.
                - **`PER_USER`**:
                  Machines are counted per-user, per-license. For example, with a max machines value of 2, each user could have 2 machines per-license.
            processLeasingStrategy:
              type: string
              enum:
                - PER_MACHINE
                - PER_LICENSE
                - PER_USER
              default: PER_MACHINE
              description: |
                The strategy used for leasing machine processes.

                Please note that a nil owner is significant for a PER_USER leasing strategy. When a machine's owner is nil (or null), the sum of all processes belonging to a machine with a nil owner will be counted towards the license's process limit. Please make sure that you're assigning an owner to machines if you utilize this leasing strategy.

                This defines how processes are leased and counted, especially i.r.t. the policy's max processes limit.

                ### Options

                - **`PER_MACHINE`**:
                  Processes are counted per-machine. For example, given a policy with a max processes value of 5, each license could have up to 5 processes for each machine. This is the default.
                - **`PER_LICENSE`**:
                  Processes are counted per-license. For example, with a max processes value of 5, each license could have up to 5 processes combined across all machines.
                - **`PER_USER`**:
                  Processes are counted per-user, per-license. For example, with a max processes value of 5, each user could have up to 5 processes combined across all owned machines per-license.
            overageStrategy:
              type: string
              enum:
                - ALWAYS_ALLOW_OVERAGE
                - ALLOW_1_25X_OVERAGE
                - ALLOW_1_5X_OVERAGE
                - ALLOW_2X_OVERAGE
                - NO_OVERAGE
              description: |
                The strategy used for allowing machine, core and process overages. Set to `NO_OVERAGE` to disable
                overages altogether (attempts to exceed a limit will then result in an error).

                ### Options

                - **`ALWAYS_ALLOW_OVERAGE`**:
                  The license may exceed its limits, and doing so will not effect the licenses validity, i.e. the
                  following validation codes will return `valid=true`: `TOO_MANY_MACHINES`, `TOO_MANY_CORES`,
                  `TOO_MANY_PROCESSES`.
                - **`ALLOW_1_25X_OVERAGE`**:
                  The license may exceed its limits, up to a maximum of 1.25x. Exceeding a limit will not effect the
                  license's validity right away, i.e. the following validation codes will return `valid=true`:
                  `TOO_MANY_MACHINES`, `TOO_MANY_CORES`, `TOO_MANY_PROCESSES`. The license will begin to fail validation
                  once the 1.25x allowance has been exceeded. When using a 1.25x allowance, all resource limits must be
                  divisible by 4.
                - **`ALLOW_1_5X_OVERAGE`**:
                  The license may exceed its limits, up to a maximum of 1.5x. Exceeding a limit will not effect the
                  license's validity right away, i.e. the following validation codes will return `valid=true`:
                  `TOO_MANY_MACHINES`, `TOO_MANY_CORES`, `TOO_MANY_PROCESSES`. The license will begin to fail validation
                  once the 1.5x allowance has been exceeded. When using a 1.5x allowance, all resource limits must be
                  divisible by 2.
                - **`ALLOW_2X_OVERAGE`**:
                  The license may exceed its limits, up to a maximum of 2x. Exceeding a limit will not effect the
                  license's validity right away, i.e. the following validation codes will return `valid=true`:
                  `TOO_MANY_MACHINES`, `TOO_MANY_CORES`, `TOO_MANY_PROCESSES`.
                  The license will begin to fail validation once the 2x allowance has been exceeded.
