---
title: "Accept Terms"
method: POST
path: "/api/auth/accept-terms"
tags: ["auth", "billing"]
---

# Accept Terms

`POST /api/auth/accept-terms`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/auth/accept-terms`
- Auth: none declared

User-initiated re-acceptance of the current TERMS_VERSION.

ROADMAP P2 (2026-04-24). Called by the frontend
terms_reacceptance modal after the user clicks "I accept the
updated terms." Updates `users.terms_version` + `terms_accepted_at`
and writes an audit-log row so legal can prove the user
consented to a specific version.

The CSRF dependency + require_auth dependency together ensure
only the authenticated user can re-accept (not an XSRF or
impersonation attack). No request body — the version is read
server-side from `OL_TERMS_VERSION` so the client can't lie
about which version they're accepting.

## Response `200`

Successful Response

- AuthActionResponse: Loose response_model for auth routes (signin/register/oauth callbacks). Multi-shape success vs error envelopes; FE branches on specific keys via the public typed wrappers.

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)