Update a VAT / tax code
Replaces a tax code’s registry fields WHOLESALE — this is not a patch. ALWAYS read the tax code first, apply your change to the object you got back, and send the whole thing. An omitted field does not keep its stored value: code, label and rateBps are required (omitting one is a 400), country clears when omitted and active is OPTIONAL WITH A DEFAULT OF true — so omitting active when updating a deactivated code silently REACTIVATES it. The body’s code is required by validation but IGNORED: the path code is merged in afterwards and wins. 404s for an unknown code — updating never implicitly creates one. PERMISSION TRAP (see solya-pos#950): the route guard accepts pos.settings.manage, but the use-case additionally asserts the kernel config:manage permission.
Authorizations
Authorization: Bearer <token>. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same pos.* scope vocabulary the route guards enforce.
Path Parameters
1Body
Response
The tax code as it now stands in the registry.