                - **`NO_OVERAGE`**: Do not allow overages. Attempts to exceed limits will fail. This is the default.
            metadata:
              type: object
              description: Object containing policy metadata.
              additionalProperties: true
            created:
              type: string
              format: date-time
              description: When the policy was created.
            updated:
              type: string
              format: date-time
              description: When the policy was last updated.
          required:
            - name
            - duration
            - strict
            - floating
            - scheme
            - requireProductScope
            - requirePolicyScope
            - requireMachineScope
            - requireFingerprintScope
            - requireUserScope
            - requireChecksumScope
            - requireVersionScope
            - requireCheckIn
            - checkInInterval
            - checkInIntervalCount
            - usePool
            - maxMachines
            - maxProcesses
            - maxCores
            - maxUses
            - protected
            - requireHeartbeat
            - heartbeatDuration
            - heartbeatCullStrategy
            - heartbeatResurrectionStrategy
            - heartbeatBasis
            - machineUniquenessStrategy
            - machineMatchingStrategy
            - componentUniquenessStrategy
            - componentMatchingStrategy
            - expirationStrategy
            - transferStrategy
            - authenticationStrategy
            - machineLeasingStrategy
            - processLeasingStrategy
            - overageStrategy
            - metadata
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the policy belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            product:
              type: object
              description: The product that the policy is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [products]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            pool:
              type: object
              description: The pool of pre-determined keys for the policy.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            licenses:
              type: object
              description: The licenses that implement the policy.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            entitlements:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
          required:
            - account
            - product
            - pool
            - licenses
            - entitlements
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    PolicyEntitlement:
      summary: The policy entitlement object
      type: object
      properties:
        id:
          type: string
        type:
          type: string
          enum: [policy-entitlements]
        attributes:
          type: object
          properties:
            created:
              type: string
              format: date-time
            updated:
              type: string
              format: date-time
          required:
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            entitlement:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [entitlements]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            policy:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [policies]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
            - entitlement
            - policy
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    User:
      type: object
      summary: The user object
      description: |
        Keygen provides identity management for your customers, which allows you to authenticate them using an
        email/password by creating a [token](https://keygen.sh/docs/api/tokens/). The token can then be used to manage
        their resources in a client-side environment, e.g. activating machines, creating licenses, etc. In addition, it
        offers other features such as associating multiple licensing with a single user, a simple password reset flow,
        etc.

        Users don't necessarily need a password. The only required attribute for a user is an email address.
        Passwordless users can be useful for associating an email address to a license, for example, for a license key
        recovery flow.

        Below you will find the various attributes for the user resource, as well as the user resource's relationships.
        To modify a relationship, you will need to use the canonical link for the given resource.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [users]
        attributes:
          type: object
          properties:
            fullName:
              type:
                - string
                - "null"
              description: The full name of the user.
            firstName:
              type:
                - string
                - "null"
              description: The first name of the user.
            lastName:
              type:
                - string
                - "null"
              description: The last name of the user.
            email:
              type: string
              description: The unique email of the user.
            status:
              type: string
              enum:
                - ACTIVE
                - INACTIVE
                - BANNED
              description: |
                The users's status, for filtering purposes and to ascertain overall status at-a-glance. An active user
                is a user that was created within the last 90 days, or has a license that has been created, validated,
                checked out, or checked in within the last 90 days. An inactive user is a user that has none of those
                traits. One of: `ACTIVE`, `INACTIVE`, or `BANNED`.
            role:
              type: string
              enum:
                - user
                - support-agent
                - sales-agent
                - developer
                - read-only
                - admin
              description: |
                The role for the user.

                ### Options

                - **`user`**:
                  A normal user of one or more of your products. Depending on account settings, they can have permission
                  to manage their own resources, e.g. licenses and machines. They cannot manage other users' resources.
                - **`support-agent`**:
                  An internal administrative user of your Keygen account, with a limited subset of permissions. Support
                  Agents can read most resource data, but cannot create, update or delete resources.
                - **`sales-agent`**:
                  An internal administrative user of your Keygen account, with a limited subset of permissions. Sales
                  Agents can read most resource data, but can only create, update and delete specific resources.
                - **`developer`**:
                  An internal administrative user of your Keygen account, with permission to manage all resources, but
                  they cannot manage account billing.
                - **`read-only`**:
                  An internal administrative user of your Keygen account, with permission to read all resources, except
                  for account billing.
