DocsReference
Licensing and revocation
Search is licensed per installation for a fixed term. This page explains exactly what the license check does, what it can and cannot do to your installation, and what it tells us.
The short versionA license lets the software run. It never controls your data. Expiry or revocation stops the search and write APIs. It never deletes, moves, encrypts or withholds anything in your bucket.
The license key
- A license is a single line beginning with
SL1.. It contains a small JSON payload and an Ed25519 signature from Avant. - The payload records your customer name, edition (
pilot,teamorbusiness; Enterprise agreements are issued asbusinesskeys with custom limits), start and expiry dates, grace periods, limits such as the maximum number of indices, and optionally the S3 bucket names it may run against. - The server checks the signature against Avant public keys built into the release. An edited license fails verification, and the server does not start.
- One license covers one installation, meaning one CloudFormation stack and one server.
- The server never logs the license string, only its ID, edition and expiry.
The revocation check
Every 6 hours by default, the server downloads a signed revocation list from:
https://search.avanttechnologiesllc.com/license/v1/revocations.json- The list is signed by Avant and verified with the built-in public keys. An unsigned or altered list is ignored.
- Each list has an increasing sequence number. The server remembers the highest one it has seen, so an old list cannot be replayed.
- Verification state is stored in your object store (
_license/state.json), so a replacement server picks up where the old one left off. - Time-based transitions such as expiry are re-evaluated every minute and do not depend on the network.
What this check tells Avant
The request is an ordinary HTTPS download from our CDN. It includes your license ID, and like any web request it reveals your server's public IP address. Both appear in our CDN access logs. We use them to see which licenses are active and to support you.
The check never sends your documents, queries, index names, mappings, credentials or usage metrics. Avant has no access to your AWS account or your bucket.
The only other request to Avant is downloading the release from this site at install or upgrade.
License states
The server is always in exactly one state, which GET /_license reports to a caller with the monitor or admin action.
| State | Search and writes | When |
|---|---|---|
valid | Full service | Signature valid, within the license term, not revoked, revocation list checked recently. |
grace_offline | Full service + Warning header | The revocation list cannot be fetched, and the last successful check is within the offline grace period, which depends on your edition. |
read_only | Reads work; writes return 403 | Offline grace exhausted; or the license expired within the expiry grace period, which depends on your edition; or the system clock was moved back more than 24 hours. |
revoked | Blocked: 403 license_revoked | The license ID appears on the revocation list. |
expired | Blocked: 403 license_expired | Past the expiry date plus the expiry grace period. |
invalid | Server does not start | Bad signature or format, a start date in the future, or a bucket that does not match the license binding. |
In every state, /health, /ready, /metrics, /_internal/health and GET /_license keep answering, so monitoring always shows you what is happening. The health and metrics endpoints need no credentials. GET /_license is never blocked by the license, but it does need an API key with the monitor or admin action whenever authentication is on, which it always is in the AWS install. In any state other than valid, each data-plane response carries a Warning: 299 header. A caller that has not authenticated gets only a generic license error; the reason and dates are available only through an authenticated GET /_license.
Read-only mode serves search, get, count, msearch, point-in-time reads and console reads. Every write is refused, including _refresh.
The license gates API requests, not work already under way. A background task that started before the license lapsed, such as a compaction or refresh in progress, is not interrupted and finishes normally.
Checking status
curl -s -H 'Authorization: ApiKey <key_id>:<secret>' <ApiEndpoint>/_license
{"state":"valid","license_id":"lic_…","customer_name":"Acme Inc","edition":"pilot",
"expires_at":"…","last_verified_at":"…","limits":{…},"message":"…"}The response never includes the license signature or the raw license. Prometheus metrics also expose the state, the expiry time, the last successful verification, and the outcomes of revocation-list fetches.
What revocation does and does not do
It does
- Stop the search and write APIs (403) at the next check, within about 6 hours.
- Apply to replacement servers too. Every server checks the same list, and the sequence stored in your object store keeps a server from falling back to an older list.
It does not
- Delete, move, encrypt or modify objects in your bucket.
- Touch any other resource in your AWS account.
- Stop you from copying, backing up or deleting the bucket with any S3 tool.
- Stop health, metrics or
/_license(which still needs an API key).
Early revocation is governed by the license terms. The objects in your bucket are in the engine's segment format. If you are leaving Search, export your documents through the API while the license is active or read-only. If you need more time, the license terms entitle you to a free export-only license for up to 30 days; ask within 30 days after the license ends.
Grace periods by edition
Grace periods depend on your edition. The exact values are written into your signed license key, so the server enforces them without contacting us.
| Edition | Offline grace | Read-only after expiry |
|---|---|---|
| Pilot | 7 days | 7 days |
| Team | 14 days | 7 days |
| Business | 30 days | 14 days |
| Enterprise | Custom, up to 90 days for restricted-egress sites | Custom, up to 30 days |
- Offline grace is how long the server keeps full service when it cannot fetch the revocation list, measured from the last successful check.
- Read-only after expiry is how long search and other reads keep working, with writes refused, after your term ends. After that the search and write APIs return 403.
- Export window. After any end of license, for any reason, you can ask us within 30 days for a free export-only license valid for up to 30 days (terms §7.6).
Editions, prices and other limits are listed on the pricing page.
Running without internet access
If the server cannot reach the revocation list, it keeps full service for the offline grace period of your edition (see above), measured from the last successful check. After that it switches to read-only until a check succeeds. Expiry still applies offline. Sites with restricted outbound access can ask for an Enterprise license with a longer offline grace, up to 90 days.
When no license is needed
The local pilot on a loopback address, Docker Compose with MinIO, and test setups run without a license. A license is required when the server uses real AWS S3, or listens on a non-loopback address with a local object store.
A note on enforcement
The license check is designed for honest customers. It is not DRM, and a determined attacker with the binary could bypass it. That would breach the license terms. We chose simple, transparent enforcement, and we tell you exactly what it does, instead of shipping obfuscation.