The answer isn't all that obvious. The
portlet-api 1.0 POM on Maven Central contains a link to the original download URL, which is that of JSR-168, the portlet spec. Downloads there are made available pursuant to the acceptance of a software license agreement which is typical of JSRs and not open source. Further, the archive you get then contains a
license.txt file which doesn't grant any rights, and the source code is marked as
Copyright 2003 IBM Corporation and Sun Microsystems, Inc.
All rights reserved.
Use is subject to license terms.
There is however an Apache 2.0-licensed repository, hosted by the Apache Software Foundation. Given that the Maven Central JAR was built by Emmanuel Venisse of the ASF (as documented the manifest in the JAR), it's quite likely that it is effectively Apache-licensed.
I don't know what the history of the code is, so you may take all this with a pinch of salt. The ASF are careful about the code they host though, so the risk is minimal; Debian uses that to build its own