fix: add error logging to agentic provisioning endpoints

[MattBro]

Problem

_error_response in the agentic provisioning views has no logging, making it impossible to diagnose 400/401 errors from production logs. We're seeing 401s on /api/agentic/provisioning/resources and can't tell why.

Changes

Added logger.warning to _error_response so all error responses from provisioning endpoints are logged with the error code and message.

How did you test this code

Verified in production logs that POST /api/agentic/provisioning/resources was returning 401 with no application-level log entry explaining the cause.

🤖 Generated with Claude Code

[greptile-apps]

Comments Outside Diff (1)

1. ee/api/agentic_provisioning/signature.py, line 19-21 (link)

   Unused constants after verify_api_version removal

   API_VERSION and API_VERSION_HEADER are now dead code — they were only referenced inside verify_api_version, which has been deleted. Neither constant is imported in views.py or anywhere else. Per the simplicity rule of "no superfluous parts", they should be removed.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: ee/api/agentic_provisioning/signature.py
   Line: 19-21
   
   Comment:
   **Unused constants after `verify_api_version` removal**
   
   `API_VERSION` and `API_VERSION_HEADER` are now dead code — they were only referenced inside `verify_api_version`, which has been deleted. Neither constant is imported in `views.py` or anywhere else. Per the simplicity rule of "no superfluous parts", they should be removed.
   
   
   
   How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: ee/api/agentic_provisioning/views.py
Line: 164-165

Comment:
**`account_requests` now has no authentication**

After this PR, `account_requests` is the only provisioning endpoint with zero authentication. All other endpoints still call `verify_stripe_signature` as their auth layer, but `account_requests` never had it — it only had `verify_api_version`. Removing `verify_api_version` here leaves the endpoint completely open.

An unauthenticated caller can now:
- Trigger account creation for arbitrary email addresses
- Force existing users through an OAuth consent redirect

The PR description says "The HMAC signature is the real authentication layer", which is correct for the other endpoints — but `account_requests` does not call `verify_stripe_signature`. Should it be added here, or is there a specific reason this endpoint is intentionally unauthenticated? A comment explaining the decision would help clarify intent.

**Rule Used:** Add inline comments to clarify the purpose of sign... ([source](https://app.greptile.com/review/custom-context?memory=4d5b48c5-045d-4693-9cd9-4081bb19508b))

**Learnt From**
[PostHog/posthog#32083](https://github.com/PostHog/posthog/pull/32083)

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: ee/api/agentic_provisioning/signature.py
Line: 19-21

Comment:
**Unused constants after `verify_api_version` removal**

`API_VERSION` and `API_VERSION_HEADER` are now dead code — they were only referenced inside `verify_api_version`, which has been deleted. Neither constant is imported in `views.py` or anywhere else. Per the simplicity rule of "no superfluous parts", they should be removed.

```suggestion
SIGNATURE_HEADER = "Stripe-Signature"
MAX_TIMESTAMP_DRIFT_SECONDS = 300
```

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: "fix: remove API-Vers..."}

[greptile-apps]

account_requests now has no authentication

After this PR, account_requests is the only provisioning endpoint with zero authentication. All other endpoints still call verify_stripe_signature as their auth layer, but account_requests never had it — it only had verify_api_version. Removing verify_api_version here leaves the endpoint completely open.

An unauthenticated caller can now:

• Trigger account creation for arbitrary email addresses
• Force existing users through an OAuth consent redirect

The PR description says "The HMAC signature is the real authentication layer", which is correct for the other endpoints — but account_requests does not call verify_stripe_signature. Should it be added here, or is there a specific reason this endpoint is intentionally unauthenticated? A comment explaining the decision would help clarify intent.

Rule Used: Add inline comments to clarify the purpose of sign... (source)

Learnt From
PostHog/posthog#32083

Prompt To Fix With AI

This is a comment left during a code review.
Path: ee/api/agentic_provisioning/views.py
Line: 164-165

Comment:
**`account_requests` now has no authentication**

After this PR, `account_requests` is the only provisioning endpoint with zero authentication. All other endpoints still call `verify_stripe_signature` as their auth layer, but `account_requests` never had it — it only had `verify_api_version`. Removing `verify_api_version` here leaves the endpoint completely open.

An unauthenticated caller can now:
- Trigger account creation for arbitrary email addresses
- Force existing users through an OAuth consent redirect

The PR description says "The HMAC signature is the real authentication layer", which is correct for the other endpoints — but `account_requests` does not call `verify_stripe_signature`. Should it be added here, or is there a specific reason this endpoint is intentionally unauthenticated? A comment explaining the decision would help clarify intent.

**Rule Used:** Add inline comments to clarify the purpose of sign... ([source](https://app.greptile.com/review/custom-context?memory=4d5b48c5-045d-4693-9cd9-4081bb19508b))

**Learnt From**
[PostHog/posthog#32083](https://github.com/PostHog/posthog/pull/32083)

How can I resolve this? If you propose a fix, please make it concise.

[MattBro]

account_requests is authenticated via the @stripe_region_proxy(strategy="body_region") decorator, which calls verify_stripe_signature(request) before the view runs. See region_proxy.py line 130.

[github-actions]

🎭 Playwright report · View test results →

⚠️ 1 flaky test:

• Creating a SQL insight with a variable and overriding it on a dashboard (chromium)

These issues are not necessarily caused by your changes.
Annoyed by this comment? Help fix flakies and failures and it'll disappear!

[MattBro]

Closing - will reopen with just the error logging change, without the version check removal.