> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Bulk-issue stored-value instruments (carte cadeau) > Mints many instruments from a batch of drafts through the SAME issue path. Each element of `instruments` is exactly an `issueGiftcard` body — `id`, `kind` (`gift_card` | `credit_note` | `store_credit`), `code`, 3-letter `currency` and a strictly positive integer `amountCents`, plus optional `customerId` and `expiresAt`. The array is typed loosely ON PURPOSE so one bad row cannot 400 the whole batch. Returns a per-row report keyed by bearer `code` (`created` / `skipped` when the id or code already exists / `failed` with a reason). Idempotent: re-posting the same batch skips the rows already issued. Invalid rows are REPORTED, not rejected — the batch still returns 200, so always read `failed` and the per-row `reason` rather than trusting the status code. The whole batch is refused with a 403 when the caller lacks the issuance right. ## OpenAPI ````yaml /openapi.json post /v1/giftcards/import openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/giftcards/import: post: tags: - Instruments summary: Bulk-issue stored-value instruments (carte cadeau) description: >- Mints many instruments from a batch of drafts through the SAME issue path. Each element of `instruments` is exactly an `issueGiftcard` body — `id`, `kind` (`gift_card` | `credit_note` | `store_credit`), `code`, 3-letter `currency` and a strictly positive integer `amountCents`, plus optional `customerId` and `expiresAt`. The array is typed loosely ON PURPOSE so one bad row cannot 400 the whole batch. Returns a per-row report keyed by bearer `code` (`created` / `skipped` when the id or code already exists / `failed` with a reason). Idempotent: re-posting the same batch skips the rows already issued. Invalid rows are REPORTED, not rejected — the batch still returns 200, so always read `failed` and the per-row `reason` rather than trusting the status code. The whole batch is refused with a 403 when the caller lacks the issuance right. operationId: importGiftcards requestBody: required: true content: application/json: schema: type: object properties: instruments: type: array items: {} description: >- The batch of issuance drafts; each element is an `issueGiftcard` body. required: - instruments example: instruments: - id: gc-2026-000142 kind: gift_card code: GC-4F2A-9B71 currency: EUR amountCents: 5000 expiresAt: '2028-01-31T23:59:59.000Z' responses: '200': description: The per-row outcome plus the created/skipped/failed totals. content: application/json: schema: type: object properties: results: type: array items: type: object properties: code: type: string status: type: string enum: - created - skipped - failed reason: type: string required: - code - status additionalProperties: false created: type: integer minimum: -9007199254740991 maximum: 9007199254740991 skipped: type: integer minimum: -9007199254740991 maximum: 9007199254740991 failed: type: integer minimum: -9007199254740991 maximum: 9007199254740991 required: - results - created - skipped - failed additionalProperties: false description: The per-row outcome plus the created/skipped/failed totals. example: results: - code: GC-4F2A-9B71 status: created created: 1 skipped: 0 failed: 0 '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: No valid credential was presented — send a bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The actor is authenticated but lacks the required `pos.*` scope. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- `Authorization: Bearer `. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same `pos.*` scope vocabulary the route guards enforce. ````