ACP Engine Licensing

ACP Engine requires a valid product license before Manager, Engine, MCP, or protected domain APIs can be used. During a new installation, create the first administrator and then complete the license screen. Manager redirects to that screen until activation succeeds.

ACP Engine obtains and renews its signed licensing state through Thyris CLS (Centralized License Service). Runtime requests use the product-local licensing component and do not contact Thyris CLS individually.

Only the minimum setup, license enrollment, and health surfaces are available before activation. Normal user authentication or administrator roles do not bypass the product license.

Recommended setup

Use online mode unless the deployment has an approved offline requirement. Configure these Helm values in a customer-specific deployment layer:

config:
  licenseMode: online
  licenseServerUrl: https://license.thyris.cloud
  licenseInstallationId: <stable-installation-uuid>
  licenseProductKey: acp-engine

Provide the local state-encryption key and separate local reader, administrator, and usage credentials through an existing Kubernetes Secret or approved external secret manager. Do not commit secret values or pass them on the Helm command line.

ACP images include the approved public verification ring. Public verification keys are not secret credentials, but their integrity is protected by pinning them to the released image. Deployment configuration may repeat the pinned values for consistency checks; it cannot introduce or replace a trust root.

The installation ID must be unique and stable. Generate it once for the deployment and retain it across normal upgrades. Do not reuse it for a second cluster.

Interactive activation

1. Deploy ACP Engine with the licensing configuration and protected Secrets.
2. Open Manager and create the first platform administrator.
3. On the license screen, copy the displayed non-secret installation identity information and provide it through the approved Thyris provisioning process.
4. Enter the one-time activation key supplied for that installation.
5. Confirm that Manager shows the expected customer, product, plan, validity, and enabled capability status before continuing configuration.

Treat the activation key as a password. It is intended for one installation and one successful activation.

Kubernetes Secret bootstrap

For automated connected deployments, set config.licenseMode to secret-bootstrap and mount a pre-created Secret:

config:
  licenseMode: secret-bootstrap

licenseProvisioning:
  existingSecret: acp-license-bootstrap
  activationKeyKey: activation-key

The Secret should contain only the supplied one-time activation value under the selected key. Delete the bootstrap Secret after ACP reports a valid license. ACP then continues as a connected installation.

Approved offline installation

For a pre-approved disconnected deployment, set config.licenseMode to offline-secret and mount the signed bundle from an existing Secret:

config:
  licenseMode: offline-secret

licenseProvisioning:
  existingSecret: acp-license-offline
  bundleKey: offline-bundle.json

Do not edit or copy the bundle. It is issued for a specific installation, product, and validity window. Arrange replacement before the displayed offline deadline.

Operational checks

After installation and every upgrade, verify:

• Manager displays the expected licensed customer and plan;
• the selected mode and installation ID are unchanged;
• the running image is a supported release containing the required public verification ring;
• expected features are available and unlicensed features remain unavailable;
• licensing status is healthy and no renewal/expiry warning is active;
• bootstrap material has been removed after connected activation;
• the licensing Secret is restricted by RBAC and encrypted at rest.

The Manager footer reads the local License Service automatically and shows the current customer, plan, enforcement status, and license expiry. It refreshes periodically and whenever the browser window becomes active. Platform administrators can open the full License page from the footer. Treat a red Blocked status as an enforcement result, not as a cached database label.

See Thyris CLS Product Licensing for the lifecycle and Thyris CLS License Modes for mode selection. ACP image maintenance follows the annual Thyris CLS Version Support and Key Rotation schedule; supported older ACP lines may receive security-only maintenance images without a feature upgrade.

For the 2027 cycle, use an ACP maintenance image published on or after 14 October 2026 and follow the downloadable customer calendar on the version support page. Confirm the selected image remains in the published support matrix before deployment.

Troubleshooting

Status	Operator action
License required	Complete enrollment with the activation key issued for this installation
License expired	Confirm the contract/bundle validity and contact Thyris
Refresh required	Check time, DNS, TLS, and outbound access to the approved licensing hostname
Feature not licensed	Confirm the purchased plan and requested ACP capability
Installation mismatch	Do not copy state; contact Thyris before migration or recovery

When opening a support request, include the ACP version, installation ID, mode, timestamp, visible status code, and correlation ID. Do not attach Secrets, activation keys, or complete bundle contents.