HTTPS¶
HTTPS JSON POST uses pinned ureq 3.4.2, rustls and normal platform certificate verification. The deadline covers connection and response reading. Responses stream under a caller-selected 0..=16 MiB bound (default 65,536 bytes); oversized responses return an error rather than a prefix. Requests allow at most 16 MiB of payload and 1..=300 seconds (default 15). HTTP error statuses retain their status/body. Transport errors expose no response body. Redirects, cookie storage, implicit credentials and environment proxy selection are disabled. URLs must use HTTPS without embedded credentials or fragments. Invalid user-agent headers are rejected. No network operation occurs until explicitly requested.
There is no automatic product activation operation in RAVET. Explicit local signed-entitlement verification is a separate optional data API. Endpoints, payload fields, purchase data, licence keys, verification policy, trial rules, machine-ID hashing and record paths remain in private consumers. Raw macOS UUID/Windows SMBIOS queries perform no hashing or transmission.