Orders

GET /api/v1/orders and its member route require orders.read and filter by current location grants.

POST /api/v1/orders requires orders.write, a granted location, and Idempotency-Key. It creates an unpaid draft using current server-authoritative product, modifier, discount, and tax data.

The request selects products and quantities; it cannot set arbitrary totals. Draft creation does not capture payment, reserve or decrement inventory, complete a sale, or trigger fiscalization. Modifier and discount selectors exist for provisioned IDs, but no public discovery endpoints currently expose them.