A valid request URL is required to generate request examples{
"actorId": "user-julie",
"scope": {
"level": "franchise",
"franchiseId": "solya"
},
"permissions": [
"sale:create",
"sale:refund",
"sale:void",
"giftcard:issue",
"discount:apply",
"price:override",
"drawer:open",
"report:view",
"config:manage"
]
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123,
"fieldErrors": [
{
"field": "<string>",
"message": "<string>"
}
]
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}Get a team member's effective permissions
Resolves the kernel permissions (capabilities/habilitations) a member EFFECTIVELY holds — the real RBAC resolution over their role assignments + the role catalog, unioned across the covering scopes. This is what the directory role label only APPROXIMATES: reach for this (not getTeamMember) to know what an account can actually do. Pass ?storeId= to resolve at one store’s scope; omit it to resolve network-wide (a franchise grant covers every store). Returns { actorId, scope, permissions } with kernel keys like sale:refund or config:manage; empty when no covering grant. Note (#926): grants live in an in-memory store today (durable per-scope persistence deferred), so a DB deployment starts empty.
A valid request URL is required to generate request examples{
"actorId": "user-julie",
"scope": {
"level": "franchise",
"franchiseId": "solya"
},
"permissions": [
"sale:create",
"sale:refund",
"sale:void",
"giftcard:issue",
"discount:apply",
"price:override",
"drawer:open",
"report:view",
"config:manage"
]
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123,
"fieldErrors": [
{
"field": "<string>",
"message": "<string>"
}
]
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}{
"error": {
"code": "VALIDATION_FAILED",
"message": "<string>",
"statusCode": 123
}
}Authorizations
Authorization: Bearer <token>. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same pos.* scope vocabulary the route guards enforce.
Path Parameters
The team-member id to act on, e.g. user-julie.
1Query Parameters
Resolve the effective permissions at ONE store's scope; omit to resolve network-wide (franchise scope). A franchise grant covers every store; a store grant only that store.
1