Whether the endpoint asking to use the relay may have it.

The relay expects a 200 whose body is exactly true, and treats everything else as a refusal. So this never raises: a 500 would deny, but it would also make an outage look like a policy, and the relay logs would blame the wrong thing.

Not signed like the rest of this API. The caller is our own relay, not a device, and it has no key of ours; a shared secret is what it can present. Being wrong here costs bandwidth, not access, because the relay carries traffic it cannot read either way.