                - **`admin`**:
                  An internal administrative user of your Keygen account, with permission to manage the entire account.
            permissions:
              type: array
              items:
                type: string
              description: An array of permissions the user has.
            metadata:
              type: object
              description: Object containing user metadata.
              additionalProperties: true
            created:
              type: string
              format: date-time
              description: When the user was created.
            updated:
              type: string
              format: date-time
              description: When the user was last updated.
          required:
            - fullName
            - firstName
            - lastName
            - email
            - status
            - role
            - metadata
            - created
            - updated
            - metadata
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the user belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - links
                - data
            group:
              type: object
              description: The group the user belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [groups]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - links
            products:
              type: object
              description: The products that the user is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            licenses:
              type: object
              description: The licenses that the user owns.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            machines:
              type: object
              description: The machines that the user owns.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            tokens:
              type: object
              description: The authentication tokens of the user.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            secondFactors:
              type: object
              description: The second factors of the user.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
          required:
            - account
            - group
            - products
            - licenses
            - machines
            - tokens
            - secondFactors
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    License:
      type: object
      summary: The license object
      description: |
        Below you will find the various attributes for the license resource, as well as the license resource's
        relationships. A license is an implementation of a product's policy.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [licenses]
        attributes:
          type: object
          properties:
            name:
              type:
                - string
                - "null"
              description: The name of the license. This can be used to distinguish licenses from eachother.
            key:
              type: string
              description: |
                A unique pre-determined key for the license. License keys are immutable values. Cannot be used on
                legacy encrypted licenses. This attribute will be automatically generated or popped from the
                remaining pool if left blank and the chosen scheme supports auto-generated keys. Depending on the
                policy's [cryptographic scheme](https://keygen.sh/docs/api/cryptography/#cryptographic-keys)
                (if any), the key attribute may be required for a 'seed' dataset to embed into the final key, and
                the key may have other requirements that must be met regarding dataset length and formatting. The
                key and its signature may be [`base64url` encoded](https://keygen.sh/docs/api/signatures/),
                depending on the chosen scheme.
            expiry:
              type:
                - string
                - "null"
              format: date-time
              description: |
                When the license will expire. Calculated from the license's policy, i.e.
                `time.now + policy.duration`, at the time of creation and/or renewal.
            status:
              type: string
              enum:
                - ACTIVE
                - INACTIVE
                - EXPIRING
                - EXPIRED
                - SUSPENDED
                - BANNED
              description: |
                The license's status, for filtering purposes and to ascertain overall status at-a-glance. An active
                license is a license that has been created, validated, checked out, or checked in within the last 90
                days. An expiring license is a license that is expiring within the next 3 days. One of: `ACTIVE`,
                `INACTIVE`, `EXPIRING`, `EXPIRED`, `SUSPENDED`, or `BANNED`.
            uses:
              type: integer
              format: int64
              description: |
                The license's current usage count. This can be incremented, decremented, or reset using the
                license's usage-related actions. Cannot exceed `2,147,483,647`, which is the maximum value of a 4
                byte integer.
            protected:
              type: boolean
              description: The license's last validated release version.
            version:
              type:
                - string
                - "null"
              description: |
                The version of the license. This is useful for versioning your licenses, e.g. for a beta program.
                This attribute is not taken into account during license validation. See the license's usage-related
                actions for more details.
            suspended:
              type: boolean
              description: Whether or not the license is suspended. A suspended license will always fail validation.
            floating:
              type: boolean
              description: Whether or not the license is floating. This is inherited from the policy.
            scheme:
              type:
                - string
                - "null"
              enum:
                - ED25519_SIGN
                - RSA_2048_PKCS1_PSS_SIGN_V2
                - RSA_2048_PKCS1_SIGN_V2
                - RSA_2048_PKCS1_ENCRYPT
                - RSA_2048_JWT_RS256
              description: |
                The cryptographic encryption/signature scheme used on the license's key. Can be used to implement
                offline licensing by securely storing arbitrary data within a license's key.
            strict:
              type: boolean
              description: Whether or not the policy is strict. This is inherited from the policy.
