Scroll
EvoraDocs
Get started
C++ SDK
REST API
Manage
Endpoint reference
All endpoints
GETPlan quota and current usage
GETList applicationsPOSTCreate an applicationGETGet an applicationPUTUpdate an applicationDELETEDelete an application
GETApplication statisticsGETExtended overviewGETLogin activity by dayGETUser growth over timeGETLicense status breakdownGETSession trends
GETList licensesPOSTGenerate licensesGETGet a licensePUTUpdate a licenseDELETEDelete a licensePOSTBan a licensePOSTUnban a licensePOSTReset a license HWIDPOSTFreeze a licensePOSTResume a frozen licensePOSTAdjust license expiry by a signed deltaPOSTBulk license actions
GETLook up a customer by usernameGETList customersPOSTCreate a customerGETGet a customerPUTUpdate a customerDELETEDelete a customerPOSTMint a password-reset tokenPOSTConsume a reset token and set the new passwordPOSTBan a customerPOSTUnban a customerPOSTReset a customer's HWIDGETRead a customer's two-factor stateDELETEReset a customer's two-factor authenticationPOSTReset a customer's device bindingPOSTMint a one-time SDK login token (panel SSO)POSTRedeem a license key on a customer's behalfPOSTBulk customer actions
POSTAuthenticate a customer by license keyPOSTAuthenticate a customer by username and password
GETList a customer's subscriptionsPOSTGrant a subscription directlyDELETERemove a subscriptionPOSTFreeze a subscriptionPOSTResume a frozen subscriptionPOSTExtend a subscription by days
GETList tiersPOSTCreate a tierPUTUpdate a tierDELETEDelete a tier
GETList app variablesPOSTCreate or update a variableDELETEDelete all app variablesGETGet a variablePUTUpdate a variableDELETEDelete a variableGETList every user variable in the applicationGETList one customer's variablesPOSTSet a customer variableDELETEDelete all of a customer's variablesDELETEDelete a customer variable
GETList webhooksPOSTCreate a webhookGETGet a webhookPUTUpdate a webhookDELETEDelete a webhookPOSTFire a test deliveryGETRead the event stream (catch-up)
GETList blacklist entriesPOSTAdd a blacklist entryDELETERemove a blacklist entryGETList whitelist entriesPOSTAdd a whitelist entryDELETERemove a whitelist entry
GETList live sessionsDELETEKill a sessionPOSTKill every live session
GETList logsGETLog statistics
GETList sellersPOSTCreate a sellerGETGet a sellerPUTUpdate a sellerDELETEDelete a sellerPOSTAdd seller balance
GETList clientsPOSTCreate a clientPUTUpdate a clientDELETEDelete a clientGETList a client's application accessPOSTGrant application accessDELETERevoke application access
GETList entitlementsPOSTCreate an entitlementPUTUpdate an entitlementDELETEDelete an entitlementGETList entitlements attached to a tierPOSTAttach an entitlement to a tierGETResolve a customer's entitlements
GETList geo rulesPOSTAdd a geo ruleDELETERemove a geo rulePUTEnable or disable geo restrictions
GETList active leasesDELETERevoke a leaseGETSeat usage for a customer

REST API reference

109 endpoints, generated from the OpenAPI specification so they always match what the server implements. Every one is callable from any language that can make an HTTP request — PHP, Node, Python, Go, C#, Ruby, Java.

Base URL https://api.evora.lol/api/developer-api · authenticate with Authorization: Bearer ag_sk_… · machine-readable spec at developer-api.yaml

Quota

Plan limits and current usage.

  • getPlan quota and current usage/quota

Applications

Create and configure applications.

  • getList applications/apps
  • postCreate an application/apps
  • getGet an application/apps/{appId}
  • putUpdate an application/apps/{appId}
  • deleteDelete an application/apps/{appId}

Statistics

Aggregate analytics for dashboards.

  • getApplication statistics/apps/{appId}/stats
  • getExtended overview/apps/{appId}/stats/overview
  • getLogin activity by day/apps/{appId}/stats/logins
  • getUser growth over time/apps/{appId}/stats/users
  • getLicense status breakdown/apps/{appId}/stats/licenses
  • getSession trends/apps/{appId}/stats/sessions

Licenses

Generate, manage and authenticate license keys.

