Admin API: license, backups and updates

This group has nine methods: license, backups, updates and the IP2Proxy database. Only one is available with an API token — reading the license state. The other eight work only in the panel, signed in as the installation owner. Authorization is described on the Admin API: overview and authorization page, and the response and error format on the Request, response and error format page.

Methods

Get the license state

GET /api/v1/license

Returns the installation's license state: whether it is active, its kind, its term and the time of the last check. The panel shows the same data on the Settings → License («Настройки → Лицензия») tab.

Token scope: full. No path, query or body parameters.

The method responds even with an inactive license, when the other methods return 402. This lets an integration tell closed access from a failure — see Expired license.

Response — code 200 and an object:

Fields of the license object:

Optional fields are absent from the response while they have no value: kind, expires_at and lease_until — until the license is activated, and also in the unmanaged, unconfigured, clock_error and invalid_certificate states; last_checked — until the tracker has contacted the license service; last_error — while checks pass without errors.

The installation ID and the license key expiration are not returned to a token.

Errors: the method has no codes of its own. A token with Summary reports («Сводные отчёты») or Extension spend («Расходы расширения») access gets 403 with the token_scope code.

Example request:

curl https://panel.example.com/api/v1/license \
  -H "Api-Key: <token>"

Example response with an active paid license:

{
  "license": {
    "required": true,
    "configured": true,
    "active": true,
    "state": "active",
    "kind": "paid",
    "expires_at": 1793664000,
    "lease_until": 1791113400,
    "last_checked": "2026-10-04T11:20:14.512334Z"
  },
  "held_deliveries": 0,
  "operator": false,
  "spend_allowed": true,
  "server_time": 1791112814
}

Example response after the term has ended:

{
  "license": {
    "required": true,
    "configured": true,
    "active": false,
    "state": "expired",
    "kind": "paid",
    "expires_at": 1791072000,
    "lease_until": 1791072000,
    "last_checked": "2026-10-04T11:20:14.512334Z"
  },
  "held_deliveries": 0,
  "operator": false,
  "spend_allowed": false,
  "server_time": 1791112814
}

State values

What to do in each state is described on the License verification and connection to the service and License expiry pages. Traffic and conversion intake continue with any state value.

Installation owner methods

These eight methods do not work with an API token of any access type. To a Full access («Полный доступ») token they respond with 403 and the forbidden code:

Example response:

curl -i https://panel.example.com/api/v1/backups \
  -H "Api-Key: <token>"

{"code": "forbidden", "message": "Резервные копии доступны только владельцу установки"}

Tokens with Summary reports and Extension spend access get 403 with the token_scope code on these methods. With an inactive license, the backup, update and IP2Proxy methods respond with 402 and the license_required code.

POST /api/v1/license/activate, PUT /api/v1/ip2proxy and POST /api/v1/ip2proxy/update share a common limit: 10 requests per minute from one IP. Beyond it, the response is 429 with the rate_limited code.

Why these methods are closed to tokens

The license, backups, updates and the IP2Proxy database concern the whole installation on the server, not the data of one team. So the tracker accepts such requests only when three conditions hold at the same time:

• the request comes from the panel after logging in with a login and password, not with the Api-Key header;
• the installation owner is logged in — the owner account created in the first-run wizard;
• it is the owner's own session, not one opened with Log in as a user.

A token acts on behalf of its creator but does not get the creator's installation rights — even if the installation owner created the token. Other owners and admins of the team also get the same 403 response to these methods in the panel.

Of the methods in this group, only monitoring can be automated: request GET /api/v1/license and watch active, state and expires_at. Do renewals, backups and updates in the panel.