What the API is
- A REST API over the Fastify backend, versioned under
/v1. - Generated from the live spec — the OpenAPI 3.0 document is generated at boot
and served at
GET /openapi.json, with Swagger UI atGET /docs. Only operations that opted into documentation appear, so the served surface is intentional. - Agent-ready — every documented operation carries an
operationId, an agent-facingdescription, thepos.*scopes it enforces (x-required-permissions) and an agent-usability tier (x-agent-tier).
Start here
Authentication
Send a bearer token — a Keycloak access token or an opaque POS session token.
Making requests
Base URL, the success and error envelopes, and pagination.
Error codes
The
ResultCode → HTTP status map, and the error body shape.Agent & MCP
The agent-tier and required-permission extensions, and the discovery flow.