  • getList licenses/apps/{appId}/licenses
  • postGenerate licenses/apps/{appId}/licenses
  • getGet a license/apps/{appId}/licenses/{licenseId}
  • putUpdate a license/apps/{appId}/licenses/{licenseId}
  • deleteDelete a license/apps/{appId}/licenses/{licenseId}
  • postBan a license/apps/{appId}/licenses/{licenseId}/ban
  • postUnban a license/apps/{appId}/licenses/{licenseId}/unban
  • postReset a license HWID/apps/{appId}/licenses/{licenseId}/reset-hwid
  • postFreeze a license/apps/{appId}/licenses/{licenseId}/pause
  • postResume a frozen license/apps/{appId}/licenses/{licenseId}/unpause
  • postAdjust license expiry by a signed delta/apps/{appId}/licenses/{licenseId}/expiry
  • postBulk license actions/apps/{appId}/licenses/bulk

Users

End-user accounts (your customers).

  • getLook up a customer by username/apps/{appId}/users/lookup
  • getList customers/users
  • postCreate a customer/users
  • getGet a customer/users/{userId}
  • putUpdate a customer/users/{userId}
  • deleteDelete a customer/users/{userId}
  • postMint a password-reset token/users/{userId}/password-reset
  • postConsume a reset token and set the new password/password-reset/fulfil
  • postBan a customer/users/{userId}/ban
  • postUnban a customer/users/{userId}/unban
  • postReset a customer's HWID/users/{userId}/reset-hwid
  • getRead a customer's two-factor state/users/{userId}/2fa
  • deleteReset a customer's two-factor authentication/users/{userId}/2fa
  • postReset a customer's device binding/users/{userId}/reset-device
  • postMint a one-time SDK login token (panel SSO)/users/{userId}/issue-session-token
  • postRedeem a license key on a customer's behalf/users/{userId}/redeem
  • postBulk customer actions/users/bulk

Authentication

Verify a customer's credentials or license key from your own panel.

  • postAuthenticate a customer by license key/apps/{appId}/licenses/authenticate
  • postAuthenticate a customer by username and password/apps/{appId}/users/authenticate

Subscriptions

A user's entitlement to an application, including freeze/resume.

  • getList a customer's subscriptions/users/{userId}/subscriptions
  • postGrant a subscription directly/users/{userId}/subscriptions
  • deleteRemove a subscription/users/{userId}/subscriptions/{appId}
  • postFreeze a subscription/users/{userId}/subscriptions/{appId}/pause
  • postResume a frozen subscription/users/{userId}/subscriptions/{appId}/unpause
  • postExtend a subscription by days/users/{userId}/subscriptions/extend

Subscription tiers

The named levels an application offers.

  • getList tiers/apps/{appId}/subscriptions
  • postCreate a tier/apps/{appId}/subscriptions
  • putUpdate a tier/apps/{appId}/subscriptions/{subscriptionId}
  • deleteDelete a tier/apps/{appId}/subscriptions/{subscriptionId}

Variables

App-wide and per-user key/value storage readable by the SDK.

  • getList app variables/apps/{appId}/variables
  • postCreate or update a variable/apps/{appId}/variables
  • deleteDelete all app variables/apps/{appId}/variables
  • getGet a variable/apps/{appId}/variables/{key}
  • putUpdate a variable/apps/{appId}/variables/{key}
  • deleteDelete a variable/apps/{appId}/variables/{key}
  • getList every user variable in the application/apps/{appId}/user-variables
  • getList one customer's variables/apps/{appId}/users/{userId}/variables
  • postSet a customer variable/apps/{appId}/users/{userId}/variables
  • deleteDelete all of a customer's variables/apps/{appId}/users/{userId}/variables
  • deleteDelete a customer variable/apps/{appId}/users/{userId}/variables/{varKey}

