> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Get a team member's effective permissions > Resolves the kernel permissions (capabilities/habilitations) a member EFFECTIVELY holds — the real RBAC resolution over their role assignments + the role catalog, unioned across the covering scopes. This is what the directory `role` label only APPROXIMATES: reach for this (not `getTeamMember`) to know what an account can actually do. Pass `?storeId=` to resolve at one store's scope; omit it to resolve network-wide (a franchise grant covers every store). Returns `{ actorId, scope, permissions }` with kernel keys like `sale:refund` or `config:manage`; empty when no covering grant. Note (#926): grants live in an in-memory store today (durable per-scope persistence deferred), so a DB deployment starts empty. ## OpenAPI ````yaml /openapi.json get /v1/team/{memberId}/permissions openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/team/{memberId}/permissions: get: tags: - Team summary: Get a team member's effective permissions description: >- Resolves the kernel permissions (capabilities/habilitations) a member EFFECTIVELY holds — the real RBAC resolution over their role assignments + the role catalog, unioned across the covering scopes. This is what the directory `role` label only APPROXIMATES: reach for this (not `getTeamMember`) to know what an account can actually do. Pass `?storeId=` to resolve at one store's scope; omit it to resolve network-wide (a franchise grant covers every store). Returns `{ actorId, scope, permissions }` with kernel keys like `sale:refund` or `config:manage`; empty when no covering grant. Note (#926): grants live in an in-memory store today (durable per-scope persistence deferred), so a DB deployment starts empty. operationId: getTeamMemberPermissions parameters: - schema: type: string minLength: 1 in: query name: storeId required: false description: >- Resolve the effective permissions at ONE store's scope; omit to resolve network-wide (franchise scope). A franchise grant covers every store; a store grant only that store. - schema: type: string minLength: 1 in: path name: memberId required: true description: The team-member id to act on, e.g. `user-julie`. responses: '200': description: >- The resolved effective permissions the member holds at the target scope. content: application/json: schema: type: object properties: actorId: type: string scope: type: object properties: level: type: string enum: - franchise - store franchiseId: type: string storeId: type: string required: - level - franchiseId additionalProperties: false permissions: type: array items: type: string required: - actorId - scope - permissions additionalProperties: false description: >- The resolved effective permissions the member holds at the target scope. example: actorId: user-julie scope: level: franchise franchiseId: solya permissions: - sale:create - sale:refund - sale:void - giftcard:issue - discount:apply - price:override - drawer:open - report:view - config:manage '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: No valid credential was presented — send a bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The actor is authenticated but lacks the required `pos.*` scope. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: No resource matches the addressed identifier. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- `Authorization: Bearer `. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same `pos.*` scope vocabulary the route guards enforce. ````