            maxMachines:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of machines the license can have associated with it. This is by default inherited
                from the policy, but can be overridden on a per-license basis.
            maxProcesses:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of machine processes the license can have associated with it. This is by default
                inherited from the policy, but can be overridden on a per-license basis.
            maxUsers:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of users the license can have associated with it. This is by default inherited from the policy, but can be overridden on a per-license basis.
            maxCores:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of machine CPU cores the license can have associated with it. The count is the
                sum of all cores for the license's machines. This is by default inherited from the policy, but can
                be overridden on a per-license basis.
            maxUses:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The maximum number of uses the license is allowed to have. This is by default inherited from the
                policy, but can be overridden on a per-license basis.
            requireHeartbeat:
              type: boolean
              description: Whether or not machines require heartbeat pings. This is inherited from the policy.
            requireCheckIn:
              type: boolean
              description: |
                Whether or not the license will require check-in at a predefined interval to continue to pass
                validation i.e. if a license misses a check-in, it will be invalidated. This is inherited from the
                policy.
            lastValidated:
              type:
                - string
                - "null"
              format: date-time
              description: When the license was last validated.
            lastCheckOut:
              type:
                - string
                - "null"
              format: date-time
              description: When the license was last checked-out.
            lastCheckIn:
              type:
                - string
                - "null"
              format: date-time
              description: |
                When the license was last checked-in. This is `null` if the policy does not require check-ins.
            nextCheckIn:
              type:
                - string
                - "null"
              format: date-time
              description: |
                The time at which the license is required to check-in by. This is `null` if the policy does not
                require check-ins.
            metadata:
              type: object
              description: Object containing license metadata.
              additionalProperties: true
            created:
              type: string
              format: date-time
              description: When the license was created.
            updated:
              type: string
              format: date-time
              description: When the license was last updated.
            permissions:
              type: array
              items:
                type: string
              description: An array of permissions the license has.
          required:
            - name
            - key
            - expiry
            - status
            - uses
            - protected
            - version
            - suspended
            - floating
            - scheme
            - strict
            - maxMachines
            - maxProcesses
            - maxCores
            - maxUses
            - requireHeartbeat
            - requireCheckIn
            - lastValidated
            - lastCheckOut
            - lastCheckIn
            - nextCheckIn
            - metadata
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the license belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            product:
              type: object
              description: The product that the license is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [products]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            policy:
              type: object
              description: The policy that the license implements.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [policies]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            group:
              type: object
              description: |
                The group the license belongs to. By default, this is inherited from the license's user, if present.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [groups]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - links
            owner:
              type: object
              description: The user that owns the license.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [users]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - links
            users:
              type: object
              description: The user that the license is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                meta:
                  type: object
                  properties:
                    count:
                      type: integer
                      format: int64
              required:
                - links
            machines:
              type: object
              description: The machines that the license is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                meta:
                  type: object
                  properties:
                    cores:
                      type: integer
                      format: int64
                    count:
                      type: integer
                      format: int64
              required:
                - links
            tokens:
              type: object
              description: The authentication tokens of the license.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            entitlements:
              type: object
              description: The entitlements that the license is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
          required:
            - account
            - product
            - policy
            - group
            - user
            - machines
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    LicenseEntitlement:
      summary: The license entitlement object
      type: object
      properties:
        id:
          type: string
        type:
          type: string
          enum: [license-entitlements]
        attributes:
          type: object
          properties:
            created:
              type: string
              format: date-time
            updated:
              type: string
              format: date-time
          required:
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            entitlement:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [entitlements]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            license:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [licenses]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
            - entitlement
            - license
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    LicenseFile:
      summary: The license file object
      type: object
      properties:
        id:
          type: string
        type:
          type: string
          enum: [license-files]
        attributes:
          type: object
          properties:
            certificate:
              type: string
              description: The certificate of the license. This is the FilePayload encoded as a base64 string.
