> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Preview a coupon against a basket total > READ-ONLY preview: resolves the presented `code`, checks it against the basket at the current instant (validity window, remaining redemptions, `minBasketCents` floor) and returns the discount it WOULD grant, in cents. Writes nothing and consumes no redemption — `POST /v1/checkout/finalize` is what actually redeems a code. Use it to answer 'does this code work on this basket, and for how much?' before committing a sale. `basketCents` is the basket total in integer cents. A code that does not exist (or was deactivated) gives 404; a code that exists but is expired, exhausted or below the basket floor gives 422 with the reason in `error.message` — treat 422 as 'the customer presented a real but unusable code', not as a malformed request. SCOPE TRAP (tracked as solya-pos#950): the router gate is `pos.checkout.operate`, which is what `x-required-permissions` reports, but that scope is NOT sufficient. The use-case additionally asserts the kernel permission `discount:apply`, and a Keycloak principal derives its kernel permissions solely from its scopes — `pos.checkout.operate` maps to `[sale:create, drawer:open, report:view]`, which does not include it. A token holding exactly `pos.checkout.operate` therefore passes the router and then 403s INSIDE the use-case. To call this today the principal needs a scope that does derive `discount:apply` — `pos.promotion.manage` or `pos.loyalty.manage`. Treat a 403 here as a missing grant, not a bad code. ## OpenAPI ````yaml /openapi.json post /v1/coupons/validate openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/coupons/validate: post: tags: - Promotions summary: Preview a coupon against a basket total description: >- READ-ONLY preview: resolves the presented `code`, checks it against the basket at the current instant (validity window, remaining redemptions, `minBasketCents` floor) and returns the discount it WOULD grant, in cents. Writes nothing and consumes no redemption — `POST /v1/checkout/finalize` is what actually redeems a code. Use it to answer 'does this code work on this basket, and for how much?' before committing a sale. `basketCents` is the basket total in integer cents. A code that does not exist (or was deactivated) gives 404; a code that exists but is expired, exhausted or below the basket floor gives 422 with the reason in `error.message` — treat 422 as 'the customer presented a real but unusable code', not as a malformed request. SCOPE TRAP (tracked as solya-pos#950): the router gate is `pos.checkout.operate`, which is what `x-required-permissions` reports, but that scope is NOT sufficient. The use-case additionally asserts the kernel permission `discount:apply`, and a Keycloak principal derives its kernel permissions solely from its scopes — `pos.checkout.operate` maps to `[sale:create, drawer:open, report:view]`, which does not include it. A token holding exactly `pos.checkout.operate` therefore passes the router and then 403s INSIDE the use-case. To call this today the principal needs a scope that does derive `discount:apply` — `pos.promotion.manage` or `pos.loyalty.manage`. Treat a 403 here as a missing grant, not a bad code. operationId: validateCoupon requestBody: required: true content: application/json: schema: type: object properties: code: type: string minLength: 1 basketCents: type: integer minimum: 0 maximum: 9007199254740991 required: - code - basketCents example: code: SAVE10 basketCents: 5000 responses: '200': description: The eligible coupon and the discount it would grant for this basket. content: application/json: schema: type: object properties: couponId: type: string minLength: 1 code: type: string minLength: 1 discountType: type: string enum: - percentage - fixed discountAmountCents: type: integer minimum: 0 maximum: 9007199254740991 required: - couponId - code - discountType - discountAmountCents additionalProperties: false description: >- The eligible coupon and the discount it would grant for this basket. example: couponId: cpn-7f3a91c2 code: SAVE10 discountType: percentage discountAmountCents: 500 '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: No valid credential was presented — send a bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The actor is authenticated but lacks the required `pos.*` scope. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: No resource matches the addressed identifier. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '422': description: The request is well-formed but violates a domain rule. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- `Authorization: Bearer `. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same `pos.*` scope vocabulary the route guards enforce. ````