POS API: 200ms p95 SLA target. Rate limit: 500 requests/min (fixed window). Authenticates via X-Api-Key header or client_credentials JWT Bearer token. POST /pos/api/v1/baskets is idempotent on pos_transaction_id.