An API is the wrong ask
Why every conversation with a licence register stalls, and what to ask for instead.
Every discussion about credential checking arrives at the same place: somebody asks the authority for an API. What comes back is a procurement cycle, a budget line and a wait measured in years, which in practice is a no. The request is then recorded as refused, and everyone concludes that authorities are not interested.
They were not asked for the right thing. What the problem actually needs is a list of licence references and their status, exported to a file, at an address that does not change. Most registers already produce that export internally, for their own reporting.
An API is a service: uptime, versioning, authentication, deprecation, a support queue. A file is an artefact: it is produced, it is published, and nothing is owed to anybody afterwards. The gap in cost between the two is enormous and the gap in usefulness, for this purpose, is close to nothing.
That is what RVW-5 is built around. Tier A is the file. Tier B adds a signature, which costs a key and one DNS record. Only tier C asks for something genuinely new, and the specification is ordered so that an authority can stop at any tier and still have moved the problem forward.
If you work inside a register and this reads as naive from where you sit, that is exactly the conversation this lab wants to have.