[{"data":1,"prerenderedAt":784},["ShallowReactive",2],{"navigation_docs":3,"-licensing-what-phones-home":136,"-licensing-what-phones-home-surround":779},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":82,"body":138,"description":772,"extension":773,"links":774,"meta":775,"navigation":776,"path":83,"seo":777,"stem":84,"__hash__":778},"docs\u002F4.licensing\u002F3.what-phones-home.md",{"type":139,"value":140,"toc":763},"minimark",[141,145,149,154,220,227,231,238,435,446,544,547,550,556,570,574,577,580,590,593,597,600,620,623,630,634,705,720,727,731,736,745,749,759],[142,143,82],"h1",{"id":144},"what-phones-home",[146,147,148],"p",{},"Your deployment makes three kinds of call to the Hub and no others. This page lists what is in each one, field by field. If you are reviewing this before a purchase, this is the page to read, and everything on it can be confirmed by capturing your own egress.",[150,151,153],"h2",{"id":152},"the-three-calls","The three calls",[155,156,157,173],"table",{},[158,159,160],"thead",{},[161,162,163,167,170],"tr",{},[164,165,166],"th",{},"Call",[164,168,169],{},"When",[164,171,172],{},"Endpoint",[174,175,176,190,203],"tbody",{},[161,177,178,181,184],{},[179,180,36],"td",{},[179,182,183],{},"Once, at enrollment",[179,185,186],{},[187,188,189],"code",{},"POST \u002Fv1\u002Fdeployments\u002Factivate",[161,191,192,195,198],{},[179,193,194],{},"Renewal",[179,196,197],{},"On a schedule, well before the license expires",[179,199,200],{},[187,201,202],{},"POST \u002Fv1\u002Flicenses\u002F{jti}\u002Frenew",[161,204,205,208,215],{},[179,206,207],{},"Heartbeat",[179,209,210,211,214],{},"Every ",[187,212,213],{},"PHONEHOME_INTERVAL"," (default 15 minutes, floor 60 seconds)",[179,216,217],{},[187,218,219],{},"POST \u002Fv1\u002Fdeployments\u002Fphone-home",[146,221,222,223,226],{},"All three go to ",[187,224,225],{},"activation.parentUrl",", over HTTPS, outbound from your namespace.",[150,228,230],{"id":229},"the-heartbeat","The heartbeat",[146,232,233,234,237],{},"The body is a single ",[187,235,236],{},"usage"," object. These are all of the fields:",[239,240,245],"pre",{"className":241,"code":242,"language":243,"meta":244,"style":244},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"usage\": {\n    \"collected_at\": \"2026-07-12T09:15:00Z\",\n    \"sims_active\": 1284,\n    \"sims_total\": 1509,\n    \"subscriptions_active\": 977,\n    \"users_total\": 43,\n    \"orders_30d\": 612,\n    \"data_bytes_30d\": 4180331495424,\n    \"version\": \"1.42.0\"\n  }\n}\n","json","",[187,246,247,256,274,300,318,335,352,369,386,403,423,429],{"__ignoreMap":244},[248,249,252],"span",{"class":250,"line":251},"line",1,[248,253,255],{"class":254},"sMK4o","{\n",[248,257,259,262,265,268,271],{"class":250,"line":258},2,[248,260,261],{"class":254},"  \"",[248,263,236],{"class":264},"spNyl",[248,266,267],{"class":254},"\"",[248,269,270],{"class":254},":",[248,272,273],{"class":254}," {\n",[248,275,277,280,284,286,288,291,295,297],{"class":250,"line":276},3,[248,278,279],{"class":254},"    \"",[248,281,283],{"class":282},"sBMFI","collected_at",[248,285,267],{"class":254},[248,287,270],{"class":254},[248,289,290],{"class":254}," \"",[248,292,294],{"class":293},"sfazB","2026-07-12T09:15:00Z",[248,296,267],{"class":254},[248,298,299],{"class":254},",\n",[248,301,303,305,308,310,312,316],{"class":250,"line":302},4,[248,304,279],{"class":254},[248,306,307],{"class":282},"sims_active",[248,309,267],{"class":254},[248,311,270],{"class":254},[248,313,315],{"class":314},"sbssI"," 1284",[248,317,299],{"class":254},[248,319,321,323,326,328,330,333],{"class":250,"line":320},5,[248,322,279],{"class":254},[248,324,325],{"class":282},"sims_total",[248,327,267],{"class":254},[248,329,270],{"class":254},[248,331,332],{"class":314}," 1509",[248,334,299],{"class":254},[248,336,338,340,343,345,347,350],{"class":250,"line":337},6,[248,339,279],{"class":254},[248,341,342],{"class":282},"subscriptions_active",[248,344,267],{"class":254},[248,346,270],{"class":254},[248,348,349],{"class":314}," 977",[248,351,299],{"class":254},[248,353,355,357,360,362,364,367],{"class":250,"line":354},7,[248,356,279],{"class":254},[248,358,359],{"class":282},"users_total",[248,361,267],{"class":254},[248,363,270],{"class":254},[248,365,366],{"class":314}," 43",[248,368,299],{"class":254},[248,370,372,374,377,379,381,384],{"class":250,"line":371},8,[248,373,279],{"class":254},[248,375,376],{"class":282},"orders_30d",[248,378,267],{"class":254},[248,380,270],{"class":254},[248,382,383],{"class":314}," 