List the public plan catalog (free, pro, business, enterprise, …)

Fetch a single plan (meters, caps, feature flags)

Certificate revocation list. Public, unauthenticated — self-host installs poll this on a 15-minute cadence so revoked node licenses stop validating without operator intervention.

Phone-home from on-prem installs. The license_id in the body authenticates the request; the signed license JWT must additionally validate against the Ed25519 public key the install was provisioned with.