A valid request URL is required to generate request examples{
"actorId": "user-julie",
"roleId": "cashier",
"scope": {
"level": "franchise",
"franchiseId": "solya"
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123,
"fieldErrors": [
{
"field": "<string>",
"message": "<string>"
}
]
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}Assign a scoped role to a team member
GRANTS one built-in RBAC role (owner / manager / cashier / viewer) to a member at an access scope — the REAL per-scope assignment the directory role label flattens. roleId is the built-in role id (NOT the free-text directory label); storeId narrows the grant to one store, and omitting it grants network-wide (the whole franchise, which covers every store). This widens what the account can do, so it is a security-posture change: only ever call it on an explicit instruction, never to ‘fix’ a missing permission. Idempotent-by-conflict: an identical (role, scope) is a 409. Every reference is checked against the live directory: an unknown roleId, an unknown memberId or an unknown storeId is a 404 and NOTHING is written — an orphan grant would be inherited by whoever is later created under the same id.
A valid request URL is required to generate request examples{
"actorId": "user-julie",
"roleId": "cashier",
"scope": {
"level": "franchise",
"franchiseId": "solya"
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123,
"fieldErrors": [
{
"field": "<string>",
"message": "<string>"
}
]
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}Authorizations
Authorization: Bearer <token>. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same pos.* scope vocabulary the route guards enforce.
Path Parameters
The team-member id to act on, e.g. user-julie.
1