Licence and agent limits

Your licence sets how many agents the stack accepts and until when. We assign it; it reaches your stack automatically through theseus-node.

Plans

Plan	What it is
Trial	Every new organisation: 30 days, 25 agents, every feature
Standard, Enterprise	A label and an agent limit we agree with you. Every integration is available on every plan

Add-ons are extra-cost options shown on the licence. The first one is backup

coming soon: it is recorded on the licence, but no managed backup

service is attached to it yet.

What counts

• Every Wazuh agent counts, except the manager itself (agent 000).
• Disabled agents count. They keep their registration and come back with one click.
• Agents held by the licence do not count.

The Agents page shows "N of M agents" in its header.

At the limit

• Add agents is turned off in the console, with the reason.

• A new machine's install is refused:

  enrolment refused (HTTP 403): This Theseus licence allows 25 agents. Ask your provider to raise the limit.

• A machine that is already enrolled (a re-run, enabling patching) is never refused.

• Remove an agent to free a place, or ask us to raise the limit.

When the licence ends

When the licence expires, the stack keeps its full limit for 14 days of grace; the console shows how many days are left. After the grace, or at once when the licence is ended, the stack keeps running but is limited to one agent:

• nothing is stopped and no data is deleted;
• agents over the limit are held: disabled through the same mechanism as Disable agent, and marked Held by licence. Agents you had already disabled are held first, then the newest ones;
• held agents stop file integrity monitoring, SCA, inventory, active response and patch jobs; the Wazuh agent's own log collection keeps running;
• when a licence is assigned again, held agents are released, oldest first, up to the new limit, and their groups restored.

You cannot enable a held agent by hand unless there is room under the limit. If you disable a held agent by hand, it becomes yours: the licence will release it later without enabling it.

The banner

A banner across the console appears when the licence has 7 days or less left, or when the stack is limited. Its messages:

Message	Status	What to do
Trial ends in N days. / Licence ends in N days.	active	Contact us to extend or buy
Trial expired. / Licence expired. In N days this stack is limited to one agent...	grace	Contact us to renew; nothing is limited yet
Trial ended. / Licence expired. This stack is limited to one agent...	expired	Contact us
Licence ended. ...	ended	Contact us
This stack has not reached its provider for 7 days. ...	stale	Restore outbound HTTPS to the control plane; see troubleshooting
No licence is installed. ...	missing	The stack has not received a licence yet; check theseus-node
The licence could not be verified. ...	invalid	Contact us

How it is kept current

• The licence is a document signed by the control plane. The stack verifies the signature with a key built into its images, and checks that it was issued for this stack.
• theseus-node writes it to /opt/theseus/runtime/license/license.json. It is renewed at least once a day.
• Each renewal is valid for 7 days. A stack that cannot reach the control plane for 7 days falls back to one agent until it reconnects; then everything comes back automatically.
• The stack re-reads the file within 30 seconds of a change and re-checks the limit every 5 minutes.

Updates and the licence

New releases and their images are for licensed stacks. Once a licence has lapsed past its grace, or was ended, upgrades are refused until it is renewed. A licence belongs to one installation: copied to another server, it does not count there.