            ttl:
              type: integer
              format: int64
            expiry:
              type: string
              format: date-time
            issued:
              type: string
              format: date-time
            includes:
              type: array
              items:
                type: string
                enum:
                  - entitlements
                  - product
                  - policy
                  - user
                  - environment
                  - group
              description: |
                The relationship data included in the license file.
          required:
            - certificate
            - ttl
            - expiry
            - issued
        relationships:
          type: object
          properties:
            account:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            license:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [licenses]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
            - license
      required:
        - id
        - type
        - attributes
        - relationships
    FilePayload:
      type: object
      properties:
        enc:
          type: string
          format: byte
          description: The license/machine data encoded in base64 that will be encrypted if `encrypt` was used during the checkout.
        sig:
          type: string
          format: byte
          description: The signature encoded in base64 signed by the algorithm specified in `alg`.
        alg:
          type: string
          enum:
            - aes-256-gcm+ed25519
            - aes-256-gcm+rsa-pss-sha256
            - aes-256-gcm+rsa-sha256
            - base64+ed25519
            - base64+rsa-pss-sha256
            - base64+rsa-sha256
          description: The algorithm used for encryption and signing.
      required:
        - enc
        - sig
        - alg
    LicenseFilePayloadEnc:
      type: object
      properties:
        data:
          $ref: "#/components/schemas/License"
        included:
          type: array
          items:
            anyOf:
              - $ref: "#/components/schemas/Entitlement"
              - $ref: "#/components/schemas/Product"
              - $ref: "#/components/schemas/Policy"
              - $ref: "#/components/schemas/User"
              - $ref: "#/components/schemas/Group"
              # - $ref: "#/components/schemas/Environment"
        meta:
          $ref: "#/components/schemas/FilePayloadMeta"
      required:
        - data
        - included
        - meta
    Machine:
      type: object
      summary: The machine object
      description: |
        Below you will find the various attributes for the machine resource, as well as the machine resource's
        relationships. Machines can be used to track and manage where your users are allowed to use your product.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [machines]
        attributes:
          type: object
          properties:
            fingerprint:
              type: string
              description: The fingerprint of the machine.
            cores:
              type:
                - integer
                - "null"
              format: int64
              description: The number of CPU cores for the machine.
            name:
              type:
                - string
                - "null"
              description: The human-readable name of the machine.
            ip:
              type:
                - string
                - "null"
              description: The IP of the machine.
            hostname:
              type:
                - string
                - "null"
              description: The hostname of the machine.
            platform:
              type:
                - string
                - "null"
              description: The platform of the machine.
            maxProcesses:
              type: 
                - integer
                - "null"
              format: int64
              description: The maximum number of processes the machine can have associated with it.
            requireHeartbeat:
              type: boolean
              description: |
                Whether or not the machine requires heartbeat pings, i.e. the policy requires heartbeats, or the
                machine has an active heartbeat monitor.
            heartbeatStatus:
              type: string
              enum:
                - NOT_STARTED
                - ALIVE
                - DEAD
                - RESURRECTED
              description: The status of the machine's heartbeat.
            heartbeatDuration:
              type: integer
              format: int64
              description: The policy's heartbeat duration.
            lastHeartbeat:
              type:
                - string
                - "null"
              format: date-time
              description: When the machine last sent a heartbeat ping.
            nextHeartbeat:
              type:
                - string
                - "null"
              format: date-time
              description: The time at which the machine is required to send a heartbeat ping by.
            lastCheckOut:
              type:
                - string
                - "null"
              format: date-time
              description: When the machine was last checked-out.
            metadata:
              type: object
              description: Object containing machine metadata.
              additionalProperties: true
            created:
              type: string
              format: date-time
              description: When the machine was created.
            updated:
              type: string
              format: date-time
              description: When the machine was last updated.
