Accept the acceptable-use policy
Records acceptance as a timestamp (the first one wins; accepting again is a no-op). This is often the last of the three activation facts, so the activation gate runs immediately — this is the route where a workspace usually goes live.
Authorizations
A dashboard session — the short-lived JWT a signed-in human holds at the dashboard, sent on the same Authorization: Bearer header. Dispatched by shape: a session token is a JWT, an API key starts with ck_. Sessions cannot be created through this API, and operations that list only this scheme refuse API keys with 401.
Response
Accepted, and what the activation gate did.
Acceptance is idempotent — the first timestamp wins. Because the AUP is often the last of the three activation facts, the activation gate runs immediately and activation reports what happened.