Licensing

API Security Local Edition uses subscription-based licensing aligned with analyzed API traffic. The product supports three license workflows: activation, telemetry reporting, and revocation. All three are performed through the System > License page of the user interface and require Admin privileges.

License states

Status	Description
Inactive	The device is not registered, or activation has not been completed.
Active	The license is active, and all product features are operational.
Expired	The subscription has expired; grace and enforcement periods may apply.
Terminated	The license has been revoked through the termination workflow.
Evaluation Active	The product is running in Evaluation Mode. The 14-day evaluation period has not expired.
Evaluation Expired	The 14-day evaluation period has expired. Activate the product with a valid purchased license to continue using API Security Local Edition.

Connectivity model for license operations

API Security Local Edition is typically installed on a host with no outbound internet connectivity. License operations, however, require an exchange of reports with the F5 entitlements service over the internet. The product supports this through a decoupled model.

A typical setup uses an operator workstation with connectivity to two networks:

• Access to the API Security user interface on the isolated network (TCP 8000)

• Access to the internet, to reach the F5 entitlements service

This allows license operations to be performed without granting the product host internet access. Two methods are available for each workflow:

• Automated method (recommended). The operator downloads a helper script from the user interface and runs it on the operator workstation. The script contacts the product, generates the required report, submits it to F5, and uploads the Signed ACK back into the product in a single run.

• Manual method. The operator performs each step individually through the user interface. The report file can also be downloaded from the product, transferred to any machine with internet access, submitted from there, and the resulting Signed ACK brought back to the product. This is useful when no single workstation has access to both networks.

All three workflows follow the same pattern: the product generates a report, the report is submitted to the F5 entitlements service, and the Signed ACK returned by F5 is uploaded back into the product.

About subscription licenses

When you purchase a subscription to API Security Local Edition, F5 issues a JSON Web Token (JWT) that identifies your license and entitlement. To obtain the JWT:

1. Log in to MyF5 (https://my.f5.com).

2. Go to My Products & Plans > Subscriptions.

3. Locate your API Security Local Edition subscription and select the Subscription ID.

4. Download the JWT file.

Activate a license

You can activate a purchased license at any time during or after the evaluation period. After successful activation, the product exits Evaluation Mode and uses the activated subscription license.

After Evaluation Mode expires, product functionality is restricted until a valid purchased license is activated.

Automated activation (recommended)

1. In the user interface, go to System > License.

2. Download the helper script.

3. On the operator workstation, make the script executable and run it in activation mode:

   chmod +x ./license_usage_offline.sh
   ./license_usage_offline.sh \
     -j jwt.txt \
     -b https://<host-ip>:8000 \
     -u <username> \
     -p '<password>' \
     -s initial \
     -k
   

The script registers the device, generates the activation request, submits it to F5, and uploads the Signed ACK back into the product. On success, the license status changes to Active.

Manual activation

1. In the user interface, go to System > License.

2. Upload the JWT file or paste its content, then select Register Device.

3. After the device is registered, download the license activation request file (report.json).

4. From a machine with internet access, submit the request to the F5 entitlements service to receive a Signed ACK:

   curl --location 'https://product.apis.f5.com/ee/v1/entitlements/telemetry' \
     --header "Authorization: Bearer $(cat jwt.txt)" \
     --header "Content-Type: application/json" \
     --data @"report.json" \
     --output signed_ack.json
   

5. Upload signed_ack.json or paste its content, then select Activate Your License.

On success, the license status changes to Active. The License Information panel then displays the license status, type, licensed request quota, subscription expiration date, and the date of the last telemetry report.

Submit a telemetry report

Telemetry reports are submitted periodically to F5 to report product usage — the number of analyzed API requests, in millions, for the observation period. Telemetry reporting is required to keep the license in good standing. The user interface displays the telemetry section when a report is required.

Automated telemetry reporting (recommended)

1. In the user interface, go to System > License.

2. Download the helper script.

3. On the operator workstation, run the script in telemetry mode:

   chmod +x ./license_usage_offline.sh
   ./license_usage_offline.sh \
     -j jwt.txt \
     -b https://<host-ip>:8000 \
     -u <username> \
     -p '<password>' \
     -s telemetry \
     -k
   

The script generates the telemetry report, submits it to F5, and uploads the Signed ACK back into the product.

Manual telemetry reporting

1. In the user interface, select Create Telemetry Report and wait for the product to prepare the report.

   Note

   If no fully completed calendar months of usage data are available, a confirmation dialog appears. Choose to create the report anyway if you need to proceed.

2. When the report is ready, the user interface displays a summary card with the total analyzed API requests and the reporting period. Select Download Telemetry Report to save report.json.

3. From a machine with internet access, submit the report to the F5 entitlements service:

   curl --location 'https://product.apis.f5.com/ee/v1/entitlements/telemetry' \
     --header "Authorization: Bearer $(cat jwt.txt)" \
     --header "Content-Type: application/json" \
     --data @"report.json" \
     --output signed_ack.json
   

4. Upload signed_ack.json or paste its content, then select Submit Signed ACK.

On success, the telemetry status updates and the Last Telemetry Report date in the License Information panel is refreshed.

Revoke a license

Revoking a license permanently deactivates it on the current device. Use this workflow when replacing a license or migrating the product to a different host.

Warning

Revocation cannot be undone. After revocation completes, the license status changes to Terminated and the entitlement is released back to F5. Complete all steps to properly release the entitlement.

To revoke a license:

1. In the user interface, go to System > License.

2. On the License Information panel, select Revoke License and confirm when prompted.

3. Download the termination report (report.json).

4. From a machine with internet access, submit the termination report to the F5 entitlements service:

   curl --location 'https://product.apis.f5.com/ee/v1/entitlements/telemetry' \
     --header "Authorization: Bearer $(cat jwt.txt)" \
     --header "Content-Type: application/json" \
     --data @"report.json" \
     --output signed_ack.json
   

5. Upload signed_ack.json or paste its content, then select Send Termination Signed ACK.

On success, the license status changes to Terminated.

License enforcement lifecycle

When a license expires, the product progresses through enforcement phases automatically. Renew the license promptly to avoid service disruption.

Phase	Indicator	Effect
Extended Warning	Yellow banner	The license has expired and enforcement is approaching. Renew immediately.
Enforcement (Soft)	Red banner	The Manage tab is unavailable until the license is renewed.
Enforcement (Hard)	Red banner	The Manage tab is unavailable and traffic processing has stopped.
Decommissioned	Red banner	All features are permanently disabled. A new license must be provisioned.

License operation notes

• All license operations require Admin privileges.

• Upload fields in the user interface accept .jwt, .json, and .txt files.

• If a billing verification failure is detected, the License page is replaced with an error screen and license operations cannot be performed. To resolve a billing issue, contact F5 Support.

• For assistance with any license operation, contact your F5 representative or open a support case through F5 Support.

Evaluation Mode

API Security Local Edition supports Evaluation Mode for time-limited trials and proof-of-concept deployments.

Evaluation Mode allows you to use API Security Local Edition for 14 days without activating a license. This mode is intended for evaluation purposes only and does not replace the standard subscription-based licensing model.

During the evaluation period, the product can be deployed and used without uploading a license JWT or completing the license activation workflow.

When the 14-day evaluation period expires, continued use of the product requires activation with a valid purchased API Security Local Edition license.

To activate the product after the evaluation period expires, go to System > License and complete the standard license activation workflow using the JWT file associated with your purchased subscription.