> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Get the POS permission manifest > Returns the product's declared permission CATALOGUE: every `pos.*` key this backend can enforce, a one-line English description of each, and the optional role bundles that group them. It is the vocabulary, never an assignment — it says which permissions EXIST, not who holds any of them, which is why it needs no credential at all: this is the only operation in the API that takes no bearer token. Reach for it to EXPLAIN a permission — to turn the `x-required-permissions` on an operation, or a key returned by `whoami`, into a human sentence, or to enumerate what could be granted. Do NOT reach for it to decide what you may do: `whoami` answers that, and a key appearing here says nothing about your own grants. Because it is static configuration that changes only when the product ships a new catalogue version, fetch it at most once and cache it against `version`. `version` is the semver of the CATALOGUE, unrelated to the API version. A key present here may still not be grantable yet in the IAM console — enforcement deliberately leads the federated snapshot — so treat this as the authoritative list of what this backend understands, not of what an operator can currently assign. ## OpenAPI ````yaml /openapi.json get /v1/permissions/manifest openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/permissions/manifest: get: tags: - Auth summary: Get the POS permission manifest description: >- Returns the product's declared permission CATALOGUE: every `pos.*` key this backend can enforce, a one-line English description of each, and the optional role bundles that group them. It is the vocabulary, never an assignment — it says which permissions EXIST, not who holds any of them, which is why it needs no credential at all: this is the only operation in the API that takes no bearer token. Reach for it to EXPLAIN a permission — to turn the `x-required-permissions` on an operation, or a key returned by `whoami`, into a human sentence, or to enumerate what could be granted. Do NOT reach for it to decide what you may do: `whoami` answers that, and a key appearing here says nothing about your own grants. Because it is static configuration that changes only when the product ships a new catalogue version, fetch it at most once and cache it against `version`. `version` is the semver of the CATALOGUE, unrelated to the API version. A key present here may still not be grantable yet in the IAM console — enforcement deliberately leads the federated snapshot — so treat this as the authoritative list of what this backend understands, not of what an operator can currently assign. operationId: getPermissionManifest responses: '200': description: The permission catalogue, served verbatim. content: application/json: schema: type: object properties: product: type: string description: The owning product — always `pos` for this backend. version: type: string description: Semver of the CATALOGUE, not of the API. permissions: type: array items: type: object properties: key: type: string description: The `pos.*` permission key, e.g. `pos.catalog.view`. description: type: string description: Short English explanation, for an admin UI. required: - key - description additionalProperties: false roles: type: array items: type: object properties: key: type: string displayName: type: string description: type: string permissions: type: array items: type: string required: - key - permissions additionalProperties: false required: - product - version - permissions additionalProperties: false description: The permission catalogue, served verbatim. example: product: pos version: 2.3.0 permissions: - key: pos.catalog.view description: Browse the product catalogue. - key: pos.catalog.manage description: Create and edit catalogue entries. roles: - key: cashier displayName: Cashier permissions: - pos.checkout.operate '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. ````