> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Record a customer consent decision > Appends one consent decision to the customer's immutable trail. `status` picks the verb: `granted` records consent for the `scope`, `withdrawn` revokes it. `source` says where the decision was captured (`counter`, `kiosk`, `web`, `phone`) and is part of the legal record — state it truthfully. Only ever record a decision the customer actually made. Returns the recomputed record. 409 when the scope is already granted, 422 when withdrawing a scope with no active consent, 404 for a subject with no record at all. PERMISSION TRAP (solya-pos#949): the route gate accepts `pos.customers.manage`, but both underlying use-cases additionally assert the kernel permission `config:manage`, which the production Keycloak path never derives from scopes. An actor holding only the documented scope therefore passes the route guard and then fails with a bare 403 from the use-case. Treat a 403 here as a server-side grant gap, not a bad request. ## OpenAPI ````yaml /openapi.json post /v1/customers/{id}/consent openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/customers/{id}/consent: post: tags: - Customers summary: Record a customer consent decision description: >- Appends one consent decision to the customer's immutable trail. `status` picks the verb: `granted` records consent for the `scope`, `withdrawn` revokes it. `source` says where the decision was captured (`counter`, `kiosk`, `web`, `phone`) and is part of the legal record — state it truthfully. Only ever record a decision the customer actually made. Returns the recomputed record. 409 when the scope is already granted, 422 when withdrawing a scope with no active consent, 404 for a subject with no record at all. PERMISSION TRAP (solya-pos#949): the route gate accepts `pos.customers.manage`, but both underlying use-cases additionally assert the kernel permission `config:manage`, which the production Keycloak path never derives from scopes. An actor holding only the documented scope therefore passes the route guard and then fails with a bare 403 from the use-case. Treat a 403 here as a server-side grant gap, not a bad request. operationId: recordCustomerConsent parameters: - schema: type: string minLength: 1 in: path name: id required: true requestBody: required: true content: application/json: schema: type: object properties: scope: type: string enum: - marketing_email - marketing_sms - loyalty_profiling - analytics - data_sharing status: type: string enum: - granted - withdrawn source: type: string enum: - counter - kiosk - web - phone required: - scope - status - source example: scope: marketing_email status: granted source: counter responses: '201': description: The consent record after the decision was appended. content: application/json: schema: type: object properties: subjectId: type: string minLength: 1 entries: type: array items: type: object properties: scope: type: string enum: - marketing_email - marketing_sms - loyalty_profiling - analytics - data_sharing status: type: string enum: - granted - withdrawn at: type: string source: type: string enum: - counter - kiosk - web - phone required: - scope - status - at - source additionalProperties: false history: type: array items: type: object properties: scope: type: string enum: - marketing_email - marketing_sms - loyalty_profiling - analytics - data_sharing status: type: string enum: - granted - withdrawn at: type: string actorId: type: string minLength: 1 source: type: string enum: - counter - kiosk - web - phone correlationId: type: string minLength: 1 required: - scope - status - at - actorId - source - correlationId additionalProperties: false required: - subjectId - entries - history additionalProperties: false description: The consent record after the decision was appended. example: subjectId: cust-1 entries: - scope: marketing_email status: granted at: '2026-07-14T10:31:00.000Z' source: counter history: - scope: marketing_email status: granted at: '2026-07-14T10:31:00.000Z' actorId: user-42 source: counter correlationId: corr-8f21 '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: No valid credential was presented — send a bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The actor is authenticated but lacks the required `pos.*` scope. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: No resource matches the addressed identifier. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: >- The request conflicts with current state (duplicate id or stale version). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '422': description: The request is well-formed but violates a domain rule. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- `Authorization: Bearer `. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same `pos.*` scope vocabulary the route guards enforce. ````