The non-creator party can push a proposed milestone back with a note describing what needs to change.
Status becomes changes_requested. The creator can then edit and resubmit.
JWT access token obtained from /auth-verify (login context) or /auth-signup. Set the bearer_token environment variable in your API client to apply it globally.