Six roles. Three of them cannot write.

Your account owner (merchant) and merchant_admin can call everything below. merchant_ops can do orders, shipping, NDR, warehouses, courier ranking and label settings.

merchant_finance, merchant_support and merchant_staff are read-only: any POST/PATCH/PUT/DELETE on order-ingestion is refused with 403 {"error":"Read-only role"} before the handler runs.

A write your role is not granted answers 403 {"error":"forbidden","cap":"<capability>","message":"This role does not have the <capability> permission"}. The cap names exactly what was missing.

🔴 Known gap, stated rather than hidden: shipping-service does not mount the read-only refusal, so POST /v1/shipping/book, /book/sync, /cancel and /ndr currently accept a read-only token. Treat that as a defect to be closed, not a feature to rely on.