> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # List rentals > Returns the rental book as a flat array, NEWEST-RENTED FIRST, with no pagination — every matching rental is in one reply. Reach for this to answer 'what is out right now', 'what is late' or to FIND a rental id; when you already hold an id use `getRental`. Narrow with `status` — `active` (unit is out, still within `dueAt`), `overdue` (an `active` rental a human has flagged as late; see `markRentalOverdue`, it is NOT applied automatically) or `returned` (closed out and settled) — and with `store` (the store the rental was OPENED in). WARNING: omitting `store` returns rentals from EVERY store, not just the caller's; always pass it unless you truly want the estate-wide book. Reading the true late set means `status=active` plus a `period.dueAt` comparison of your own, because an unflagged late rental is still `active`. No match is an empty array (200), never a 404. ## OpenAPI ````yaml /openapi.json get /v1/rentals openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/rentals: get: tags: - Rentals summary: List rentals description: >- Returns the rental book as a flat array, NEWEST-RENTED FIRST, with no pagination — every matching rental is in one reply. Reach for this to answer 'what is out right now', 'what is late' or to FIND a rental id; when you already hold an id use `getRental`. Narrow with `status` — `active` (unit is out, still within `dueAt`), `overdue` (an `active` rental a human has flagged as late; see `markRentalOverdue`, it is NOT applied automatically) or `returned` (closed out and settled) — and with `store` (the store the rental was OPENED in). WARNING: omitting `store` returns rentals from EVERY store, not just the caller's; always pass it unless you truly want the estate-wide book. Reading the true late set means `status=active` plus a `period.dueAt` comparison of your own, because an unflagged late rental is still `active`. No match is an empty array (200), never a 404. operationId: listRentals parameters: - schema: type: string minLength: 1 in: query name: store required: false - schema: type: string enum: - active - returned - overdue in: query name: status required: false responses: '200': description: >- The matching rentals, newest-rented first (empty array when none match). content: application/json: schema: type: array items: type: object properties: id: type: string skuId: type: string customerId: type: string storeId: type: string period: type: object properties: startAt: type: string dueAt: type: string required: - startAt - dueAt additionalProperties: false days: anyOf: - type: number enum: - 1 - type: number enum: - 3 - type: number enum: - 7 - type: number enum: - 14 ratePerDayCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 depositAmountCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 depositReference: type: string status: type: string enum: - active - returned - overdue settlement: type: object properties: returnedAt: type: string condition: type: string enum: - conforme - dommage lateFeeCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 damageRetentionCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 releasedDepositCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 required: - returnedAt - condition - lateFeeCents - damageRetentionCents - releasedDepositCents additionalProperties: false actorId: type: string rentedAt: type: string required: - id - skuId - customerId - storeId - period - days - ratePerDayCents - depositAmountCents - depositReference - status - actorId - rentedAt additionalProperties: false description: >- The matching rentals, newest-rented first (empty array when none match). example: - id: rnt-2030-000184 skuId: >- 6b1f0c93a4d7e28150c3af6b9d24e70f8a5c1b3e6d90f27a4c8b5e1d3f7a9c02 customerId: cust-1 storeId: shop-1 period: startAt: '2030-01-01T09:00:00.000Z' dueAt: '2030-01-04T09:00:00.000Z' days: 3 ratePerDayCents: 640 depositAmountCents: 4000 depositReference: PREAUTH-4821 status: active actorId: user-associate-1 rentedAt: '2030-01-01T09:00:00.000Z' '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: No valid credential was presented — send a bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The actor is authenticated but lacks the required `pos.*` scope. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- `Authorization: Bearer `. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same `pos.*` scope vocabulary the route guards enforce. ````