iRetail PRO store node 1.0.0-m1: approvals
1 operations
← All documentation · Source: contracts openapi/store-v1.yaml at 8000474.
← iRetail PRO store node 1.0.0-m1
Operations
POST
/v1/approvals
A senior employee's one-time approval for a permission in this context (spec/RBAC.md).
From a workplace only, a register's, a handheld's or a back office's token or an employee's session on one (403 forbidden, details principal workplace, otherwise); the approver's PIN counts in that device's attempts (429 too_many_requests). The token covers one request within 60 seconds for the same permission, store, workplace and a value no higher; one approved without a value covers only a request without one.
operationId
approve
Parameters
| Name | In | Type | Description |
|---|---|---|---|
IRetail-App
|
header | string |
Which app sends the request, at which version: <app>/<version>, optionally a space and (<platform>), as cashier/1.2.0 (windows-x64) or manager/1.2.0 (web). The register (cashier), the back office and the console (manager) and the device gateway (gateway) send it on every request; a request without it is not one of the apps and is served as the current API, and a device token of an app's kind without it is an app of an unknown version; a header that does not parse counts as absent. The node may refuse an app 426 app_update_required by it, except on the operations marked x-app-update-exempt. Not a security boundary (spec/API.md, Transport; spec/RELEASES.md, Who is asking). |
Request body required
application/jsonApprovalRequest
Responses
Schemas
Error object
Every error response.
error required
|
string |
Stable code, see spec/API.md. |
message required
|
string |
English text for logs. |
details
|
object |
Principal object
kind required
|
"employee" | "device" | "integration" |
|
id required
|
string (uuid) |
|
display_name required
|
string |
ApprovalRequest object
login required
|
string |
|
pin required
|
string |
|
permission required
|
string |
|
value
|
integer (int64) |
Approval object
approval_token required
|
string |
One-time, send as Approval-Token. |
expires_at required
|
string (date-time) |
|
approver required
|
Principal |