Accept activation terms

POST/v1/activation/terms:accept

Idempotency-Key requiredAccepts bearer

Accept the current terms version — rail step 8

termsVersion must equal GET /v1/activation terms.currentVersion; an older one is 409 CONFLICT details.reason TERMS_VERSION_STALE with details.currentVersion.Show more

termsVersion must equal GET /v1/activation terms.currentVersion; an older one is 409 CONFLICT details.reason TERMS_VERSION_STALE with details.currentVersion. Accepting the version already accepted is a 200 with the original acceptance. A missing, wrong or doubled proof is 403 PERMISSION_DENIED details.reason STEP_UP_FAILED, STEP_UP_LOCKED when the user is locked out, and STEP_UP_UNAVAILABLE when the caller has no MFA factor to step up with (enrol one at /v1/auth/mfa; on the CAPPED flow, confirm with an e-mailed code instead, below). Idempotency-Key required. Audited (activation.terms_accepted). a third proof, emailCode — the 6-digit code POST /v1/activation/terms:send-code e-mailed to the signed-in Owner — so an Owner with no authenticator (every new sign-up) can accept. The body carries exactly one of stepUpCode, stepUpAssertion or emailCode; none or more than one is 403 STEP_UP_FAILED. A wrong, expired, voided (a newer code was sent) or never-sent emailCode is 403 PERMISSION_DENIED details.reason STEP_UP_FAILED; the 5th wrong attempt spends the code and further attempts are STEP_UP_LOCKED until a new code is sent (the code lives 15 minutes, as the sign-up code). A code is spent by a successful acceptance. On the NINE_STEP flow emailCode is 400 VALIDATION details.field emailCode, details.reason FLOW_NOT_CAPPED (step up with stepUpCode or stepUpAssertion there); an emailCode that is not six digits is 400 VALIDATION details.field emailCode. On CAPPED, STEP_UP_UNAVAILABLE answers only a stepUpCode or stepUpAssertion from a caller with no factor; its message points at terms:send-code. on the CAPPED flow the acceptance is a click-wrap — the body may carry termsVersion and no proof at all (no stepUpCode, stepUpAssertion or emailCode); the Owner's human session is the proof (the e-mail was confirmed at sign-up), and the console sends termsVersion only, once the Owner has ticked "I agree". Every other rule stands: human session only, Owner only (OWNER_ONLY), termsVersion must be the current one (TERMS_VERSION_STALE), the version already accepted answers the original acceptance, Idempotency-Key required, audited. A proof that is sent anyway on CAPPED is still judged as above (exactly one, a wrong one 403 STEP_UP_FAILED), so a client of 1.52.0 keeps working. The NINE_STEP flow is unchanged: no proof there is 403 PERMISSION_DENIED details.reason STEP_UP_FAILED (or STEP_UP_UNAVAILABLE for a caller with no factor). where the tenant's country is routed to the hosted onboarding provider (ActivationState.businessVerification.provider stripe_connect), the terms the Owner accepts include that provider's connected-account agreement, shown by the console as a fourth document beside the platform's own; the acceptance is forwarded to the tenant's connected account as its terms acceptance (the date, the caller's IP address and user agent), at once when the account exists and otherwise when the business verification opens it. Same request and answer; termsVersion still names the platform's version.

Headers

Idempotency-KeystringRequired
Mandatory on mutations: **48h TTL**; replay with same body-hash returns the original response with Idempotency-Replayed true; same key + different body is 409 IDEMPOTENCY_CONFLICT; in-flight duplicate…Show more
Mandatory on mutations: **48h TTL**; replay with same body-hash returns the original response with Idempotency-Replayed true; same key + different body is 409 IDEMPOTENCY_CONFLICT; in-flight duplicate is 409 IDEMPOTENCY_IN_PROGRESS.

Request bodyTermsAcceptRequest

termsVersionstringRequired
stepUpCodestringOptional
A current code from the caller's MFA factor
stepUpAssertionWebAuthnAssertionOptional
A WebAuthn assertion (the JSON of a PublicKeyCredential from navigator.credentials.get), every binary value base64url.Show more
A WebAuthn assertion (the JSON of a PublicKeyCredential from navigator.credentials.get), every binary value base64url. The stepUpAssertion of every step-up-guarded body. Obtain the challenge from POST /ops/v1/auth/mfa/step-up/webauthn-options.
5 child attributes
- idstringRequired
  The credential id, base64url
- rawIdstringRequired
  The credential id, base64url
- typestringRequired
  - public-key
- responseobjectRequired
  4 child attributes
  - clientDataJSONstringRequired
    base64url
  - authenticatorDatastringRequired
    base64url
  - signaturestringRequired
    base64url
  - userHandlestringOptional
    base64url, or null when the authenticator returns none
- clientExtensionResultsobjectOptional
emailCodestringOptional
the 6-digit code POST /v1/activation/terms:send-code e-mailed to the signed-in Owner (15 minutes, at most 5 attempts).Show more
the 6-digit code POST /v1/activation/terms:send-code e-mailed to the signed-in Owner (15 minutes, at most 5 attempts). On the NINE_STEP flow it is 400 VALIDATION details.field emailCode, details.reason FLOW_NOT_CAPPED. optional on CAPPED too (the acceptance needs no proof there); kept for compatibility.

Responses

200AcceptedTermsAcceptance
400ApiErrorResponse
401
UNAUTHENTICATED — missing or expired token.Show more
UNAUTHENTICATED — missing or expired token. Declared on every operation because `security` is declared globally at the document root: every route is authenticated, so every route can answer 401.
ApiErrorResponse
403ApiErrorResponse
405
VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge).Show more
VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge). Not retryable as sent.
ApiErrorResponse
409CONFLICT TERMS_VERSION_STALE — a newer terms version is currentApiErrorResponse
413
VALIDATION — the request body is larger than the surface's limit.Show more
VALIDATION — the request body is larger than the surface's limit. Not retryable as sent: shrink the body. Declared on every operation that takes a request body. details carries exactly one key, maxBodyBytes (integer): the limit that applies to this surface, in bytes.
ApiErrorResponse
414
VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge).Show more
VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge). Not retryable as sent: send long input in the body of a POST.
ApiErrorResponse
415
VALIDATION — a request body that is not JSON (application/json or application/*+json; a form body only on the OAuth token routes).Show more
VALIDATION — a request body that is not JSON (application/json or application/*+json; a form body only on the OAuth token routes). The public edge refuses it before the platform sees it (details.reason UNSUPPORTED_MEDIA_TYPE, details.source edge). Not retryable as sent: send Content-Type application/json. Declared on every operation that takes a JSON request body.
ApiErrorResponse
500INTERNAL — a bug, and traceId is the support handle.ApiErrorResponse

Errors you should handle

Branch on code and honour retryable — never on the HTTP status alone.

400	VALIDATION message.intent.checkOut must be after message.intent.checkIn	not retryable
400	UNKNOWN_DOMAIN Unknown domain 'HOTELS'. Did you mean HTL?	not retryable
401	UNAUTHENTICATED The bearer token is expired. Re-authenticate and retry.	not retryable
403	PERMISSION_DENIED Reading wallets needs the finance:read permission.	not retryable
405	VALIDATION This method is not served.	not retryable
409	CONFLICT Terms version 2026-09 is no longer current; read and accept 2026-10.	not retryable
413	VALIDATION The request body is larger than this API accepts (262144 bytes).	not retryable
414	VALIDATION The request URI is longer than 8 KiB.	not retryable
415	VALIDATION Send application/json.	not retryable
500	INTERNAL An unexpected error occurred. Quote the traceId to support.	retryable