          required:
            - fingerprint
            - cores
            - name
            - ip
            - hostname
            - platform
            - maxProcesses
            - requireHeartbeat
            - heartbeatStatus
            - heartbeatDuration
            - lastHeartbeat
            - nextHeartbeat
            - lastCheckOut
            - metadata
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the machine belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            product:
              type: object
              description: The product that the machine is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [products]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            license:
              type: object
              description: The license that the machine is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [licenses]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            group:
              type: object
              description: The group the machine belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [groups]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - links
            owner:
              type: object
              description: The user that owns the machine.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type:
                    - object
                    - "null"
                  properties:
                    type:
                      type: string
                      enum: [users]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            components:
              type: object
              description: The components for the machine.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
            processes:
              type: object
              description: The processes for the machine.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
              required:
                - links
          required:
            - account
            - product
            - license
            - group
            - processes
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    MachineFile:
      summary: The machine file object
      type: object
      properties:
        id:
          type: string
        type:
          type: string
          enum: [machine-files]
        attributes:
          type: object
          properties:
            certificate:
              type: string
              description: The certificate of the machine. This is the FilePayload encoded as a base64 string.
            ttl:
              type: integer
              format: int64
            expiry:
              type: string
              format: date-time
            issued:
              type: string
              format: date-time
            includes:
              type: array
              items:
                type: string
                enum:
                  - entitlements
                  - product
                  - policy
                  - user
                  - environment
                  - group
              description: |
                The relationship data included in the license file.
          required:
            - certificate
            - ttl
            - expiry
            - issued
        relationships:
          type: object
          properties:
            account:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            license:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [licenses]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            machine:
              type: object
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [machines]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
            - license
            - machine
      required:
        - id
        - type
        - attributes
        - relationships
    MachineFilePayloadEnc:
      type: object
      properties:
        data:
          $ref: "#/components/schemas/Machine"
        included:
          type: array
          items:
            anyOf:
              - $ref: "#/components/schemas/Entitlement"
              - $ref: "#/components/schemas/Product"
              - $ref: "#/components/schemas/Policy"
              - $ref: "#/components/schemas/User"
              - $ref: "#/components/schemas/License"
              - $ref: "#/components/schemas/Component"
              # - $ref: "#/components/schemas/Environment"
              - $ref: "#/components/schemas/Group"
        meta:
          $ref: "#/components/schemas/FilePayloadMeta"
      required:
        - data
        - included
        - meta
    FilePayloadMeta:
      type: object
      properties:
        issued:
          type: string
          format: date-time
        expiry:
          type:
            - string
            - "null"
          format: date-time
        ttl:
          type: integer
          description: The time-to-live (TTL) of the checked out file, in seconds.
      required:
        - issued
        - expiry
        - ttl
    Component:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier for the component.
        type:
          type: string
          enum: [components]
        attributes:
          type: object
          properties:
            fingerprint:
              type: string
              description: The unique fingerprint of the component, e.g. a motherboard serial number. Must be unique within the scope of the machine it belongs to.
            name:
              type: string
              description: The human readable-name of the component.
            metadata:
              type: object
              additionalProperties: true
              description: Object containing component metadata.
            created:
              type: string
              format: date-time
              description: When the component was created.
              readOnly: true
            updated:
              type: string
              format: date-time
              description: When the component was last updated.
              readOnly: true
          required:
            - fingerprint
            - name
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the process belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            product:
              type: object
              description: The product that the process is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [products]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            license:
              type: object
              description: The license that the process is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [licenses]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            machine:
              type: object
              description: The machine that the process is for.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [machines]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
            - machine
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    Process:
      type: object
      summary: The process object
      description: |
        Utilizing processes, you can manage application concurrency across machines. For example, you could restrict the
        number of application instances allowed per-machine.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [processes]
        attributes:
          type: object
          properties:
            pid:
              type: integer
              format: int64
              description: |
                The pid of the process. This can be an arbitrary string, but must be unique within the scope of the
                process it belongs to.
            status:
              type: string
              enum:
                - ALIVE
                - DEAD
                - RESURRECTED
              description: |
                The status of the process's heartbeat. One of: `ALIVE`, `DEAD`, or `RESURRECTED`.
