Guide

API Reference

Public API reference for plugin licensing and developer-authenticated product credential management, with partially documented commerce and partner families clearly marked.

Start with getting started Explore API docs

POST /activateGET /validatePOST /deactivate

Product credentials
Activation request
Entitlement check
Device registration
Periodic validation
Deactivation when needed

SoundSync

Reference pages

Start with authentication and licensing for native plugin integrations.

Authentication

Product plugin credential headers and compatibility aliases.

Explore

Plugin Connection Verification

POST /api/plugin-connections/verify.

Explore

Licensing

Claim, claim-status, activate, customer-login activate, validate, and deactivate.

Explore

Product Credentials

Credential concepts and status.

Explore

Errors

Stable codes and client behavior.

Explore

SoundSync

Fully documented plugin endpoints

These endpoints include method, auth, fields, responses, side effects, retry/grace guidance through related guides.

POST /api/plugin-connections/verify

Verify product, App ID, plugin key, and plugin secret belong together before activation testing.

Auth: JSON body credential check. Headers are not used for this endpoint.
Scope: Product, app, credential, environment, and machine scoped.
Request fields: productId
appId
pluginKey
pluginSecret
pluginVersion optional
environment optional
Returns: ok/connected, productId, credentialId, pluginVersion, environment, lastSeenAt.
Side effects: Updates credential last-used state, upserts plugin connection status, and records a plugin connection event.

POST /api/license/v1/claim

Start a serial claim when customer identity or email verification is required.

Auth: Product plugin credential. Licensing endpoints require x-ss-app-id, x-ss-plugin-key, and x-ss-plugin-secret headers, or verified body/query aliases.
Scope: Product, app, credential, environment, and machine scoped.
Request fields: license_key
instance_id
email
product_id optional when not inferred
Returns: pending_email_verification with claim_id/claimId and emailSent when verification is required.
Side effects: Creates or restores a pending serial claim and can send the verification email.

GET/POST /api/license/v1/claim-status

Restore a pending serial claim and receive claim activation material after email verification.

Auth: Product plugin credential. Licensing endpoints require x-ss-app-id, x-ss-plugin-key, and x-ss-plugin-secret headers, or verified body/query aliases.
Scope: Product, app, credential, environment, and machine scoped.
Request fields: license_key
instance_id
claim_id optional
Returns: pending_email_verification or verified with claim_activation_token/claimActivationToken.
Side effects: Does not activate the machine. The client must call /activate after verified status.

POST /api/license/v1/activate

Activate the current machine after direct serial/customer proof or a verified serial claim.

Auth: Product plugin credential. Licensing endpoints require x-ss-app-id, x-ss-plugin-key, and x-ss-plugin-secret headers, or verified body/query aliases.
Scope: Product, app, credential, environment, and machine scoped.
Request fields: license_key or serial
instance_id or machine_id
claim_activation_token when using verified claim
claim_id optional
plugin_version optional
Returns: status activated, activationId, validation_token, entitlement_id, customer, max_activations, remaining, productId, grace_expires_at, offline_grace_days.
Side effects: Creates or reactivates a machine activation, ensures entitlement state, marks serial redeemed/billing eligible where applicable, records events, and issues a validation token.

POST /api/license/v1/customer-login/activate

Activate by customer account identity when the product supports account/login activation.

Auth: Product plugin credential. Licensing endpoints require x-ss-app-id, x-ss-plugin-key, and x-ss-plugin-secret headers, or verified body/query aliases.
Scope: Product, app, credential, environment, and machine scoped.
Request fields: email
password or customer_token
instance_id or machine_id
product_id/app context when required
plugin_version optional
Returns: activation result with validation token, entitlement/customer details, device limit and subscription state where applicable.
Notes: Never cache the customer password. Store only returned activation state and validation token.

POST /api/license/v1/validate

Validate cached activation state on startup or during periodic revalidation.

Auth: Product plugin credential. Licensing endpoints require x-ss-app-id, x-ss-plugin-key, and x-ss-plugin-secret headers, or verified body/query aliases.
Scope: Product, app, credential, environment, and machine scoped.
Request fields: instance_id or machine_id
validation_token/token or activationId/licenseReference/license key context
product_id optional
Returns: active/denied state, rotated validation token, last validation timestamps, offline grace fields, subscription/license state.
Side effects: Refreshes validation state and token when allowed. Explicit denials force lock and must not use offline grace.

