The configuration currently authorizes only HTTPGET, which is a read operation. Adding products to a basket changes server-side state and is performed through an OCAPI operation that usesPOST. The client ' s permitted-method list must therefore includepost.

OCAPI authorization is resource- and method-specific. Even thoughwrite_attributes: " (**) " permits all writable attributes for an otherwise authorized write request, it doesnotauthorize a missing HTTP method. The HTTP method itself must be explicitly listed in the resource configuration. Salesforce ' s OCAPI documentation identifies POST as a method used to create resources or execute actions that modify server state.

Option B changes the attribute selector but still leaves the client without POST permission, so the request remains unauthorized. Option C adds OPTIONS, which is associated with HTTP capability/CORS behavior and does not perform the basket modification.

Thus:

" methods " :[ " get " , " post " ]

allows the existing read access while also authorizing the required write operation.

Study Guide reference:Application Development — OCAPI configuration, resource permissions, HTTP methods, basket APIs, and read/write authorization.

===============