            lastHeartbeat:
              type:
                - string
                - "null"
              format: date-time
              description: |
                When the process last sent a heartbeat ping. The initial value of this attribute will be equal to
                the process's created timestamp.
            nextHeartbeat:
              type:
                - string
                - "null"
              format: date-time
              description: |
                The time at which the process is required to send its next heartbeat ping by. This attribute is
                calculated using the license policy's heartbeat duration.
            interval:
              type:
                - integer
                - "null"
              format: int64
              description: |
                The heartbeat interval for the process, in seconds. The process must send heartbeat pings within
                this timeframe to remain alive. This is inherited from the license's policy.
            metadata:
              type: object
              description: Object containing process metadata.
              additionalProperties: true
            created:
              type: string
              format: date-time
              description: When the process was created.
            updated:
              type: string
              format: date-time
              description: When the process was last updated.
          required:
            - pid
            - status
            - lastHeartbeat
            - nextHeartbeat
            - interval
            - metadata
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the process belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            product:
              type: object
              description: The product that the process is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [products]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            license:
              type: object
              description: The license that the process is associated with.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [licenses]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            machine:
              type: object
              description: The machine that the process is for.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [machines]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
            - product
            - license
            - machine
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    WebhookEvent:
      type: object
      summary: The webhook event object
      description: |
        Webhook events are dispatched using POST requests to an account's webhook endpoints. Events usually get sent
        quickly, but sometimes there can be a small delay. If you experience a delay longer than 1 hour for the initial
        event, please contact us.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [webhook-events]
        attributes:
          type: object
          properties:
            endpoint:
              type: string
              description: The endpoint that the event will be sent to.
            payload:
              type: object
              description: The event payload in serialized JSON format.
            event:
              type: string
              enum:
                - account.updated
                - account.subscription.paused
                - account.subscription.resumed
                - account.subscription.canceled
                - account.subscription.renewed
                - account.plan.updated
                - account.billing.updated
                - user.created
                - user.updated
                - user.deleted
                - user.password-reset
                - user.banned
                - user.unbanned
                - user.group.updated
                - product.created
                - product.updated
                - product.deleted
                - policy.created
                - policy.updated
                - policy.deleted
                - policy.pool.popped
                - policy.entitlements.attached
                - policy.entitlements.detached
                - license.created
                - license.updated
                - license.deleted
                - license.expiring-soon
                - license.expired
                - license.checked-out
                - license.checked-in
                - license.check-in-required-soon
                - license.check-in-overdue
                - license.validation.succeeded
                - license.validation.failed
                - license.usage.incremented
                - license.usage.decremented
                - license.usage.reset
                - license.renewed
                - license.revoked
                - license.suspended
                - license.reinstated
                - license.policy.updated
                - license.user.updated
                - license.group.updated
                - license.entitlements.attached
                - license.entitlements.detached
                - machine.created
                - machine.updated
                - machine.deleted
                - machine.checked-out
                - machine.heartbeat.ping
                - machine.heartbeat.dead
                - machine.heartbeat.resurrected
                - machine.heartbeat.reset
                - machine.group.updated
                - package.created
                - package.updated
                - package.deleted
                - process.created
                - process.updated
                - process.deleted
                - process.heartbeat.ping
                - process.heartbeat.dead
                - process.heartbeat.resurrected
                - token.generated
                - token.regenerated
                - token.revoked
                - second-factor.created
                - second-factor.enabled
                - second-factor.disabled
                - second-factor.deleted
                - entitlement.created
                - entitlement.updated
                - entitlement.deleted
                - release.created
                - release.updated
                - release.deleted
                - release.upgraded
                - release.package.updated
                - release.published
                - release.yanked
                - release.constraints.attached
                - release.constraints.detached
                - artifact.created
                - artifact.updated
                - artifact.deleted
                - artifact.downloaded
                - artifact.uploaded
                - group.created
                - group.updated
                - group.deleted
                - group.owners.attached
                - group.owners.detached
            status:
              type: string
              enum:
                - DELIVERING
                - DELIVERED
                - FAILING
                - FAILED
              description: |
                The current status of the event. Possible statuses are: `DELIVERING`, `DELIVERED`, `FAILING`, and
                `FAILED`.
