Build against the CodeOn API

The plugin-facing endpoints. All responses are JSON; license-related responses carry a signature so the plugin can verify payloads end-to-end.

• POST /api/v1/validate-license

  The heartbeat WordPress plugins call once per day. Request shape, signed response, status enum (active / grace / expired / suspended), grace-period contract.
  Open
• GET /api/v1/updates/<plugin>

  Update manifest the WP UpdateChecker reads. Per-plugin tag resolution, version compare rules, force-refresh hints.
  Open
• POST /api/v1/tamper-report

  Daily silent heartbeat from a watermarked plugin when its build-stamp fails to verify. Best-effort, fire-and-forget.
  Open

Inbound callbacks CodeOn receives from upstream gateways and turns into local order state.

• Bank of Georgia callbacks

  Signed callbacks BoG sends for created → processing → completed (and refund / rejected). Signature verification, event ordering, replay protection.
  Open

The contracts a CodeOn plugin honours so license validation, updates, and tamper detection work end-to-end.

• License key format

  32-char checksummed string, prefix conventions, slug derivation for URLs.
  Open
• Build-id telemetry

  How CODEON_BUILD_ID is seeded into a watermarked ZIP and cross-checked on validate-license.
  Open
• Watermark contract

  Per-customer scatter files, fail-hard streamer rules, recovery-mode behaviour on tamper.
  Open