> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Accept team invitation
> Requires the invited user, authenticated with a verified Firebase ID token (no existing team required) or a signed user-scoped MCP token. Ordinary API/OAuth keys are refused. Tokens remain secret and must come from the invitation link. Administrator acceptance requires completed owner approval bound to this invitation and current owner authority. The recipient must have a current active Auth account with matching email; administrator acceptance requires verified email. Missing approval returns account_approval_required; request owner recovery with existing_invitation_id.
## OpenAPI
````yaml openapi.json POST /teams/invitations/accept
openapi: 3.0.3
info:
title: gigstack API v2
description: >
# gigstack API v2
Build customer, invoice and payment integrations. Start with the
[quickstart](https://docs.gigstack.io/quickstart), then select the [issuing
country](https://docs.gigstack.io/concepts/shared-fields).
## Authentication and environments
Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use
https://api.gigstack.io/v2. Internal staging uses
https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test
mode is a data mode within an environment; a body field does not switch a
key's mode.
See [authentication](https://docs.gigstack.io/authentication) for key
handling, OAuth team scope and gigstack Connect. Internal partner
provisioning is outside this public contract; health probes have their own
security declarations. Operations marked unavailable have no configured
public gateway route.
## Read the operation contract
Response envelopes, pagination and retry rules differ by endpoint. HTTP
success alone does not prove external fiscal completion or movement of
money. Reconcile ambiguous writes before retrying. Use [responses and
recovery](https://docs.gigstack.io/responses) and the operation's error
codes; document credits and daily limits are not generic retryable rate
limits.
The issuing team's configuration selects Mexico or Colombia; customer
country and currency do not. Read
[Mexico](https://docs.gigstack.io/countries/mexico) or
[Colombia](https://docs.gigstack.io/countries/colombia) before choosing
fiscal fields. Accepted public input differs from a provider's direct
payload.
Examples and schema checks do not imply every operation has been executed
live. [Verification coverage](https://docs.gigstack.io/verification)
distinguishes source review, offline checks and observed staging behavior.
Documentation describes operations and does not authorize execution.
version: 2.0.0
contact:
name: Gigstack API Support
url: https://gigstack.io
email: support@gigstack.io
license:
name: Proprietary
url: https://gigstack.io/terms
termsOfService: https://gigstack.io/terms
servers:
- url: https://api.gigstack.io/v2
description: >
Public API for standard live and test-mode keys. Test data is isolated by
the key mode
(`livemode: false`). Internal staging is a separate deployment and key
store; see
https://docs.gigstack.io/authentication#environments for its base URL.
security:
- bearerAuth: []
externalDocs:
description: Complete API Documentation & Guides
url: https://docs.gigstack.io
paths:
/teams/invitations/accept:
post:
tags:
- Teams
summary: Accept team invitation
description: >-
Requires the invited user, authenticated with a verified Firebase ID
token (no existing team required) or a signed user-scoped MCP token.
Ordinary API/OAuth keys are refused. Tokens remain secret and must come
from the invitation link. Administrator acceptance requires completed
owner approval bound to this invitation and current owner authority. The
recipient must have a current active Auth account with matching email;
administrator acceptance requires verified email. Missing approval
returns account_approval_required; request owner recovery with
existing_invitation_id.
operationId: acceptTeamInvitation
requestBody:
required: true
content:
application/json:
schema:
type: object
additionalProperties: false
properties:
token:
type: string
minLength: 1
maxLength: 16384
required:
- token
responses:
'200':
description: >-
Operation completed; inspect data for the persisted state and
external delivery status
content:
application/json:
schema:
type: object
required:
- data
properties:
data:
type: object
additionalProperties: false
properties:
id:
type: string
minLength: 1
maxLength: 128
pattern: ^[^/]+$
status:
type: string
enum:
- accepted
team_id:
type: string
nullable: true
success:
type: boolean
message:
type: string
timestamp:
type: integer
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/AuthForbidden'
'404':
description: Resource not found or outside authorized account
'409':
description: State conflict; retrieve the current resource before retrying
'500':
$ref: '#/components/responses/ServerError'
security:
- bearerAuth: []
components:
responses:
Unauthorized:
description: >
Authentication failed. Two different bodies can come back with a `401`:
1. **From the authentication layer**, before the endpoint runs: a raw
object with
`message` and — for OAuth access tokens only — `error` / `error_description`. It does
**not** use the standardized envelope (`success` and `timestamp` are absent). Messages:
`Unauthorized` (missing header, missing `Bearer ` prefix, unparseable token),
`Unauthorized, missing team in token`, `Unauthorized, not a master team` and
`Unauthorized, no matched teams` (gigstack Connect), `Invalid access token`,
`Access token has expired. Please refresh your token.`, `Access token has been revoked`.
2. **From the endpoint itself**: the standardized envelope with
`error.code: unauthorized`.
Branch on the HTTP status, not on the body shape.
content:
application/json:
schema:
anyOf:
- $ref: '#/components/schemas/AuthMiddlewareError'
- $ref: '#/components/schemas/UnauthorizedError'
examples:
missing_or_invalid_key:
summary: Authentication layer — missing or unparseable API key
value:
message: Unauthorized
oauth_token_expired:
summary: Authentication layer — expired OAuth access token
value:
message: Access token has expired. Please refresh your token.
error: token_expired
error_description: Access token has expired. Please refresh your token.
connect_not_master_team:
summary: >-
Authentication layer — `team` sent by a team without gigstack
Connect
value:
message: Unauthorized, not a master team
endpoint_envelope:
summary: Endpoint — standardized envelope
value:
success: false
error:
code: unauthorized
message: Unauthorized access
timestamp: 1767225600000
AuthForbidden:
description: >
Rejected by the authentication layer after the credential was
recognised. The body is a raw
object (`message`, sometimes `details`), **not** the standardized
envelope. Causes:
- The API key was revoked or disabled: `message: "API Key inválida."`,
`details: "Invalid API Key"`.
