SOLVED and posting the resolution for the next person who hits this. Symptom: WeatherKit REST API returned 401 with NOT_ENABLED on every request, even though the WeatherKit capability was checked on the App ID, the entitlement was in the app, and the JWT was signed correctly with a valid key. Root cause: the App ID has WeatherKit in TWO places in the developer portal, and they are independent checkboxes. Certificates, Identifiers & Profiles -> Identifiers -> your App ID has both a "Capabilities" tab AND an "App Services" tab. WeatherKit appears on both. Ours was checked under Capabilities but NOT under App Services. The service-side flag is what the REST API checks, so everything client-side looked correct while the API kept answering NOT_ENABLED. Fix: Identifiers -> select the App ID -> App Services tab -> check WeatherKit -> Save (accept the provisioning profile invalidation; installed builds keep working and the next build regenerates profiles). Our REST calls started returning live weather within minutes, same JWT, no code changes. Credit where due: an Apple DTS engineer describes this exact one-of-two trap in thread 835229, which is how we finally found it. If you are staring at NOT_ENABLED with correct entitlements and a correct JWT, check the App Services tab before anything else.