Create and Assign Custom Licenses

You can define custom licenses in JFrog Catalog and assign them to packages or package versions. Custom licenses cover internal legal frameworks, proprietary agreements, or third-party licenses that standard scanners don't detect.

After you assign a custom license, JFrog Curation and JFrog Xray enforce it in license policies, include it in the generated software bill of materials (SBOM), and make it available through the GraphQL and REST APIs.

• Create a Custom License
• Assign a License from License Settings
• Assign a License from a Package Version

Before You Begin

You need the following:

• Admin permissions in the JFrog Platform.
• Access to JFrog Catalog.
• At least one curated remote repository, if you want Curation to enforce the license.

Manage Custom Licenses

You can manage custom licenses from Catalog > License Settings. The list shows the following details for each license:

• Name
• Created date
• Creator
• Last modified
• Expiration date
• Associated package count

From this page, you can create, edit, and delete custom licenses, and assign one license to multiple packages or versions.

Create a Custom License

Create a custom license when a package needs a license that standard scanners don't detect.

To create a custom license:

1. Navigate to Catalog > License Settings.

2. Click Create License.

3. Fill in the following fields.

   Field	Required	Description
   Name	Yes	Unique identifier for the license. Supports special characters in Software Package Data Exchange (SPDX) expressions.
   Full Text	Yes	The full legal agreement text. Supports rich text and Markdown.
   Category	Yes	Select from the predefined dropdown list, for example Permissive, Copyleft, or Proprietary.
   Expiration Date	No	Optional date for a time-limited entitlement. After the date, Catalog no longer enforces the license.

4. Click Create.

Assign a Custom License to a Package or Version

You can assign a custom license from License Settings or from a package version.

Assign a License from License Settings

Use this flow to assign one license to multiple packages or versions at once.

To assign a license from License Settings:

1. Navigate to Catalog > License Settings.
2. Select the license you want to assign.
3. Click Assign to Packages.
4. Search and select the target packages or versions.
5. Click Assign.

Assign a License from a Package Version

Use this flow to assign a license to a specific package version, a range of versions, or all versions of a package.

To assign a license from a package version:

1. Navigate to the package detail page in JFrog Catalog.
2. Open the Licenses tab.
3. Click Assign Custom License.
4. Select the custom license from the list.
5. Choose the assignment scope:
   • A specific version.
   • A range of versions.
   • All versions.
6. Choose the assignment mode:
   • Add: The custom license coexists with detected public licenses.
   • Replace: The custom license overrides the detected public license.
7. Click Assign.

License Expressions

When you assign multiple licenses to one package, define how those licenses relate to each other:

• And: The package is governed by all assigned licenses at the same time.
• Or: The package is governed by any one of the assigned licenses.

Expiration and Notifications

A custom license can include an expiration date. As that date approaches, Catalog shows warnings at 90, 60, 30, and 10 days before expiration. Expiring licenses are highlighted on the License Settings page and on the package Licenses tab.

When a license expires:

• Curation and Xray no longer enforce it in policy evaluations.
• It remains visible in Catalog for audit and is marked as expired.

Policy Enforcement

Curation and Xray evaluate custom licenses in their license policies.

Evaluation Logic

When a package enters the JFrog Platform or is scanned:

1. Catalog checks the package for a custom license assignment.
2. If a custom license exists, policy evaluation uses it and respects the Add or Replace mode.
3. If no custom license is assigned, policy evaluation uses the detected open-source software (OSS) license.

Curation Policies

Custom licenses appear in the license list when you configure Block list by License or Allow list by License. For more information, see List of Available Conditions.

Xray Policies

Custom licenses are available in Xray policy wizards under the License criteria. When you assign a custom license in Replace mode, Xray uses that license instead of the detected license for violation checks.

SBOM Consistency

Custom licenses that you assign in Catalog appear in SBOMs that Xray generates:

• Add mode: The custom license appears alongside the detected license in the SBOM.
• Replace mode: The custom license replaces the detected license in the SBOM.

Changes in Catalog propagate to Xray and appear in later SBOM exports.

REST API

You can manage custom licenses with the REST API.

Create License Request

curl -X POST \
  'https://<JFROG_URL>/api/v1/catalog/licenses' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <TOKEN>' \
  -d '{
    "name": "<LICENSE_NAME>",
    "license_text": "<LICENSE_TEXT>",
    "category": "<LICENSE_CATEGORY>"
  }'

Where:

• <JFROG_URL> is the hostname of your JFrog Platform.
• <TOKEN> is an access token with permission to manage Catalog licenses.
• <LICENSE_NAME> is the unique license name.
• <LICENSE_TEXT> is the full license text.
• <LICENSE_CATEGORY> is a category from the license category list, such as Proprietary.

For example:

curl -X POST \
  'https://company.jfrog.io/api/v1/catalog/licenses' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <TOKEN>' \
  -d '{
    "name": "My-Internal-License",
    "license_text": "Full license agreement text...",
    "category": "Proprietary"
  }'

List Licenses Request

curl -X GET \
  'https://<JFROG_URL>/api/v1/catalog/licenses' \
  -H 'Authorization: Bearer <TOKEN>'

The <JFROG_URL> and <TOKEN> placeholders are the same as in the create request.

For example:

curl -X GET \
  'https://company.jfrog.io/api/v1/catalog/licenses' \
  -H 'Authorization: Bearer <TOKEN>'

GraphQL API

You can query and manage custom licenses through Catalog GraphQL, which is part of JFrog OneModel. For more information, see Catalog GraphQL.

Related Topics

• Configure Catalog
• Configure and Manage Labels
• Catalog
• List of Available Conditions