612",[248,385,299],{"class":254},[248,387,389,391,394,396,398,401],{"class":250,"line":388},9,[248,390,279],{"class":254},[248,392,393],{"class":282},"data_bytes_30d",[248,395,267],{"class":254},[248,397,270],{"class":254},[248,399,400],{"class":314}," 4180331495424",[248,402,299],{"class":254},[248,404,406,408,411,413,415,417,420],{"class":250,"line":405},10,[248,407,279],{"class":254},[248,409,410],{"class":282},"version",[248,412,267],{"class":254},[248,414,270],{"class":254},[248,416,290],{"class":254},[248,418,419],{"class":293},"1.42.0",[248,421,422],{"class":254},"\"\n",[248,424,426],{"class":250,"line":425},11,[248,427,428],{"class":254},"  }\n",[248,430,432],{"class":250,"line":431},12,[248,433,434],{"class":254},"}\n",[146,436,437,438,441,442,445],{},"Each number is one ",[187,439,440],{},"COUNT"," or ",[187,443,444],{},"SUM"," your own deployment runs against its own database, immediately before it sends:",[155,447,448,458],{},[158,449,450],{},[161,451,452,455],{},[164,453,454],{},"Field",[164,456,457],{},"Where it comes from",[174,459,460,471,482,493,504,515,526,535],{},[161,461,462,466],{},[179,463,464],{},[187,465,325],{},[179,467,468],{},[187,469,470],{},"select count(*) from public.sim",[161,472,473,477],{},[179,474,475],{},[187,476,307],{},[179,478,479],{},[187,480,481],{},"select count(*) from public.sim where state = 'active'",[161,483,484,488],{},[179,485,486],{},[187,487,342],{},[179,489,490],{},[187,491,492],{},"select count(*) from public.subscription where state = 'active'",[161,494,495,499],{},[179,496,497],{},[187,498,359],{},[179,500,501],{},[187,502,503],{},"select count(*) from auth.users",[161,505,506,510],{},[179,507,508],{},[187,509,376],{},[179,511,512],{},[187,513,514],{},"select count(*) from public.\"order\" where created_at > now() - interval '30 days'",[161,516,517,521],{},[179,518,519],{},[187,520,393],{},[179,522,523],{},[187,524,525],{},"select coalesce(sum(usage_bytes), 0) from public.sim_data_usage where timestamp > now() - interval '30 days'",[161,527,528,532],{},[179,529,530],{},[187,531,410],{},[179,533,534],{},"The version of the API binary you are running",[161,536,537,541],{},[179,538,539],{},[187,540,283],{},[179,542,543],{},"When the counters were read, UTC",[146,545,546],{},"They are counts and totals. There are no identifiers in them, no rows, and no sample of the underlying data.",[146,548,549],{},"We ask for them because your subscription is priced on volume, and we have no way to see inside your cluster. If you would rather we billed you on numbers you send us than on numbers we take from you, this is the shape that makes that possible.",[146,551,552,553,555],{},"Collection never blocks the heartbeat. If a counter query fails, the heartbeat still goes out with no ",[187,554,236],{}," body at all, and the Hub records the check-in as normal.",[146,557,558,562,563,565,566,569],{},[559,560,561],"strong",{},"Cadence."," The platform reads ",[187,564,213],{},", a Go duration. Set it through the chart's env passthrough, ",[187,567,568],{},"--set api.env.PHONEHOME_INTERVAL=5m",". Unset means the built-in default of 15 minutes, floored at 60 seconds. There is no separate knob for the usage report: it rides the same tick.",[150,571,573],{"id":572},"what-the-heartbeat-does-not-send","What the heartbeat does not send",[146,575,576],{},"Nothing about your infrastructure. No node names, no pod names, no namespace layout, no cluster version, no cloud provider, no CPU, no memory, no disk, no network topology.",[146,578,579],{},"No logs. No stack traces. No error reports. No configuration, no environment variables, no connection strings.",[146,581,582,583,585,586,589],{},"No personal data belonging to your customers. No names, no email addresses, no phone numbers, no ICCIDs, no order contents, no addresses, no payment details. ",[187,584,359],{}," is a count of rows in ",[187,587,588],{},"auth.users",". It does not carry who they are.",[146,591,592],{},"No catalog, no pricing, no revenue figures.",[150,594,596],{"id":595},"what-is-on-the-request-itself","What is on the request itself",[146,598,599],{},"The heartbeat is authenticated by proof of possession, so it carries these headers:",[601,602,603,609,615],"ul",{},[604,605,606],"li",{},[187,607,608],{},"Authorization: DPoP \u003Cyour license token>",[604,610,611,614],{},[187,612,613],{},"DPoP: \u003Ca proof JWT signed with your private key>",". The proof binds the HTTP method, the request URL, a fresh identifier, and a digest of the body.",[604,616,617],{},[187,618,619],{},"Content-Digest: \u003Csha-256 of the body>",[146,621,622],{},"The license token in that header contains the identifiers the Hub uses to find your row: the license id, your deployment id, and the expiry. Those are values we issued to you in the first place.",[146,624,625,626,629],{},"Because this is an HTTPS request that we receive, we necessarily see where it came from. The Hub records the source IP address and the ",[187,627,628],{},"User-Agent"," string against the timestamp of each check-in, the same way any web server records a request. That is the complete set of things we observe that your deployment did not choose to send.",[150,631,633],{"id":632},"what-the-response-carries","What the response carries",[239,635,637],{"className":241,"code":636,"language":243,"meta":244,"style":244},"{\n  \"deployment_id\": \"8c1f...