---
title: "Runtime phone-home verification called by EE deployments"
method: POST
path: "/v1/projects/phone-home"
tags: ["Projects"]
---

# Runtime phone-home verification called by EE deployments

`POST /v1/projects/phone-home`

## Request body

- PhoneHomeBodyDto
  - `token` string, required

## Response `200`

- PhoneHomeResponseDto
  - `body` PhoneHomeResponseBodyDto, required
    - `ok` boolean, required
    - `reason` 'revoked' | 'no_active_license' | 'invalid'
    - `projectId` string, uuid — Hub-side project id when the inbound JWT resolved to a project. Absent on `invalid`.
    - `sub` string — Project key (JWT `sub`) echoed back so denial responses can still be bound to a subject when no project exists.
    - `expiresAt` string, date-time
    - `iat` number, required — Issued-at as unix seconds.
    - `exp` number, required — Envelope expiry as unix seconds — enforced server-side via the JWS `exp` claim to defeat replay.
  - `signature` string, required — Compact JWS (RS256) whose payload equals `body`. Verify against the JWKS.

## Other responses

- `400` — Validation failed
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `409` — Conflict
- `500` — Internal server error

---

[API](https://skmtc.net/vendure/apis/vendure-io-api-public.md) · [All operations](https://skmtc.net/vendure/apis/vendure-io-api-public/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vendure/vendure-io-api-public/revisions/5fc4757128af/schema)