WeatherKit REST API returns 401 NOT_ENABLED although App ID and Key are enabled

Title: WeatherKit REST API returns 401 NOT_ENABLED although App ID and WeatherKit key are enabled

Body: I am integrating WeatherKit REST API for an iOS app, but every request returns:

HTTP 401 {"reason":"NOT_ENABLED"}

Configuration summary:

• The App ID has WeatherKit enabled in App Services.
• The App ID also has WeatherKit enabled in Capabilities.
• The WeatherKit key shows WeatherKit enabled in the Keys page.
• A Service ID has been created.
• The backend generates an ES256 JWT using the .p8 private key.
• The decoded JWT header and payload have been verified.

I have redacted the actual Team ID, Key ID, Bundle ID, and Service ID here for security reasons.

Test A:

• JWT header.id = TEAM_ID.SERVICE_ID
• JWT payload.iss = TEAM_ID
• JWT payload.sub = SERVICE_ID
• kid = WEATHERKIT_KEY_ID
• exp - iat = 3600 seconds

Result: HTTP 401 {"reason":"NOT_ENABLED"}

Test B:

• JWT header.id = TEAM_ID.BUNDLE_ID
• JWT payload.iss = TEAM_ID
• JWT payload.sub = BUNDLE_ID
• kid = WEATHERKIT_KEY_ID
• exp - iat = 3600 seconds

Result: HTTP 401 {"reason":"NOT_ENABLED"}

Since Apple returns NOT_ENABLED instead of INVALID_AUTH_TOKEN, the JWT appears to be structurally accepted, but WeatherKit is not enabled for the authenticated identifier/key combination.

Questions:

1. For WeatherKit REST API, should the JWT sub claim use the Service ID or the App Bundle ID?
2. What exactly causes HTTP 401 NOT_ENABLED?
3. Is there any additional WeatherKit REST API enablement required besides enabling WeatherKit on the App ID and creating a WeatherKit key?
4. Could this be an account-side entitlement propagation issue?