            lastResponseCode:
              type:
                - integer
                - "null"
              format: int64
              description: The last HTTP response code that your webhook endpoint sent in response to the webhook.
            lastResponseBody:
              type:
                - string
                - "null"
              description: The last HTTP response body that your webhook endpoint sent in response to the webhook.
            created:
              type: string
              format: date-time
              description: When the event was created.
            updated:
              type: string
              format: date-time
              description: When the event was last updated.
          required:
            - endpoint
            - payload
            - event
            - status
            - lastResponseCode
            - lastResponseBody
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the event belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
        links:
          $ref: "#/components/schemas/SelfLinks"
      required:
        - id
        - type
        - attributes
        - relationships
        - links
    SecondFactor:
      type: object
      summary: The second factor object
      description: |
        Below you will find the various attributes for the second factor resource, as well as the resource's
        relationships.
      properties:
        id:
          type: string
        type:
          type: string
          enum: [second-factors]
        attributes:
          type: object
          properties:
            uri:
              type: string
              description: The provisioning URI of the second factor.
            secret:
              type: string
              description: The secret of the second factor.
            enabled:
              type: boolean
              description: Whether or not the second factor is enabled.
            created:
              type: string
              format: date-time
              description: When the second factor was created.
            updated:
              type: string
              format: date-time
              description: When the second factor was last updated.
          required:
            - uri
            - secret
            - enabled
            - created
            - updated
        relationships:
          type: object
          properties:
            account:
              type: object
              description: The account that the second factor belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [accounts]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
            user:
              type: object
              description: The user the second factor belongs to.
              properties:
                links:
                  $ref: "#/components/schemas/RelatedLinks"
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum: [users]
                    id:
                      type: string
                  required:
                    - type
                    - id
              required:
                - data
                - links
          required:
            - account
            - user
      required:
        - id
        - type
        - attributes
        - relationships
    Error:
      type: object
      properties:
        title:
          type: string
          description: A short, human-readable summary of the problem.
        detail:
          type: string
          description: A more detailed human-readable explanation of the problem.
        code:
          type: string
          description: |
            A unique, unchanging machine-readable error code. This may or may not be included in the error payload,
            depending on the type of error.
        source:
          type: object
          description: |
            A Object containing references to the source of the error. This may or may not be included in the error
            payload, depending on the type of error.
          properties:
            pointer:
              type: string
              description: |
                A pointer to the problem data, e.g. "/data" for the primary data, "/data/attributes/email" for a
                specific attribute, or "/data/relationships/user" for a problem with a relationship. This may or may not
                be included in the error payload, depending on the type of error.
            parameter:
              type: string
              description: |
                A string indicating which URI query parameter caused the error. This may or may not be included in the
                error payload, depending on the type of error.
      required:
        - title
        - detail
    PaginationLinks:
      type: object
      properties:
        first:
          type: string
          format: uri
        last:
          type: string
          format: uri
        prev:
          type: string
          format: uri
        next:
          type: string
          format: uri
        self:
          type: string
          format: uri
        meta:
          type: object
          properties:
            pages:
              type: integer
              format: int64
            count:
              type: integer
              format: int64
          required:
            - pages
            - count
      required:
        - self
        - last
        - first
        - prev
        - next
        - meta
    SelfLinks:
      type: object
      properties:
        self:
          type: string
          format: uri
      required:
        - self
    RelatedLinks:
      type: object
      properties:
        related:
          type: string
          format: uri
      required:
        - related
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
      description: |
        The email and password of the user. Credentials MUST use a colon (i.e. ":") to separate the email and password
        (i.e. "EMAIL:PASSWORD"), and those credentials MUST then be base64 encoded.
    BearerToken:
      type: http
      scheme: bearer
      description: An authentication token with privileges to manage the resource.
security:
  - BearerToken: []