Open Stripe Checkout to start a NEW subscription for an org whose current one is dead. Admin-only, same dependency as the routes above.

The self-serve half of what /reprovision does for support. Stripe cannot revive a canceled subscription; the only way back is a new one, and Stripe's own guidance is to collect payment details and create it — which is Checkout. See stripe_client.create_resubscribe_session for why Checkout rather than a server-side create (SCA), and why there is no trial.

The access guard is the top-up's INVERTED. Top-up refuses a blocked org; this route refuses everything EXCEPT a dead one: 409 unless a subscription id is stored AND its status is terminal. Both halves, like /reprovision — "resubscribe" must never mean "start a second subscription beside a working one", and an org with no stored id was never provisioned at all (Manage billing already handles that). A blocked-but-alive status such as paused or past_due is a payment problem the Portal fixes, not this.

Nothing is written here. The subscription is created by Checkout, and the webhook adopts it onto the row when customer.subscription.created lands — the same path a Portal re-subscribe already takes.