EULA

The EULA tag covers reading the published agreement and accepting it during browser session self-signup flows. Shapes follow EulaResponse (content, version), AcceptEulaRequest (accepted), and AcceptEulaResponse (message, user_id, optional workspace_id) — see the API reference.

GET /eula and POST /eula/accept both require authentication at the HTTP edge: an API key in X-API-Key, a Kratos browser session (ory_kratos_session cookie), or a JWT. They are used during onboarding after sign-in, before the user is provisioned. POST /eula/accept relies on X-User-Email / X-User-Phone from the Oathkeeper session (same pattern as other auth-browser routes — see Auth (browser session)).

Operations vs wire routes

Concern	HTTP	operationId	Notes
Read agreement	GET /eula	get_eula	Declares api_key in OpenAPI; a browser session or JWT is accepted too.
Accept & provision	POST /eula/accept	accept_eula	Body AcceptEulaRequest with accepted: true. Session-email header expectations match browser auth flows.

SDK coverage

Capability	Python	Rust (openapp_sdk)	Go	TypeScript (AsyncClient)
Get EULA	client.eula.get()	client.eula().get()	EULAAPI.GetEula	Not on façade yet
Accept EULA	client.eula.accept(accepted=True)	client.eula().accept(...)	EULAAPI.AcceptEula	Not on façade yet

Typical errors

GET /eula and POST /eula/accept return 401 without an API key, browser session or JWT. POST /eula/accept also returns 400 for invalid bodies. See Errors & retries.

Examples

Fetch EULA text

Python

text = await client.eula.get()
assert "version" in text

Go

GetEula returns EulaResponse.

import (
    "context"

    openapiclient "github.com/tomers/openapp-sdk/go"
)

resp, httpResp, err := client.EULAAPI.GetEula(context.Background()).Execute()
if err != nil {
    return err
}
defer httpResp.Body.Close()
_ = resp.GetContent()
_ = resp.GetVersion()

Rust

Returns serde_json::Value for EulaResponse.

use openapp_sdk::Client;

let client = Client::builder()
    .api_key("https://openapp.house_openapp_YOUR_SECRET")
    .build()?;

let eula = client.eula().get().await?;
if let Some(v) = eula["version"].as_str() {
    println!("{v}");
}

TypeScript

const eula = await fetch("https://openapp.house/api/v1/eula", {
  headers: { "x-api-key": process.env.OPENAPP_API_KEY! },
}).then((r) => r.json() as Promise<{ content: string; version: string }>);

GET /eula is not public: send an API key (as above), or call it from a signed-in page with credentials: "include" so the ory_kratos_session cookie goes along. Without either, the gateway answers 401. The public copy of the terms lives at /terms. Replace with AsyncClient.getEula once the Node façade exposes it.

Accept EULA (authenticated session)

Use this only when your transport carries the browser session / bearer token expected by the gateway (see Authentication and Auth (browser session)).

Python

out = await client.eula.accept(accepted=True)

Go

import (
    "context"

    openapiclient "github.com/tomers/openapp-sdk/go"
)

body := *openapiclient.NewAcceptEulaRequest(true)
resp, httpResp, err := client.EULAAPI.AcceptEula(context.Background()).
    AcceptEulaRequest(body).
    Execute()
if err != nil {
    return err
}
defer httpResp.Body.Close()
_ = resp

Rust

use openapp_sdk::Client;
use serde_json::json;

let client = Client::builder()
    .api_key("https://openapp.house_openapp_YOUR_SECRET")
    .build()?;

let provisioned = client
    .eula()
    .accept(&json!({ "accepted": true }))
    .await?;

TypeScript

const out = await fetch("https://openapp.house/api/v1/eula/accept", {
  method: "POST",
  credentials: "include",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ accepted: true }),
}).then(
  (r) =>
    r.json() as Promise<{
      message: string;
      user_id: string;
      workspace_id?: string;
    }>,
);

The browser path relies on the page’s ory_kratos_session cookie (same as Auth (browser session)) — credentials: "include" sends it across origins as long as CORS is configured. From Node, swap credentials: "include" for an undici.Agent + tough-cookie wrapper that replays the cookie jar captured during the Kratos self-service login, or pass an explicit Cookie: header. POST /eula/accept also provisions the user — capture out.user_id / out.workspace_id for the next dashboard hop. Replace with AsyncClient.acceptEula once the Node façade exposes it.