opschain admin licence verify
Included from Basic tier
Triggers an immediate online licence verification round (the API v2
LicenceService.TriggerVerification call): the server phones home to the
LimePoint Licence
Service for every stored document carrying enforcement: online and the
command reports each installation's status — last outcome (ok,
current after adopting a newer document, revoked, error,
no_credential), when it last verified, and the next scheduled check.
The same round otherwise runs on the server's own cadence (the
document's verify_interval, or daily, with jitter and capped backoff
on failures).
Each verification request carries the product, licence id, installation
id, product version and the server's store kind (postgres or
sqlite). Verification currency is advisory: a failed or revoked round
raises events and shows here, but entitlements never degrade while the
stored document is within its own validity. A newer document the service
returns is verified against the embedded keyring before it is adopted —
exactly as if it had been applied with opschain admin licence apply.
A server with no online-enforcement documents answers an empty round
(nothing to verify); a server without the online manager composed
answers not found. The verb authenticates as the ordinary logged-in user and
requires permission to update the /licence path plus a server target
(--server <url>, OPSCHAIN_SERVER, or the active context);
-o json|yaml prints the raw status blocks.
The installation credential
An online document verifies with a per-installation credential the
Licence Service issued when the document was minted (shown once —
to the issuer with a pushed licence, to the registering operator with a
registered Basic licence). The server reads it from two places, in
order: the environment variable OPSCHAIN_LICENCE_CREDENTIAL — a bare
token when one online document is stored, or installation_id=token
pairs separated by commas when several online documents with distinct
installation ids are stored — and, for an installation the variable does
not name, the server's secret vault at
licence/<installation_id>/credential, which is where opschain admin licence register stores the credential it receives
(LicenceService.StoreLicenceCredential). Without a value in either
place a round reports no_credential for that installation and nothing
is sent. An offline document (minted with offline enforcement, the
air-gap shape) has no service URL and no credential: it never phones home and is
not listed by this verb — revocations reach it through the release
denylist.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Round completed and reported. |
| 1 | The request failed or the verification document could not be decoded. |
| 2 | Usage error — no server target. |
Named errors
the licence lives on a server — pass --server <url> or 'opschain context use <name>'— no server target (exit 2).
Examples
opschain admin licence verify
installation inst-7f3a (licence acme-2027) via https://licensing.limepoint.com, every 24h0m0s: ok, last verified 2026-10-29T03:12:44Z, next check 2026-10-30T03:20:01Z
See also
opschain docs cli/admin-licence-show— the stored licence and its resolved status, including the same online-verification block.opschain docs cli/admin-licence-apply— apply a licence file by hand (the offline/air-gap lane).