Replace a team member's directory record

REPLACES a staff account’s directory record wholesale. This is NOT a patch, despite the shape: name, email, role and store are all REQUIRED, and whatever you send becomes the record. Always getTeamMember first and send the current values back for the fields you are not changing — reconstructing plausible ones silently rewrites a colleague’s row. The sharpest edge is active: it DEFAULTS TO TRUE, so omitting it RE-ENABLES a deactivated account and hands sign-in back to somebody who was deliberately locked out. Send it explicitly, every time. The path memberId is authoritative — an id in the body is discarded, so you cannot address one member and mutate another. Setting active: false is also the ONLY deactivation path: there is no delete endpoint, and this never removes a row. 404s for an unknown member (it never implicitly creates one). PERMISSION TRAP (solya-pos#950): x-required-permissions says pos.team.manage, and that is what the router gate checks — but the use-case behind it additionally asserts the kernel permission config:manage, and the scope-to-kernel table (SCOPE_KERNEL_PERMISSIONS) maps pos.team.manage to NOTHING. A token-authenticated actor holding exactly the documented scope therefore passes the gate and then fails with a bare 403 from inside the use-case. Read a 403 here as a server-side grant gap, not as a malformed request, and do not retry it with a different body.

PUT /v1/team/{memberId}

Error

A valid request URL is required to generate request examples

200

{
  "id": "user-julie",
  "name": "Julie Ferrand",
  "email": "[e-mail]",
  "role": "owner",
  "store": "Magasin Bastille",
  "active": true
}

{
  "error": {
    "code": "VALIDATION_FAILED",
    "message": "<string>",
    "statusCode": 123,
    "fieldErrors": [
      {
        "field": "<string>",
        "message": "<string>"
      }
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

{
  "error": {
    "message": "<string>",
    "statusCode": 123
  }
}

Authorizations

Authorization · string · header · required

Authorization: Bearer <token>. Accepts EITHER a Keycloak access token (scopes-in-token) OR an opaque POS session token; both resolve to the same pos.* scope vocabulary the route guards enforce.

Path Parameters

memberId · string · required

Minimum string length: 1

Body

application/json

name · string · required

Minimum string length: 1

email · string<email> · required

Pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$

role · string · required

Minimum string length: 1

store · string · required

Minimum string length: 1

active · boolean · default: true

Response

200

application/json

The replaced record: the path id plus exactly the fields you sent.

The replaced record: the path id plus exactly the fields you sent.

id · string · required

Minimum string length: 1

name · string · required

Minimum string length: 1

email · string<email> · required

Pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$

role · string · required

Minimum string length: 1

store · string · required

Minimum string length: 1

active · boolean · required