# Activate a managed lifecycle

## Endpoint

```http
POST /managed-lifecycle/activate
```

Activate the exact host-issued lifecycle UID. accountPublicKey must name this authority or the request returns 403 before mutation. Native already-exists is 409. Native refusals preserve code, outcome and optional details. An unexpected failure returns 500 with outcome unknown.

### Parameters

No operation parameters.

### Request body

The request uses the schema below.

Required: yes.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Activation"
}
```


### Responses

#### HTTP 200

The host decision completed.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Activated"
}
```

#### HTTP 400

Malformed JSON or invalid request fields.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 401

Missing or invalid loopback capability.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 403

An Origin header or failed authority/proof check is refused.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 405

Only POST is accepted.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 409

The lifecycle already exists or a native conflict was refused.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 413

Request exceeds the 65536-byte body limit.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 415

Content-Type must be application/json.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 429

Invalid-capability attempts exceeded the rolling-minute limit.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP 500

Unexpected activation failure; outcome is unknown.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

#### HTTP default

Native authority refusal classified by its error code.

Content type: `application/json`.

```json
{
  "$ref": "#/components/schemas/Error"
}
```

Authentication and access: Host-only HTTP operations of the stock auth service. These six routes exist only on the loopback listener and return 404 on the public listener. The owner-private auth-service discovery record supplies its port and exchange capability. Every operation requires the exact Authorization bearer capability, application/json and no Origin header. Requests match the exact target, so query strings and trailing slashes return 404. Bodies default to 65536 bytes. More than 30 invalid capability attempts in a rolling minute receive 429.

The loopback listener also serves /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /service-endpoint-authority, /service-endpoint-host and /chat-session/open, /chat-session/bearer, /chat-session/retire. Their public request and response shapes are in the [Auth HTTP API](https://docs.cotal.ai/api/auth/). Proof operations additionally require the loopback capability. The loopback /health handler also accepts other methods. Elevated exchange views and operator host operations are loopback-only. Mesh discovery is public-listener-only. This implementation reference does not establish a stable cloud API.

[OpenAPI specification](https://docs.cotal.ai/auth-host.openapi.json) contains the referenced response schemas. [Complete Markdown reference](/api/auth-host.md).