Get the POS permission manifest
Returns the product’s declared permission CATALOGUE: every pos.* key this backend can enforce, a one-line English description of each, and the optional role bundles that group them. It is the vocabulary, never an assignment — it says which permissions EXIST, not who holds any of them, which is why it needs no credential at all: this is the only operation in the API that takes no bearer token.
Reach for it to EXPLAIN a permission — to turn the x-required-permissions on an operation, or a key returned by whoami, into a human sentence, or to enumerate what could be granted. Do NOT reach for it to decide what you may do: whoami answers that, and a key appearing here says nothing about your own grants. Because it is static configuration that changes only when the product ships a new catalogue version, fetch it at most once and cache it against version.
version is the semver of the CATALOGUE, unrelated to the API version. A key present here may still not be grantable yet in the IAM console — enforcement deliberately leads the federated snapshot — so treat this as the authoritative list of what this backend understands, not of what an operator can currently assign.