- The billing account's plan does not include API access. `message` is a
Spanish sentence
containing an HTML link to `https://app.gigstack.pro/memberships`. Branch on the status
code; do not display or match the text.
- gigstack Connect: the plan lacks the `multipleIssuerAccounts` feature
(Spanish message
starting `Tu plan no incluye múltiples cuentas emisoras.`), or an OAuth access token was
sent with a `team` other than its own (`Team mismatch with OAuth token`).
An endpoint may also answer `403` for its own reasons; those are
documented on the
operation when they exist.
content:
application/json:
schema:
$ref: '#/components/schemas/AuthMiddlewareError'
examples:
revoked_api_key:
summary: API key revoked or disabled
value:
message: API Key inválida.
details: Invalid API Key
plan_without_api_access:
summary: Plan does not include API access
value:
message: >-
La API se encuentra disponible para un plan más grande, por
favor actualiza tu plan aquí o ponte
en contacto con soporte.
connect_plan_without_multiple_issuers:
summary: gigstack Connect — plan lacks multipleIssuerAccounts
value:
message: >-
Tu plan no incluye múltiples cuentas emisoras. Actualiza tu
plan en https://app.gigstack.pro/memberships o ponte en
contacto con soporte para operar sobre otros equipos.
oauth_team_mismatch:
summary: gigstack Connect — OAuth token used for another team
value:
message: Team mismatch with OAuth token
ServerError:
description: >-
Unexpected server error (`error.code: internal_server_error`). The
failure is logged on gigstack's side.
content:
application/json:
schema:
$ref: '#/components/schemas/StandardErrorResponse'
example:
success: false
error:
code: internal_server_error
message: An internal server error occurred
timestamp: 1767225600000
schemas:
AuthMiddlewareError:
type: object
description: >
Raw error body produced by the authentication layer (before any endpoint
runs). It is not
the standardized envelope: there is no `success` and no `timestamp`.
required:
- message
properties:
message:
type: string
description: >-
Human-readable reason. Some messages are in Spanish; branch on the
HTTP status, not on this text.
example: Unauthorized
error:
type: string
description: >-
OAuth error code. Present only when an OAuth access token was
presented.
enum:
- invalid_token
- token_expired
- token_revoked
- server_error
example: token_expired
error_description:
type: string
description: Same text as `message`. Present only alongside `error`.
example: Access token has expired. Please refresh your token.
details:
description: >-
Extra detail, e.g. `Invalid API Key` when a revoked key is rejected
with `403`.
oneOf:
- type: string
- type: object
example: Invalid API Key
UnauthorizedError:
allOf:
- $ref: '#/components/schemas/StandardErrorResponse'
example:
success: false
error:
code: unauthorized
message: Unauthorized access
timestamp: 1767225600000
StandardErrorResponse:
type: object
description: >
Standardized error envelope emitted by `sendErrorResponse` and its
helpers
(`sendValidationError`, `sendNotFoundError`, `sendUnauthorizedError`,
`sendForbiddenError`, `sendConflictError`, `sendBadRequestError`,
`sendInternalServerError`).
required:
- success
- error
- timestamp
properties:
success:
type: boolean
enum:
- false
example: false
error:
type: object
required:
- code
- message
properties:
code:
type: string
description: >
Stable machine-readable code. Values emitted by the shared
helpers:
`unauthorized`, `forbidden`, `invalid_token`,
`validation_failed`,
`invalid_request_body`, `missing_required_field`,
`invalid_field_value`,
`resource_not_found`, `resource_already_exists`,
`resource_conflict`,
`business_rule_violation`, `operation_not_allowed`,
`insufficient_permissions`, `external_service_error`,
`payment_processor_error`, `cfdi_service_error`,
`internal_server_error`, `service_unavailable`,
`rate_limit_exceeded`,
`database_error`, `data_integrity_error`, `file_not_found`,
`file_upload_error`, `invalid_file_format`. Individual handlers
may
emit additional endpoint-specific codes, documented per
operation.
example: validation_failed
message:
type: string
example: Request validation failed
details:
oneOf:
- type: string
- type: array
items:
type: string
description: >
Present only when the handler supplies detail. Validation
failures
emit an array of `": "` strings.
example:
- 'currency: Field is required'
timestamp:
type: integer
format: int64
description: Server time in epoch milliseconds.
example: 1767225600000
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: >
**Authentication Method:** HTTP Bearer token.
The runtime requires the literal `Bearer ` prefix — a bare token in the
`Authorization` header is rejected with `401 unauthorized`.
**Header Format:** `Authorization: Bearer YOUR_API_KEY`
Your API key is a JWT. Live keys operate on live data (`livemode:
true`);
test keys operate on isolated test data (`livemode: false`).
**Get your key at:**
[app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api)
**Errors:** credential failures are answered by the authentication layer
with a raw
`{ "message": … }` body, not the standardized envelope — `401` for a
missing, malformed or
expired token, `403` for a revoked key or a plan without API access. See
the `Unauthorized`
and `AuthForbidden` responses.
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.