\",\n  \"last_phonehome_at\": \"2026-07-12T09:15:01Z\",\n  \"lease_status\": \"active\"\n}\n",[187,638,639,643,663,683,701],{"__ignoreMap":244},[248,640,641],{"class":250,"line":251},[248,642,255],{"class":254},[248,644,645,647,650,652,654,656,659,661],{"class":250,"line":258},[248,646,261],{"class":254},[248,648,649],{"class":264},"deployment_id",[248,651,267],{"class":254},[248,653,270],{"class":254},[248,655,290],{"class":254},[248,657,658],{"class":293},"8c1f...",[248,660,267],{"class":254},[248,662,299],{"class":254},[248,664,665,667,670,672,674,676,679,681],{"class":250,"line":276},[248,666,261],{"class":254},[248,668,669],{"class":264},"last_phonehome_at",[248,671,267],{"class":254},[248,673,270],{"class":254},[248,675,290],{"class":254},[248,677,678],{"class":293},"2026-07-12T09:15:01Z",[248,680,267],{"class":254},[248,682,299],{"class":254},[248,684,685,687,690,692,694,696,699],{"class":250,"line":302},[248,686,261],{"class":254},[248,688,689],{"class":264},"lease_status",[248,691,267],{"class":254},[248,693,270],{"class":254},[248,695,290],{"class":254},[248,697,698],{"class":293},"active",[248,700,422],{"class":254},[248,702,703],{"class":250,"line":320},[248,704,434],{"class":254},[146,706,707,709,710,441,712,715,716,719],{},[187,708,689],{}," is the one field that changes anything. It is ",[187,711,698],{},[187,713,714],{},"revoked",". This is how your deployment learns it has been revoked: it asks, on its own schedule, and the answer tells it. Nothing is ever pushed to you. A revoked answer makes the deployment park itself, which is covered in ",[717,718,86],"a",{"href":87},".",[146,721,722,723,726],{},"The other channel for the same signal is the renew call, which answers ",[187,724,725],{},"410 Gone"," for a revoked license. Whichever the deployment reaches first, the effect is the same.",[150,728,730],{"id":729},"the-other-two-calls","The other two calls",[146,732,733,735],{},[559,734,36],{}," posts the activation code and the public half of the key the agent just generated, along with a self-signed proof that it holds the private half. It sends no business data at all. The Hub answers with your license.",[146,737,738,740,741,744],{},[559,739,194],{}," posts one field, ",[187,742,743],{},"confirmation_jkt",": the thumbprint of the new public key the agent wants the successor license bound to. The request is signed with the current key. It sends no business data either. The Hub answers with the successor license.",[150,746,748],{"id":747},"turning-it-off","Turning it off",[146,750,751,752,754,755,758],{},"You cannot, and you should not want to. The heartbeat is the same channel that tells your deployment its license is still good. A deployment that stops calling home stops learning anything, including that it is fine, and eventually its license expires and it stops serving. Slowing it down is supported: raise ",[187,753,213],{}," (",[187,756,757],{},"--set api.env.PHONEHOME_INTERVAL=1h","). Revocation then takes up to that interval to reach you, which is the tradeoff you are making.",[760,761,762],"style",{},"html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":244,"searchDepth":251,"depth":258,"links":764},[765,766,767,768,769,770,771],{"id":152,"depth":258,"text":153},{"id":229,"depth":258,"text":230},{"id":572,"depth":258,"text":573},{"id":595,"depth":258,"text":596},{"id":632,"depth":258,"text":633},{"id":729,"depth":258,"text":730},{"id":747,"depth":258,"text":748},"Every field your deployment sends to the Hub, why it sends it, and what it never sends.","md",null,{},true,{"title":82,"description":772},"CnNVPd7qp7c5uOFK8qrmLnIhoqAM-u9Z6DEBxC-M8no",[780,782],{"title":78,"path":79,"stem":80,"description":781,"children":-1},"The signing key is generated in your cluster and never transmitted, and the license agent can touch exactly two objects in your namespace.",{"title":86,"path":87,"stem":88,"description":783,"children":-1},"What happens to a deployment whose license is revoked, and the single command that brings it back.",1783967741116]