POST /api/license/v1/deactivate

Deactivate this machine and release local access.

Auth: Product plugin credential. Licensing endpoints require x-ss-app-id, x-ss-plugin-key, and x-ss-plugin-secret headers, or verified body/query aliases.
Scope: Product, app, credential, environment, and machine scoped.
Request fields: license_key or customer/email entitlement context
instance_id or machine_id
Returns: status deactivated, code DEVICE_DEACTIVATED, remaining_activations.
Side effects: Sets deactivated_at on the activation, records an event, and should cause the client to delete local activation state.

SoundSync

Partially documented API families

These areas exist in the public API catalog but require a later endpoint-by-endpoint contract expansion before full public examples.

Family	Status	Current public guidance
Entitlements	Partial	Use only through documented licensing/customer-library flows until endpoint contracts are expanded.
Downloads	Partial	Use delivery docs and customer-library/library-token references; full endpoint schemas pending.
Customer Library	Partial	Library-token and WebView library surfaces are known but not fully rebuilt in Phase 2.
Subscriptions	Partial	Subscription states are documented for licensing denials; management APIs need separate contract work.
Storefront and Embed	Partial	Public storefront/embed docs remain route-level; not part of native plugin licensing completion.
Reseller and Partner APIs	Controlled/partial	Use approved partner docs only; plugin credentials are not partner API keys.
Webhooks	Partial	Existing webhook docs remain public but need a later webhook-specific truth pass.

API reference

Endpoint groups are organized by authentication model, product scope, request shape, response shape, errors, idempotency, and integration surface.

POST/GET

Plugin Licensing API

/docs/api/licensing

Verified plugin connection, serial claim, activation, validation, customer-login activation, and deactivation endpoints.

GET/POST

Product Credentials API

/docs/api/product-credentials

Developer-authenticated product credential creation, ensure, reveal, rotation, and revocation endpoints.

GET

Entitlements and Delivery API

/docs/api/entitlements

Customer entitlement delivery and library-token authorization.

GET/POST

Customer Library API

/docs/api/customer-library

Customer-token library listing, webview-library, claim, and expansion/review boundaries.

GET/PUT

Subscriptions API

/docs/api/subscriptions

Beta product subscription settings and subscription state behavior.

GET/POST

Storefront and Embed API

/docs/api/storefront-embed

Hosted storefront and embedded storefront bootstrap/frame-token/cart handoff.

GET/POST/PATCH/DELETE

Partner API

/docs/api/reseller-partner

Controlled partner products, orders, licenses, campaigns, and webhooks.

GET/POST/PATCH/DELETE

Webhooks API

/docs/api/webhooks

Partner webhook subscriptions, delivery events, and signatures.

GET/POST

Checkout API

/docs/api/checkout

Product checkout, quote, tax jurisdiction, and embed handoff.

GET/POST

Orders API

/docs/api/orders

Developer-visible order reporting and partner refund routes.

GET/POST/PATCH

Promotions API

/docs/api/promotions

Promo codes, scheduled deals, and promotion offers.

GET/POST

Marketplace API

/docs/api/marketplace

Public marketplace search and developer list/unlist.

GET

Analytics API

/docs/api/analytics

Developer analytics, revenue, activity, and exports.

GET/POST

Billing API

/docs/api/billing

Developer billing, statements, invoices, settlements, and payouts.

GET/POST/PATCH

Email Marketing API

/docs/api/email-marketing

Contacts, campaigns, automation, and usage.

GET/POST/PATCH/PUT

Brand, Domains, and Reviews API

/docs/api/brand-domains-reviews

Brand Manager, custom domains, DNS workflow, and review moderation.

GET/POST/PATCH/DELETE

Team Accounts API

/docs/api/team-accounts

Boundary page: developer team API is not verified.

GET/POST limited

Subscription Bundles API

/docs/api/subscription-bundles

Promotion-offer creation is verified; checkout is not.