Webhooks

Outbound event delivery, plus the event stream that backs it. **Verify every payload.** If the webhook has a secret, each request carries `X-Evora-Timestamp` and `X-Evora-Signature`, where the signature is `HMAC_SHA256(secret, timestamp + "." + rawBody)` as lowercase hex. Compute it over the RAW body before JSON parsing, compare with a constant-time function, and reject anything whose timestamp is far from now. An endpoint that skips this can be driven by anyone who learns its URL. **Deduplicate on `X-Evora-Event-Id`.** Retries reuse the same id, so recording processed ids is what keeps a redelivery from granting twice. `X-Evora-Delivery-Attempt` tells you which try you are receiving. **Delivery is at-least-once, not guaranteed.** A non-2xx response is retried with exponential backoff — 6 attempts across roughly two hours — after which the event is left in the stream and not retried again. An endpoint that keeps failing is auto-disabled and the developer notified. The retry window is deliberately short: enforcement is pull-based, so a missed webhook can never grant or extend access. For anything longer than a brief outage, read `GET /apps/{appId}/events?since=` — that is the durable path, and it works even with no webhook configured.

  • getList webhooks/apps/{appId}/webhooks
  • postCreate a webhook/apps/{appId}/webhooks
  • getGet a webhook/apps/{appId}/webhooks/{webhookId}
  • putUpdate a webhook/apps/{appId}/webhooks/{webhookId}
  • deleteDelete a webhook/apps/{appId}/webhooks/{webhookId}
  • postFire a test delivery/apps/{appId}/webhooks/{webhookId}/test
  • getRead the event stream (catch-up)/apps/{appId}/events

Access control

Blacklist and whitelist entries.

  • getList blacklist entries/apps/{appId}/blacklist
  • postAdd a blacklist entry/apps/{appId}/blacklist
  • deleteRemove a blacklist entry/apps/{appId}/blacklist/{entryId}
  • getList whitelist entries/apps/{appId}/whitelist
  • postAdd a whitelist entry/apps/{appId}/whitelist
  • deleteRemove a whitelist entry/apps/{appId}/whitelist/{entryId}

Sessions

Live SDK sessions.

  • getList live sessions/apps/{appId}/sessions
  • deleteKill a session/apps/{appId}/sessions/{sessionId}
  • postKill every live session/apps/{appId}/sessions/kill-all

Logs

Authentication and event history.

  • getList logs/apps/{appId}/logs
  • getLog statistics/apps/{appId}/logs/stats

Sellers

Reseller accounts.

  • getList sellers/apps/{appId}/sellers
  • postCreate a seller/apps/{appId}/sellers
  • getGet a seller/apps/{appId}/sellers/{sellerId}
  • putUpdate a seller/apps/{appId}/sellers/{sellerId}
  • deleteDelete a seller/apps/{appId}/sellers/{sellerId}
  • postAdd seller balance/apps/{appId}/sellers/{sellerId}/balance

Clients

Sub-accounts you grant per-application management access.

  • getList clients/clients
  • postCreate a client/clients
  • putUpdate a client/clients/{clientId}
  • deleteDelete a client/clients/{clientId}
  • getList a client's application access/clients/{clientId}/apps
  • postGrant application access/clients/{clientId}/apps
  • deleteRevoke application access/clients/{clientId}/apps/{appId}

Entitlements

Fine-grained feature flags attached to tiers or users.

  • getList entitlements/apps/{appId}/entitlements
  • postCreate an entitlement/apps/{appId}/entitlements
  • putUpdate an entitlement/apps/{appId}/entitlements/{entitlementId}
  • deleteDelete an entitlement/apps/{appId}/entitlements/{entitlementId}
  • getList entitlements attached to a tier/apps/{appId}/subscriptions/{subscriptionId}/entitlements
  • postAttach an entitlement to a tier/apps/{appId}/subscriptions/{subscriptionId}/entitlements
  • getResolve a customer's entitlements/apps/{appId}/users/{userId}/entitlements

Geo

Country-level access rules.

  • getList geo rules/apps/{appId}/geo-rules
  • postAdd a geo rule/apps/{appId}/geo-rules
  • deleteRemove a geo rule/apps/{appId}/geo-rules/{ruleId}
  • putEnable or disable geo restrictions/apps/{appId}/geo-enabled

Floating licenses

Concurrent-seat leases.

  • getList active leases/apps/{appId}/floating/leases
  • deleteRevoke a lease/apps/{appId}/floating/leases/{leaseId}
  • getSeat usage for a customer/apps/{appId}/users/{userId}/floating/seats