Error

A valid request URL is required to generate request examples

{
  "subjectId": "cust-1",
  "entries": [
    {
      "scope": "marketing_email",
      "status": "granted",
      "at": "2026-07-14T10:31:00.000Z",
      "source": "counter"
    }
  ],
  "history": [
    {
      "scope": "marketing_email",
      "status": "granted",
      "at": "2026-07-14T10:31:00.000Z",
      "actorId": "user-42",
      "source": "counter",
      "correlationId": "corr-8f21"
    }
  ]
}

{
  "error": {
    "code": "VALIDATION_FAILED",
    "message": "<string>",
    "statusCode": 123,
    "fieldErrors": [
      {
        "field": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

Customers

Record a customer consent decision

Appends one consent decision to the customer’s immutable trail. status picks the verb: granted records consent for the scope, withdrawn revokes it. source says where the decision was captured (counter, kiosk, web, phone) and is part of the legal record — state it truthfully. Only ever record a decision the customer actually made. Returns the recomputed record. 409 when the scope is already granted, 422 when withdrawing a scope with no active consent, 404 for a subject with no record at all. PERMISSION TRAP (solya-pos#949): the route gate accepts pos.customers.manage, but both underlying use-cases additionally assert the kernel permission config:manage, which the production Keycloak path never derives from scopes. An actor holding only the documented scope therefore passes the route guard and then fails with a bare 403 from the use-case. Treat a 403 here as a server-side grant gap, not a bad request.

POST

customers

{id}

consent

Error

A valid request URL is required to generate request examples

{
  "subjectId": "cust-1",
  "entries": [
    {
      "scope": "marketing_email",
      "status": "granted",
      "at": "2026-07-14T10:31:00.000Z",
      "source": "counter"
    }
  ],
  "history": [
    {
      "scope": "marketing_email",
      "status": "granted",
      "at": "2026-07-14T10:31:00.000Z",
      "actorId": "user-42",
      "source": "counter",
      "correlationId": "corr-8f21"
    }
  ]
}

{
  "error": {
    "code": "VALIDATION_FAILED",
    "message": "<string>",
    "statusCode": 123,
    "fieldErrors": [
      {
        "field": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

Authorizations

Authorization

string

header

required

Authorization: Bearer <token>. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same pos.* scope vocabulary the route guards enforce.

Path Parameters

string

required

Minimum string length: 1

Body

application/json

scope

enum<string>

required

Available options:

marketing_email,

marketing_sms,

loyalty_profiling,

analytics,

data_sharing

status

enum<string>

required

Available options:

granted,

withdrawn

source

enum<string>

required

Available options:

counter,

kiosk,

web,

phone

Response

The consent record after the decision was appended.

subjectId

string

required

Minimum string length: 1

entries

object[]

required

Show child attributes

history

object[]

required

Show child attributes

Get a customer's consent record Erase a customer's personal data (GDPR)

Ventes & encaissement

Catalogue & stock

Finance

Clients & fidélité

Marketing & promotions

Services

Système

Other

Record a customer consent decision

Authorizations

Path Parameters

Body

Response