> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Evaluate the active promotion rules against a cart > DRY-RUN: loads every rule whose validity window contains the current instant, runs them against the cart snapshot you pass, and returns the best NON-CONFLICTING set of outcomes. Writes nothing and does not touch the cart — it answers 'what would this basket earn automatically?'. Two rules that claim the same SKU conflict, and only the more valuable one survives, so the reply is a selection, not the sum of everything that matched. Use it to preview or verify an offer's effect on a concrete basket, or to explain a till total; do NOT use it to grant a reduction — `POST /v1/checkout/finalize` re-computes promotions server-side and is the only thing that makes them real. Cart money is integer cents; `applied[].benefitCents` is a positive magnitude while `discountLines[].amountCents` is SIGNED (`<= 0`) so a breakdown sums straight into a total. Scope gotcha (tracked as solya-pos#943): despite being the till's read path, this rides the back-office `pos.promotion.manage` scope, so a plain cashier token holding only `pos.checkout.operate` is refused 403 at the router gate. In practice `pos.promotion.manage` is the grant that works here. ## OpenAPI ````yaml /openapi.json post /v1/promotions/evaluate openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/promotions/evaluate: post: tags: - Promotions summary: Evaluate the active promotion rules against a cart description: >- DRY-RUN: loads every rule whose validity window contains the current instant, runs them against the cart snapshot you pass, and returns the best NON-CONFLICTING set of outcomes. Writes nothing and does not touch the cart — it answers 'what would this basket earn automatically?'. Two rules that claim the same SKU conflict, and only the more valuable one survives, so the reply is a selection, not the sum of everything that matched. Use it to preview or verify an offer's effect on a concrete basket, or to explain a till total; do NOT use it to grant a reduction — `POST /v1/checkout/finalize` re-computes promotions server-side and is the only thing that makes them real. Cart money is integer cents; `applied[].benefitCents` is a positive magnitude while `discountLines[].amountCents` is SIGNED (`<= 0`) so a breakdown sums straight into a total. Scope gotcha (tracked as solya-pos#943): despite being the till's read path, this rides the back-office `pos.promotion.manage` scope, so a plain cashier token holding only `pos.checkout.operate` is refused 403 at the router gate. In practice `pos.promotion.manage` is the grant that works here. operationId: evaluatePromotions requestBody: required: true content: application/json: schema: type: object properties: cart: type: object properties: lines: type: array items: type: object properties: id: type: string minLength: 1 skuId: nullable: true type: string pattern: ^[0-9a-f]{64}$ quantity: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 unitPrice: type: integer minimum: 0 maximum: 9007199254740991 vatRate: type: number minimum: 0 maximum: 100 free: type: boolean required: - id - skuId - quantity - unitPrice - vatRate - free freeLineSequence: type: integer minimum: 0 maximum: 9007199254740991 required: - lines - freeLineSequence required: - cart example: cart: lines: - id: line-1 skuId: >- 2f0a30932a471a86d885382399c476bc17fde6e613c42a73e2cf6a760fe4f774 quantity: 2 unitPrice: 1990 vatRate: 20 free: false - id: line-2 skuId: >- 9c1d4b7e0a3f6852cd41e0b7a26f5d98314c7ae60b2f9d51a83c604e7fb21d3a quantity: 1 unitPrice: 1200 vatRate: 20 free: false freeLineSequence: 0 responses: '200': description: >- The selected non-conflicting outcomes and the total benefit in cents. content: application/json: schema: type: object properties: applied: type: array items: type: object properties: ruleId: type: string ruleType: type: string enum: - bogo - threshold - bundle benefitCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 discountLines: type: array items: type: object properties: skuId: type: string quantity: type: integer minimum: -9007199254740991 maximum: 9007199254740991 amountCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 required: - skuId - quantity - amountCents additionalProperties: false claimedSkuIds: type: array items: type: string required: - ruleId - ruleType - benefitCents - discountLines - claimedSkuIds additionalProperties: false totalBenefitCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 required: - applied - totalBenefitCents additionalProperties: false description: >- The selected non-conflicting outcomes and the total benefit in cents. example: applied: - ruleId: promo-threshold-tshirt ruleType: threshold benefitCents: 398 discountLines: - skuId: >- 2f0a30932a471a86d885382399c476bc17fde6e613c42a73e2cf6a760fe4f774 quantity: 2 amountCents: -398 claimedSkuIds: - >- 2f0a30932a471a86d885382399c476bc17fde6e613c42a73e2cf6a760fe4f774 totalBenefitCents: 398 '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: No valid credential was presented — send a bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The actor is authenticated but lacks the required `pos.*` scope. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- `Authorization: Bearer `. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same `pos.*` scope vocabulary the route guards enforce. ````