Licensing

An Athena server is licensed with a single license certificate — a .lic.cer file issued for your organisation. The server checks it locally against the licensing authority built into Athena: there is no license server, no activation call and no periodic check-in, so licensing works the same on a fully air-gapped network as anywhere else. This page explains the license states, what a lapsed license does and does not stop, the limits and features a license grants, the expiry warnings, and how to install or renew a license from the console, the REST API or PowerShell.

Viewing the license#

Open Settings → License. The tab shows:

• State — one of the four states below. When the license is not in force, a line underneath spells out what is blocked and what keeps working.
• License type, Licensed to, License ID, Expires (in the server's local time) and Days remaining. A license with no expiry date shows No expiry. During the grace period a Grace period row shows how many days of grace remain.
• Limits — Agents and User accounts, each shown as in use / licensed (for example 42 / 100), or Unlimited when the license sets no cap. A limit that is already exceeded is flagged Over limit.
• Features — each licensable feature marked Included or Not included, followed by each separately licensed module installed on the server, listed by name (for example BitLocker and Sysmon). Features and modules that are not included are still listed (see Licensed features and Separately licensed modules).
• Install a license — the upload control, shown to users who can manage settings.

Viewing the tab requires the settings.view permission; installing a license requires settings.manage. In the shipped role bundles both belong to Admin. Neither permission is ever restricted by the license itself. The tab re-reads the license periodically, so a page left open reflects an expiry that happens while you are looking at it.

License states#

Athena works out the state from the expiry date every time it is asked — not from a value captured when the server started — so a license that expires while the server is running is treated as expired straight away, with no restart.

The length of the grace period is set in the license certificate itself.

What is blocked when the license is not in force#

In the License expired and Not licensed states, Athena refuses to start new work:

• enrolling new agents;
• creating new console user accounts, including accounts created automatically for directory or single sign-on users at first login;
• running commands and deployments;
• running scheduled jobs — except the server's own housekeeping jobs (database backup, log cleanup, agents cleanup, commands cleanup and collection refresh), which keep running;
• dispatching monitor sweeps and compliance evaluations to agents;
• migrating agents to another server;
• starting remote-control sessions.

These keep working: agent check-in, inventory collection, signing in, and all read access — every page, report and record you already have stays visible. Nothing is deleted.

A refused action returns a message that says why and how to fix it, for example:

Command execution is blocked: this server's license expired on 2026/09/30 00:00:00 and its
grace period has ended. Upload a current license file under Settings to restore it.
Agent check-in, inventory collection and all read access are unaffected.

Each refusal is also written to the audit log as a LicenseBlocked event (see Audit trail).

Agent and user limits#

A license can cap two counts:

When a limit is used up, the new agent or account is refused with a message naming the licensed maximum and how many already exist. Existing agents and accounts are untouched and remain fully usable — a limit only stops new ones. The very first administrator account of a fresh install is always created, so a new server can be signed in to and licensed.

Licensed features#

Some capabilities are switched on per license. The Features list on the License tab shows which ones yours includes. They include:

On a valid license, a feature marked Not included is unavailable to every user, whatever their role: its pages and settings tabs are hidden, its API calls return 403 Forbidden, and a scheduled job that depends on it (for example a Windows Update scan) records the refusal as its result. If you open such a page directly, Athena explains that your role or this server's license does not include it.

When the license lapses, Athena does not remove read access to these features — you can still open existing reports, for example. The new-work blocks above apply instead, and changes that depend on a licensed feature (such as a settings-sync push or a remote registry edit) are refused. Separately licensed modules are the exception: see below.

