> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise license management

> Understand runtime license states, entitlements, and immutable signed license activation.

This page covers the signed license used by self-hosted Enterprise deployments. Start with
[Editions and deployment models](/en-US/editions) when comparing OpenSource Edition, Enterprise
Edition, and MoleSignal Cloud.

The self-hosted runtime exposes two license states:

| Runtime state          | Meaning                                                                      |
| ---------------------- | ---------------------------------------------------------------------------- |
| **OpenSource Edition** | Runs without a verified signed enterprise license.                           |
| **Enterprise Edition** | Runs with a verified, active signed license and the associated entitlements. |

Internal API values can use compatibility identifiers such as `community`, `oss`, or `pro`. The UI
maps verified capabilities to the edition names above. MoleSignal Cloud is a deployment and account
model, not a third self-hosted license file format; Cloud plan entitlements will be service-managed.

## Entitlements

A signed license can include feature names and limits. Current gated capabilities include features
such as:

* `agent`;
* `sso`;
* `federated_search`;
* `domain_management`;
* report-rendering or deployment-specific commercial capabilities.

Permissions and license features are independent. Enabling a feature does not grant a user the
permission to configure or use the feature.

## View the active license

Only a system-scoped principal with `sys.licenses.read` can open **Settings → License** or call:

```text theme={null}
GET /api/v1/system/license
GET /api/v1/system/license/versions
```

The snapshot includes verification, expiration, issued-to identity, feature names, intake limit,
and active version id.

## Upload and activate

License packages contain a base64 payload and detached Ed25519 signature. The server rejects an
invalid or expired package before activation.

Uploaded versions are immutable. Activation updates one active pointer and replaces the in-process
license holder without editing historical packages.

```text theme={null}
POST /api/v1/system/license/versions
POST /api/v1/system/license/versions/{id}/activate
```

These operations require `sys.licenses.manage` and produce audit events. Signed package and
signature contents are excluded from logs, traces, and audit payloads.

## Startup and fallback

The active database version is reverified at startup. Environment import from `MS_LICENSE_FILE` is
used only when explicitly enabled for initial bootstrap or disaster fallback.

If the active version cannot be verified, MoleSignal degrades to OpenSource behavior and exposes
the load problem in system health.

Continue with [Editions and deployment models](/en-US/editions) or the
[Administration overview](/en-US/administration).