Assure licensing API
Server-side activation for encrypted compliance packs. Called by the Assure WordPress plugin during import — not intended for browser use.
Checkout
Creates a Stripe Checkout session for a yearly subscription. Redirects to Stripe hosted checkout.
Paid pack SKUs:
- Privacy ($49/yr):
apps,ccpa,cfr-part-2,coppa,ferpa,lgpd,pipeda,uk-gdpr - Accessibility ($99/yr):
wcag - HIPAA / GLBA ($99/yr):
hipaa,ftc-safeguards - Security ($129/yr):
soc2,iso-27001,pci-dss,dora,nis2 - Bundles:
library(Complete Library, $299/yr, 1 site),agency(Agency, $699/yr, 10 sites)
nist-csf is not a checkout SKU — NIST CSF 2.0 ships free with the WordPress.org plugin (builtin), alongside GDPR and OWASP Top 10.
Checkout session
Returns unlock key and download URL after successful payment (used by success page).
Pack download
Serves the encrypted pack after payment verification. Requires signed token or paid session_id.
Stripe webhook
Stripe checkout.session.completed (and subscription lifecycle) events for Assure yearly pack purchases (separate Stripe account from Site Access Policies).
Activate
Binds a purchased unlock key to one WordPress site URL. Idempotent when the same site re-activates.
{
"unlock_key": "8a3f5c2e9b1d7046e4f2a8c6b0d9e3f7",
"site_url": "https://example.com",
"framework": "hipaa"
}
Success (200):
{
"activated": true,
"reused": false,
"framework": "hipaa",
"label": "HIPAA",
"site_url": "https://example.com",
"activated_at": "2026-08-29T00:00:00.000Z"
}
Errors: 403 invalid key, 409 key already bound to another site.
Pack security model
- Store packs are AES-256-GCM encrypted (
.assure-pack) at download time with the buyer’s unlock key. - Plaintext pack catalogs are not publicly downloadable.
- Decryption requires a split key: half embedded in Assure, half from purchase.
- Activation binds the unlock key to a single site before import completes.