Resolve or create the authenticated user's Free entitlement
Eligible users receive Free immediately without browser verification. Soft risk signals are retained for audit, not challenged. Paid history, disposable email and prior successful device/cookie grants still deny Free. Replaying an ungranted challenge-pending claim rechecks eligibility and device ownership before granting; existing grants are never replenished.
Authorizations
JWT authentication token
Body
Opaque privacy-conscious browser signal; only an HMAC is stored.
1024Response
Free granted or already exists, or another entitlement already applies
allowed, existing, challenge_required, denied, paid_or_team_entitled free_usage, self_serve_usage, legacy_credits Stable decision code, including free_device_already_claimed for a device that permanently consumed its Free grant.

