> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # Cancel retention > Cancel a stamped tax retention document with the SAT. **Cancellation motives** (SAT catalog): - `01` - Comprobante emitido con errores con relación - `02` - Comprobante emitido con errores sin relación - `03` - No se llevó a cabo la operación - `04` - Operación nominativa relacionada en una factura global **gigstack Connect:** Cancel other teams' retentions using the `team` parameter. Replaces the deprecated [`DELETE /retentions/{id}`](/reference/deleteRetentionsById), which runs the same handler and takes the same body. Some HTTP clients and proxies drop the body of a DELETE request. ## OpenAPI ````yaml openapi.json POST /retentions/{id}/cancel openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Internal partner provisioning is outside this public contract; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /retentions/{id}/cancel: post: tags: - Retentions summary: Cancel retention description: > Cancel a stamped tax retention document with the SAT. **Cancellation motives** (SAT catalog): - `01` - Comprobante emitido con errores con relación - `02` - Comprobante emitido con errores sin relación - `03` - No se llevó a cabo la operación - `04` - Operación nominativa relacionada en una factura global **gigstack Connect:** Cancel other teams' retentions using the `team` parameter. Replaces the deprecated [`DELETE /retentions/{id}`](/reference/deleteRetentionsById), which runs the same handler and takes the same body. Some HTTP clients and proxies drop the body of a DELETE request. operationId: cancelRetentionById parameters: - name: id in: path required: true schema: type: string description: Retention UUID example: 9d9b0e5b-034c-42f7-bd21-3a868a57c13e - $ref: '#/components/parameters/TeamParameter' requestBody: required: true content: application/json: schema: type: object required: - motive properties: motive: type: string description: SAT cancellation motive code enum: - '01' - '02' - '03' - '04' example: '02' replace_uuid: type: string description: UUID of replacement document (required when motive is "01") examples: cancel_with_errors: summary: Cancel — document had errors (no replacement) value: motive: '02' cancel_with_replacement: summary: Cancel — replace with new document description: Motive 01 requires the UUID of the replacement document value: motive: '01' replace_uuid: a1b2c3d4-5678-90ab-cdef-1234567890ab cancel_not_carried_out: summary: Cancel — operation not carried out value: motive: '03' responses: '200': description: Retention canceled successfully content: application/json: schema: $ref: '#/components/schemas/StandardSuccessResponse' examples: canceled: summary: Retention canceled value: message: Retention canceled successfully data: id: 9d9b0e5b-034c-42f7-bd21-3a868a57c13e uuid: 9d9b0e5b-034c-42f7-bd21-3a868a57c13e status: canceled document_type: retenciones retention_key: '26' cancellation: motive: '02' canceled_at: '2026-03-06T12:00:00.000Z' success: true timestamp: 1767225600000 '400': description: Bad request or cancellation error content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' examples: already_canceled: summary: Already canceled value: error: code: bad_request message: Retention is already canceled success: false timestamp: 1767225600000 missing_replacement: summary: Missing replacement UUID for motive 01 value: error: code: bad_request message: replace_uuid is required when motive is 01 success: false timestamp: 1767225600000 '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/AuthForbidden' '404': description: '`Retention not found`.' content: application/json: schema: $ref: '#/components/schemas/NotFoundError' example: success: false error: code: resource_not_found message: Retention not found timestamp: 1767225600000 '500': $ref: '#/components/responses/ServerError' security: - bearerAuth: [] components: parameters: TeamParameter: name: team in: query required: false schema: type: string description: > **gigstack Connect:** Target team ID for multi-team access. Requires gigstack Connect enabled on your team and shared billing account. Also requires the `multipleIssuerAccounts` feature on your plan. Requests targeting a team other than the one your API key belongs to return `403` without it. Only API keys can use it: an OAuth access token sent with another team's id is rejected with `403 Team mismatch with OAuth token`. **Optional — omit it entirely** unless you are acting on another team. It deliberately carries no example value so generated snippets do not emit `?team=undefined`; when the parameter is absent, the team is derived from your API key. **Example:** `?team=team_xyz789` schemas: StandardSuccessResponse: type: object description: | Standardized success envelope emitted by `sendSuccessResponse`. required: - success - data - timestamp properties: success: type: boolean enum: - true example: true data: type: object description: The operation payload. message: type: string description: Human-readable summary. Present only when the handler supplies one. example: Operation completed successfully timestamp: type: integer format: int64 description: Server time in **epoch milliseconds** (`Luxon.now().toMillis()`). example: 1767225600000 ValidationErrorResponse: allOf: - $ref: '#/components/schemas/StandardErrorResponse' description: > Body validation failure. Unknown top-level keys are rejected — the validator runs in strict allowlist mode (`allowUnknown: false`), so a field not declared in the request schema produces an `unexpected_key` detail rather than being ignored. example: success: false error: code: validation_failed message: Request validation failed details: - 'currency: Field is required' - 'client_id: Unexpected field' timestamp: 1767225600000 NotFoundError: allOf: - $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: resource_not_found message: Resource not found timestamp: 1767225600000 StandardErrorResponse: type: object description: > Standardized error envelope emitted by `sendErrorResponse` and its helpers (`sendValidationError`, `sendNotFoundError`, `sendUnauthorizedError`, `sendForbiddenError`, `sendConflictError`, `sendBadRequestError`, `sendInternalServerError`). required: - success - error - timestamp properties: success: type: boolean enum: - false example: false error: type: object required: - code - message properties: code: type: string description: > Stable machine-readable code. Values emitted by the shared helpers: `unauthorized`, `forbidden`, `invalid_token`, `validation_failed`, `invalid_request_body`, `missing_required_field`, `invalid_field_value`, `resource_not_found`, `resource_already_exists`, `resource_conflict`, `business_rule_violation`, `operation_not_allowed`, `insufficient_permissions`, `external_service_error`, `payment_processor_error`, `cfdi_service_error`, `internal_server_error`, `service_unavailable`, `rate_limit_exceeded`, `database_error`, `data_integrity_error`, `file_not_found`, `file_upload_error`, `invalid_file_format`. Individual handlers may emit additional endpoint-specific codes, documented per operation. example: validation_failed message: type: string example: Request validation failed details: oneOf: - type: string - type: array items: type: string - type: object description: > Present only when the handler supplies detail. Validation failures emit an array of `": "` strings. An object only where an operation documents its keys: account billing answers `409` `billing_operation_pending` with `{ "operation_id": "" }`, the operation holding the account lock, to reconcile (`POST /teams/{id}/billing/operations/{operationId}/reconcile`). example: - 'currency: Field is required' timestamp: type: integer format: int64 description: Server time in epoch milliseconds. example: 1767225600000 AuthMiddlewareError: type: object description: > Raw error body produced by the authentication layer (before any endpoint runs). It is not the standardized envelope: there is no `success` and no `timestamp`. required: - message properties: message: type: string description: >- Human-readable reason. Some messages are in Spanish; branch on the HTTP status, not on this text. example: Unauthorized error: type: string description: >- OAuth error code. Present only when an OAuth access token was presented. enum: - invalid_token - token_expired - token_revoked - server_error example: token_expired error_description: type: string description: Same text as `message`. Present only alongside `error`. example: Access token has expired. Please refresh your token. details: description: >- Extra detail, e.g. `Invalid API Key` when a revoked key is rejected with `403`. oneOf: - type: string - type: object example: Invalid API Key UnauthorizedError: allOf: - $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 responses: Unauthorized: description: > Authentication failed. Two different bodies can come back with a `401`: 1. **From the authentication layer**, before the endpoint runs: a raw object with `message` and — for OAuth access tokens only — `error` / `error_description`. It does **not** use the standardized envelope (`success` and `timestamp` are absent). Messages: `Unauthorized` (missing header, missing `Bearer ` prefix, unparseable token), `Unauthorized, missing team in token`, `Unauthorized, not a master team` and `Unauthorized, no matched teams` (gigstack Connect), `Invalid access token`, `Access token has expired. Please refresh your token.`, `Access token has been revoked`. 2. **From the endpoint itself**: the standardized envelope with `error.code: unauthorized`. Branch on the HTTP status, not on the body shape. content: application/json: schema: anyOf: - $ref: '#/components/schemas/AuthMiddlewareError' - $ref: '#/components/schemas/UnauthorizedError' examples: missing_or_invalid_key: summary: Authentication layer — missing or unparseable API key value: message: Unauthorized oauth_token_expired: summary: Authentication layer — expired OAuth access token value: message: Access token has expired. Please refresh your token. error: token_expired error_description: Access token has expired. Please refresh your token. connect_not_master_team: summary: >- Authentication layer — `team` sent by a team without gigstack Connect value: message: Unauthorized, not a master team endpoint_envelope: summary: Endpoint — standardized envelope value: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 AuthForbidden: description: > Rejected by the authentication layer after the credential was recognised. The body is a raw object (`message`, sometimes `details`), **not** the standardized envelope. Causes: - The API key was revoked or disabled: `message: "API Key inválida."`, `details: "Invalid API Key"`. - Legacy plans only: the billing account's plan does not include API access. `message` is a Spanish sentence containing an HTML link to `https://app.gigstack.pro/memberships`. Branch on the status code; do not display or match the text. Pricing v3 accounts always have API access. - gigstack Connect: the account lacks gigstack Connect (Pricing v3) or its legacy plan lacks the `multipleIssuerAccounts` feature (Spanish message; on Pricing v3 it starts `Tu cuenta no tiene gigstack Connect`, on legacy plans `Tu plan no incluye múltiples cuentas emisoras.`), or an OAuth access token was sent with a `team` other than its own (`Team mismatch with OAuth token`). An endpoint may also answer `403` for its own reasons; those are documented on the operation when they exist. content: application/json: schema: $ref: '#/components/schemas/AuthMiddlewareError' examples: revoked_api_key: summary: API key revoked or disabled value: message: API Key inválida. details: Invalid API Key plan_without_api_access: summary: Plan does not include API access value: message: >- La API se encuentra disponible para un plan más grande, por favor actualiza tu plan aquí o ponte en contacto con soporte. connect_plan_without_multiple_issuers: summary: gigstack Connect — plan lacks multipleIssuerAccounts value: message: >- Tu plan no incluye múltiples cuentas emisoras. Actualiza tu plan en https://app.gigstack.pro/memberships o ponte en contacto con soporte para operar sobre otros equipos. connect_v3_without_connect: summary: gigstack Connect — Pricing v3 account without gigstack Connect value: message: >- Tu cuenta no tiene gigstack Connect, que incluye múltiples cuentas emisoras. Actívalo en Ajustes > General > Facturación (https://app.gigstack.pro/settings?tab=general&subtab=billing) o ponte en contacto con soporte para operar sobre otros equipos. oauth_team_mismatch: summary: gigstack Connect — OAuth token used for another team value: message: Team mismatch with OAuth token ServerError: description: >- Unexpected server error (`error.code: internal_server_error`). The failure is logged on gigstack's side. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: internal_server_error message: An internal server error occurred timestamp: 1767225600000 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": … }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.