Skip to main content
Endor Labs licenses are based on the number of contributing developers and are billed annually. Your license defines the features available to you and the number of contributing developers you are entitled to. See Endor Labs licenses for the full licensing model, SKUs, and entitlements per contributing developer. You can view your product bundle, current plan, expiration date, enabled features, scan credits, and license consumption to monitor usage throughout your contract term and plan for renewals. Only users with the Admin role in the root namespace can view license details. See Authorization roles to learn about roles. To view license details:
  1. Select Settings from the user menu.
  2. Select License.
  3. Select License Info from the left sidebar.
License information

​
Contributing developers

License consumption is measured in contributing developers. A contributing developer is any developer who has committed code to a scanned branch in the past 90 days. Each developer is counted once across all namespaces in your tenant, deduplicated by commit email and source code management (SCM) identity. The license consumption count is the total number of unique contributing developers at a point in time. Commits made to pull request branches are not counted. Click Download CSV to download the list of contributing developer email addresses, SCM IDs, host URLs, and verification status as a CSV file. The verification status column shows Yes for verified contributors and No for unverified ones. Contributing developers Each contributing developer is classified as verified or unverified, which determines how accurately they are counted toward your license consumption.
  • Verified: A unique developer whose committing email is linked to a confirmed SCM account, such as a GitHub identity. Multiple committing emails linked to the same SCM account are counted as one in the license consumption count.
  • Unverified: The committing email could not be associated with an SCM identity. This also happens when branches are scanned in CI or CLI mode, where the scan has no access to SCM APIs to resolve identities.

​
Organizations that need attention

The Organizations that need attention list shows organizations with unverified contributors. Verify these contributors to get an accurate license consumption count and resolve developers who would otherwise be counted incorrectly. For projects scanned with scheduled, agentless scans, Endor Labs verifies contributors automatically through SCM APIs. Projects scanned through the CLI or in CI need manual verification. To verify contributors:
  1. Click the vertical three dots on the organization you want to verify and select Verify contributors.
  2. Enter the access token with the required permissions. See Supported SCM platforms and access tokens to learn more.
  3. Click Verify.
Verification runs in the background and refreshes the status in the list and the contributor count. If verification fails, the status shows an error. Review the error detail for the reason and how to resolve it. Verification error The status indicator may show failure even if some projects in the organization are verified but others aren’t, due to permission or other issues. Download the CSV to see which projects failed, fix the cause, and verify again. Some contributors remain unverified even after verification, such as those whose committing emails are local machine addresses, CI/CD bot commits, or emails with typos in the Git configuration. If unverified contributors count remains but no organizations appear in the list, their committing emails could not be linked to any SCM identity. Download the CSV to identify these contributors. Contributing developers only

​
Supported SCM platforms and access tokens

To verify contributors, use an access token with the minimum permissions required for your SCM platform, as shown in the following table.

​
Scan credits

Your license includes scan credits for each contributing developer, which pool across your contract term. The page shows your scan credit usage and total scan credit pool. Each PR scan, monitored branch scan, and default branch scan above the allowed limit counts against the scans permitted by your contract plan. For per-seat allocations, credit pooling, and overage, see Endor Labs licenses.

​
Frequently asked questions

Your access token is invalid, expired, or missing permissions. Generate a new token with the required permissions and verify again.
Verification succeeded for some projects and failed for others. Download the CSV to see which projects failed, fix the cause, and verify again.
No. Endor Labs automatically filters known bots, such as Dependabot, Renovate, and GitHub Actions, so they are not counted. Other bots may still appear in the contributor list. Contact your account team for additional information.
Endor Labs clears the token after verification and does not store it. Enter it again each time you verify.
The count reflects commits from the past 90 days and refreshes periodically. Contributors who have not committed in that window drop out automatically.
Once. A developer who commits to multiple projects counts only once toward your license consumption.
No. Scans continue and any overage appears in your usage. Contact your account team to add more credits.
Their commit emails are not linked to any SCM account, such as local machine addresses, bot commits, or typos in the Git configuration. Download the CSV to find them, then link the email to the SCM account or correct the Git configuration. Contact your account team for additional information.