Store the org's PEWC opt-in disclosure copy
Store the org’s consumer-facing PEWC opt-in disclosure copy (rendered by the hosted opt-in form). STORING the copy is self-serve; APPROVING it is NOT — this NEVER flips pewcDisclosureApproved (the four 47 CFR 64.1200(f)(9) elements are a legal artifact counsel / an admin must finalize, A6). The org must have started onboarding (a submitted identity) first.
Authorizations
Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.
Body
the org's consumer-facing PEWC opt-in copy (stored, NOT approved).