> ## Documentation Index > Fetch the complete documentation index at: https://docs-pos.solya.app/llms.txt > Use this file to discover all available pages before exploring further. # Provision a team member > Adds one staff account to the directory. This PROVISIONS a person who can sign in, so only call it on an explicit instruction naming the individual — never to 'fill in' a directory. Unlike the customer and product creates, `id` is REQUIRED and chosen by YOU: nothing is minted server-side. Pick a stable, human-meaningful id (the directory uses `user-`) and check it first with `getTeamMember` — an id that already exists is a 409 CONFLICT, never an overwrite, so a duplicate is safe but wasted. `email` must be a valid address (it is the account's contact), `role` is a free-text label with no enforced vocabulary (match the labels the directory already uses — a typo silently creates a new role facet), and `store` is a display label for the store or network the account is scoped to. `active` defaults to `true`: the account may sign in the moment this returns. There is NO delete endpoint — the only way back is `updateTeamMember` with `active: false`. PERMISSION TRAP (solya-pos#950): `x-required-permissions` says `pos.team.manage`, and that is what the router gate checks — but the use-case behind it additionally asserts the kernel permission `config:manage`, and the scope-to-kernel table (`SCOPE_KERNEL_PERMISSIONS`) maps `pos.team.manage` to NOTHING. A token-authenticated actor holding exactly the documented scope therefore passes the gate and then fails with a bare 403 from inside the use-case. Read a 403 here as a server-side grant gap, not as a malformed request, and do not retry it with a different body. ## OpenAPI ````yaml /openapi.json post /v1/team openapi: 3.0.3 info: title: Solya POS API version: 1.0.0 description: >- The Solya POS backend HTTP surface. Every documented operation is agent-ready: it carries an `operationId`, an agent-facing `description`, the `pos.*` scopes it enforces (`x-required-permissions`) and an `x-agent-tier`. Success responses return the payload as raw JSON; failures return the `ErrorResponse` envelope (`{ error: { code, message, statusCode } }`). servers: - url: / description: The backend, relative to its deployed origin. security: [] paths: /v1/team: post: tags: - Team summary: Provision a team member description: >- Adds one staff account to the directory. This PROVISIONS a person who can sign in, so only call it on an explicit instruction naming the individual — never to 'fill in' a directory. Unlike the customer and product creates, `id` is REQUIRED and chosen by YOU: nothing is minted server-side. Pick a stable, human-meaningful id (the directory uses `user-`) and check it first with `getTeamMember` — an id that already exists is a 409 CONFLICT, never an overwrite, so a duplicate is safe but wasted. `email` must be a valid address (it is the account's contact), `role` is a free-text label with no enforced vocabulary (match the labels the directory already uses — a typo silently creates a new role facet), and `store` is a display label for the store or network the account is scoped to. `active` defaults to `true`: the account may sign in the moment this returns. There is NO delete endpoint — the only way back is `updateTeamMember` with `active: false`. PERMISSION TRAP (solya-pos#950): `x-required-permissions` says `pos.team.manage`, and that is what the router gate checks — but the use-case behind it additionally asserts the kernel permission `config:manage`, and the scope-to-kernel table (`SCOPE_KERNEL_PERMISSIONS`) maps `pos.team.manage` to NOTHING. A token-authenticated actor holding exactly the documented scope therefore passes the gate and then fails with a bare 403 from inside the use-case. Read a 403 here as a server-side grant gap, not as a malformed request, and do not retry it with a different body. operationId: createTeamMember requestBody: required: true content: application/json: schema: type: object properties: id: type: string minLength: 1 name: type: string minLength: 1 email: type: string format: email pattern: >- ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ role: type: string minLength: 1 store: type: string minLength: 1 active: default: true type: boolean required: - id - name - email - role - store example: id: user-camille name: Camille Vendeur email: camille.vendeur@rivoli-retail.fr role: cashier store: Boutique Pilote active: true responses: '201': description: The provisioned account, echoed back exactly as stored. content: application/json: schema: type: object properties: id: type: string minLength: 1 name: type: string minLength: 1 email: type: string format: email pattern: >- ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ role: type: string minLength: 1 store: type: string minLength: 1 active: type: boolean required: - id - name - email - role - store - active additionalProperties: false description: The provisioned account, echoed back exactly as stored. example: id: user-camille name: Camille Vendeur email: camille.vendeur@rivoli-retail.fr role: cashier store: Boutique Pilote active: true '400': description: >- The request failed schema validation; `error.fieldErrors` lists the fields. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: No valid credential was presented — send a bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: The actor is authenticated but lacks the required `pos.*` scope. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: >- The request conflicts with current state (duplicate id or stale version). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: An unexpected server error — safe to retry idempotent requests. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: ValidationErrorResponse: type: object required: - error additionalProperties: false description: >- A `VALIDATION_FAILED` envelope carrying the offending fields in `fieldErrors`. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED message: type: string statusCode: type: integer fieldErrors: type: array description: >- One entry per rejected field: the field path and why it was rejected. items: type: object required: - field - message additionalProperties: false properties: field: type: string description: Dot-path of the offending field. message: type: string description: Why the field was rejected. ErrorResponse: type: object required: - error additionalProperties: false description: The uniform failure envelope every non-2xx response returns. properties: error: type: object required: - code - message - statusCode additionalProperties: false properties: code: type: string enum: - VALIDATION_FAILED - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - BUSINESS_RULE_VIOLATION - INTERNAL_ERROR description: >- Machine-readable kernel `ResultCode` — branch on this, not on `message`. message: type: string description: >- Human-readable explanation. Safe to surface; never leaks server internals. statusCode: type: integer description: >- The HTTP status, mirrored into the body so a client need not read headers. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- `Authorization: Bearer `. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same `pos.*` scope vocabulary the route guards enforce. ````