Licensing & Entitlement

0scp is a SaaS Contract on AWS Marketplace. Marketplace owns subscription and billing; a small seller-hosted licensing service maps your subscription to a license key your in-account stack validates at runtime.

The license key

When you subscribe, Marketplace redirects you to the 0scp registration page with a one-time token. The licensing service:

Resolves the token to your CustomerIdentifier, ProductCode, and AWS account id (ResolveCustomer).
Reads your entitlement — the contract dimension, quantity, and expiration (GetEntitlements).
Mints an HMAC-signed license key and stores the record.

You can always view your current key, status, and plan in the Customer Portal (the authenticated /app portal).

Runtime validation

Your in-account stack periodically validates the key:

GET {seller}/v1/license/validate?licenseKey=...&accountId=...
→ { valid, status, dimension, quantity, expiresAt }

Results are cached, and validation fails open during a transient outage so guardrails stay enforced.

Read-only degrade

Entitlement state maps directly to platform capability:

Status	Behavior
ACTIVE	Full platform — detect, contain, budgets, autopilot.
EXPIRED	Read-only. Dashboards and reports keep working; write/enforce actions return `402 Payment Required`.
SUSPENDED	Read-only. Same as expired; typically follows an unsubscribe or billing issue.

Renewing or fixing billing in Marketplace triggers an SNS event to the licensing service, which restores ACTIVE automatically — no redeploy needed.