Separately licensed modules

These modules are licensed on their own, apart from the features above:

Modules follow stricter rules than the other features:

• Off unless the license says on. A module is available only when your license certificate lists its feature. A license issued before the module was sold separately does not list it, so the module stays off until you install a re-issued license that includes it.
• No read access without a license in force. Other features keep read-only access when the license lapses. A module does not: with no license, or with a license expired past its grace period, the module is switched off completely, including its pages. During the grace period modules keep working, like everything else.
• Switched off means inert. When a module is not included, every permission it uses (for example bitlocker.view or sysmon.manage) is refused for every user, whatever their role. Its tabs, pages and widgets are hidden, and its REST endpoints return 403 Forbidden. The server also stops talking to agents about that module: it sends no status requests or policy pushes and ignores what agents report for it. Compliance baselines the module created are withdrawn from agents, and its filter fields disappear from collections and reports and match nothing.
• Takes effect immediately. The check runs every time, so installing a license that adds or removes a module applies at once, with no restart. Connected agents get their compliance assignments again right away, so the baselines of a module the new license drops are withdrawn without waiting for the agents to reconnect.

Expiry warnings#

A banner appears at the top of every console page as the expiry date approaches:

Users who can view settings also get a View license link that opens Settings → License. A license with no expiry date never shows a banner. If you hide the banner and it moves to a more serious stage, it reappears.

Installing or renewing a license#

1. Copy the .lic.cer file you received to a machine that can reach the Athena console. On an air-gapped network, bring it in on approved media as you would any other file.
2. Open Settings → License and, under Install a license, click Choose license file.
3. Select the file. Athena shows Verifying and installing… and then either License installed. or the reason it was refused.

What happens when you upload:

• It is checked first. The file is verified — issued by the trusted licensing authority, issued for Athena, not past its grace period — before anything is replaced. A refused file never touches the license in force.
• The previous license is backed up. The file being replaced is copied next to the license file with a timestamp, named like license.lic.cer.2026-09-24_143005.bak.
• It takes effect immediately. No restart is needed; blocked actions work again straight away, and banners and License tabs already open in other browsers update on their own.

There is no “remove license” action: you replace a license by installing its successor. The upload accepts files up to 64 KB — a license certificate is only a few kilobytes.

If the upload is refused

Every refusal leaves the current license in force and tells you what was wrong:

Where the license file lives#

Uploading through the console or API writes the certificate to the server's license path, which is also where the server looks for it at startup:

To use a different location, set Licensing:FilePath in appsettings.json, or the environment variable Licensing__FilePath. The directory is created on first install if it does not exist, and must be writable by the account the server runs as. You can also place the certificate at this path before the server starts; it is loaded at startup. Include this file (and its .bak copies, if you want them) in your data backups.

REST API#

curl -k -H "Authorization: Bearer $TOKEN" https://athena.example.local:8443/api/license

curl -k -H "Authorization: Bearer $TOKEN" \
     -F "file=@renewal.lic.cer" \
     https://athena.example.local:8443/api/license/upload

The data object returned by both calls includes:

A successful upload returns 200 with the new state, so you do not need a second call to confirm it. A refused file returns 400 with the reason in message; a file larger than 64 KB is rejected with 413; and 500 means the file was written but not put into force (restart the server, as described above).

PowerShell#

The Athena PowerShell module has two license cmdlets:

• Get-AthenaLicense — returns the same fields as GET /api/license, except the modules list. To check a module's license, use the License tab or the REST API.
• Install-AthenaLicense -Path <file> — uploads a certificate and returns the state it produced. Supports -WhatIf and -Confirm. A refusal is reported with the server's reason, not just a status code.

# Show everything, including limits and feature flags
Get-AthenaLicense | Format-List

# Warn when the license has lapsed or has less than 30 days left
$license = Get-AthenaLicense
if (-not $license.IsLicensed -or $license.DaysUntilExpiry -lt 30) {
    Write-Warning "Athena license: $($license.State), $($license.DaysUntilExpiry) day(s) left"
}

# Install a renewal and report what it grants
$new = Install-AthenaLicense -Path "D:\renewal.lic.cer"
"Now $($new.State), expires $($new.ExpiresAt), $($new.AgentLimit) agents"

Audit trail#

Licensing activity is recorded in the audit log, so it can be filtered and forwarded to your SIEM:

Related#

• Air-Gapped Operation — running Athena with no outbound connectivity.
• Data Directories & Backup — what to back up, including the license file.
• Configuration — setting Licensing:FilePath through appsettings.json or environment variables.
• Permission Model & Role Bundles — settings.view and settings.manage.
• Audit Event Types Reference — the full list of audit events.