2

A few points to be made to help give clarity to the scenario:

  1. The AGPL application and its API can and most likely be customised to suit business needs
  2. Other unknown licensed applications require to utilise these customised API calls (entry points) to ensure standardisation of calls
  3. The whole 'network' of other applications are stand alone applications e.g. ERP and CMS. The assumption would be that these talk between one another through the same means i.e. REST API
  4. Customers (on a SaaS network) would 'connect' to the AGPL application by means of 'indirect' or layered platforms/APIs e.g. customer uses the website portal (CMS) -> eCommerce -> AGPL Application's REST API

I have found few references of explicitly stating API below, but found they don't tackle or highlight the issue of 'how far' does this network interaction goes IF the application has been modified - tons of answers on unmodified though...

Under AGPLv3+ do I need to provide the source for secondary applications? https://opensource.stackexchange.com/a/6714/12926

Does this mean that if any customisation is required to tailor to a business needs it must be made publicly available (and releasing their business logic advantage) even if the use of the business logic is through Rest APIs or within layers of applications?

If so would a potential solution be to develop and release a separately licensed wrapper around the AGPL application (including the customised API) to manoeuvre around releasing the complete business logic and only the wrapper?

Improve this question

1 Answer 1

Reset to default
2

The (A)GPL license is a strong copyleft license. This means that if an application contains code licensed under the (A)GPL license, then the entire application must be licensed under terms that are compatible with the (A)GPL. This includes any modification/customization you made.

The main exception is if the application consists of multiple distinct parts that communicate "at arm's length" with each other, like through a REST API.

The difference between the GPL and the AGPL is that the GPL requires that you make the source code available to anybody that receives a copy of the executable, but the AGPL additionally requires that you make the sources available to anybody that interacts remotely with the application.

In yoiur situation, the source of the AGPL application that provides the API must be made available to the users of the API under terms that are compatible with the AGPL license. The sources must correspond to the actual application that the users interact with, so including your customizations.
The source code does not have to be made available to the general public, but only to those entities that use it.

Improve this answer
3
  • Thanks for taking the time to respond. When you say "entities that use it" are you referring to the customers of the company that don't have any direct connection to the AGPL application but information will be passed between through other secondary applications. I'm particularly interested in the workflow of the original post: e.g. customer uses the website portal (CMS) -> eCommerce -> AGPL Application's REST API
    – April Caledonia
    Aug 24, 2018 at 7:51
  • @AprilCaledonia: With the "entities that use it", I was primarily referring to the companies running the CMS, ERP, etc. Whether the end-users also fall under it depends on how direct or indirect their interaction with the API is. If the API is used directly from scripts running on the end-user's machine, the chances are that the end-users have the right to access the source code under the AGPL. If the API is only accessed from other servers, then the end-users probably don't have that right.
    – Bart van Ingen Schenau
    Aug 24, 2018 at 16:34
  • Thanks again! Yes that makes sense. The API is authenticated to do such actions and thus the end user is the authorised user which wouldn't be the customer of the company but rather the authorised user from the ERP/CMS integration. It would be intriguing to understand the concept if the end users could also be non authenticated and that there interaction is in form of a script running on server (within a CMS integration e.g.) rather than a client side script e.g. calling the API itself and how far that linking goes... maybe that's for another question.
    – April Caledonia
    Aug 27, 2018 at 9:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.