To enable POS forging:

Use this in heat.properties

heat.allowedBotHosts=*
heat.allowedUserHosts=*
heat.uiServerHost=0.0.0.0
heat.apiServerHost=0.0.0.0
heat.apiKeyDisabled=true

NOTE: allowing unlimited Bot hosts and userhosts has risks if you're not sure your heat server isn't accessible to outside network. Other settings are safer and may work as well

curl http://localhost:7733/api/v1/mining/start/THIS%20IS%20THE%20PASSPHRASE

If you want to further limit access to a public server specify your apikey in heat-default.properties, set heat.apiKeyDisabled=false and add the apiKey as an (encoded) parameter to the URL

POP is combined into POS during the first blockchain slice period.