403.
Authentication
The Centrale and the Caisse sign users in through Keycloak (the identity provider). A signed-in session carries a token that the backend verifies on every request. For automated clients, the API also accepts an opaque POS token — see Authentication in the Developers guides.Permissions are scopes
Authorization is scope-based. Each permission is a string of the formpos.<domain>.<action>, for example pos.catalog.manage,
pos.inventory.read or pos.settings.manage. The backend annotates each
endpoint with the scopes it requires, and the full catalogue is available at
GET /v1/permissions/manifest.
Scopes are grouped by domain (catalogue, inventory, finance, settings, …) and
by action (typically
read vs manage). A read scope lets you view a
screen; a manage scope lets you create, edit or advance records in it.Roles
A role is a named bundle of scopes assigned to a user. Typical roles:
You manage team members and inspect their permissions from the Centrale
Team screen — see the Team guide. The
permissions panel there resolves each member’s effective scopes.
Elevation at the till
Some sensitive till actions (large discounts, certain overrides) require elevation — a manager confirms with a PIN before the action proceeds (POST /v1/auth/elevate, PIN managed via PUT /v1/auth/elevation/pin). This
keeps day-to-day cashier accounts low-privilege while still allowing supervised
exceptions.
Checking your own access
CallGET /v1/auth/whoami to see the identity and scopes attached to the current
session — useful when a screen or an API call is unexpectedly denied.