Get a team member's effective permissions
Resolves the kernel permissions (capabilities/habilitations) a member EFFECTIVELY holds — the real RBAC resolution over their role assignments + the role catalog, unioned across the covering scopes. This is what the directory role label only APPROXIMATES: reach for this (not getTeamMember) to know what an account can actually do. Pass ?storeId= to resolve at one store’s scope; omit it to resolve network-wide (a franchise grant covers every store). Returns { actorId, scope, permissions } with kernel keys like sale:refund or config:manage; empty when no covering grant. Note (#926): grants live in an in-memory store today (durable per-scope persistence deferred), so a DB deployment starts empty.
Authorizations
Authorization: Bearer <token>. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same pos.* scope vocabulary the route guards enforce.
Path Parameters
The team-member id to act on, e.g. user-julie.
1Query Parameters
Resolve the effective permissions at ONE store's scope; omit to resolve network-wide (franchise scope). A franchise grant covers every store; a store grant only that store.
1
