> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Claim a sandbox with the emailed code

> The person proves they read the inbox the sandbox was created for. On success the sandbox is
theirs: their email is marked verified, the test key is no longer limited to test data, and
they receive a link to set a password and sign in to app.gigstack.pro, where they can go live.
The code works once and locks after 5 wrong attempts; a sandbox locks for good after 15 wrong
attempts across re-sent codes. Every mismatch, expired or spent code answers the same
`400 invalid_or_expired_code`.

Off by default (`404 not_found`), like `POST /auth/sandbox`.




## OpenAPI

````yaml openapi.json POST /auth/sandbox/claim
openapi: 3.0.3
info:
  title: gigstack API v2
  description: >
    # gigstack API v2


    Build customer, invoice and payment integrations. Start with the
    [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing
    country](https://docs.gigstack.io/concepts/shared-fields).


    ## Authentication and environments


    Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use
    https://api.gigstack.io/v2. Internal staging uses
    https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test
    mode is a data mode within an environment; a body field does not switch a
    key's mode.


    See [authentication](https://docs.gigstack.io/authentication) for key
    handling, OAuth team scope and gigstack Connect. Internal partner
    provisioning is outside this public contract; health probes have their own
    security declarations. Operations marked unavailable have no configured
    public gateway route.


    ## Read the operation contract


    Response envelopes, pagination and retry rules differ by endpoint. HTTP
    success alone does not prove external fiscal completion or movement of
    money. Reconcile ambiguous writes before retrying. Use [responses and
    recovery](https://docs.gigstack.io/responses) and the operation's error
    codes; document credits and daily limits are not generic retryable rate
    limits.


    The issuing team's configuration selects Mexico or Colombia; customer
    country and currency do not. Read
    [Mexico](https://docs.gigstack.io/countries/mexico) or
    [Colombia](https://docs.gigstack.io/countries/colombia) before choosing
    fiscal fields. Accepted public input differs from a provider's direct
    payload.


    Examples and schema checks do not imply every operation has been executed
    live. [Verification coverage](https://docs.gigstack.io/verification)
    distinguishes source review, offline checks and observed staging behavior.
    Documentation describes operations and does not authorize execution.
  version: 2.0.0
  contact:
    name: Gigstack API Support
    url: https://gigstack.io
    email: support@gigstack.io
  license:
    name: Proprietary
    url: https://gigstack.io/terms
  termsOfService: https://gigstack.io/terms
servers:
  - url: https://api.gigstack.io/v2
    description: >
      Public API for standard live and test-mode keys. Test data is isolated by
      the key mode

      (`livemode: false`). Internal staging is a separate deployment and key
      store; see

      https://docs.gigstack.io/authentication#environments for its base URL.
security:
  - bearerAuth: []
externalDocs:
  description: Complete API Documentation & Guides
  url: https://docs.gigstack.io
paths:
  /auth/sandbox/claim:
    post:
      tags:
        - Auth
      summary: Claim a sandbox with the emailed code
      description: >
        The person proves they read the inbox the sandbox was created for. On
        success the sandbox is

        theirs: their email is marked verified, the test key is no longer
        limited to test data, and

        they receive a link to set a password and sign in to app.gigstack.pro,
        where they can go live.

        The code works once and locks after 5 wrong attempts; a sandbox locks
        for good after 15 wrong

        attempts across re-sent codes. Every mismatch, expired or spent code
        answers the same

        `400 invalid_or_expired_code`.


        Off by default (`404 not_found`), like `POST /auth/sandbox`.
      operationId: claimAgentSandbox
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              required:
                - team_id
                - code
              properties:
                team_id:
                  type: string
                  pattern: ^[A-Za-z0-9_-]{1,64}$
                  description: '`team_id` returned by `POST /auth/sandbox`.'
                code:
                  type: string
                  pattern: ^[0-9]{6}$
                  description: Six-digit code from the email.
            example:
              team_id: team_a1b2c3d4e5f6
              code: '123456'
      responses:
        '200':
          description: Sandbox claimed.
          content:
            application/json:
              schema:
                type: object
                required:
                  - success
                  - data
                  - timestamp
                properties:
                  success:
                    type: boolean
                    enum:
                      - true
                  data:
                    type: object
                    required:
                      - claimed
                      - team_id
                      - next
                    properties:
                      claimed:
                        type: boolean
                        enum:
                          - true
                      team_id:
                        type: string
                      password_email:
                        type: string
                        enum:
                          - sent
                          - failed
                        description: >-
                          Whether the set-password email was handed to the mail
                          provider. On `failed`, use "forgot password" in the
                          app.
                      next:
                        type: string
                  message:
                    type: string
                  timestamp:
                    type: integer
                    format: int64
              example:
                success: true
                data:
                  claimed: true
                  team_id: team_a1b2c3d4e5f6
                  password_email: sent
                  next: >-
                    Check your email to set your password, then go live from the
                    app
                message: Sandbox claimed
                timestamp: 1767225600000
        '400':
          description: >-
            Wrong, expired, locked or already used code
            (`invalid_or_expired_code`), or an invalid body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StandardErrorResponse'
              example:
                success: false
                error:
                  code: invalid_or_expired_code
                  message: The code is not valid for this sandbox or has expired
                timestamp: 1767225600000
        '404':
          description: Agent sandboxes are not enabled in this environment.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StandardErrorResponse'
              example:
                success: false
                error:
                  code: not_found
                  message: Not found
                timestamp: 1767225600000
        '429':
          description: >-
            Too many attempts from this IP or for this sandbox. `Retry-After`
            says when to retry.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StandardErrorResponse'
              example:
                success: false
                error:
                  code: rate_limit_exceeded
                  message: Too many claim attempts. Retry in 900 seconds.
                timestamp: 1767225600000
      security: []
components:
  schemas:
    StandardErrorResponse:
      type: object
      description: >
        Standardized error envelope emitted by `sendErrorResponse` and its
        helpers

        (`sendValidationError`, `sendNotFoundError`, `sendUnauthorizedError`,

        `sendForbiddenError`, `sendConflictError`, `sendBadRequestError`,

        `sendInternalServerError`).
      required:
        - success
        - error
        - timestamp
      properties:
        success:
          type: boolean
          enum:
            - false
          example: false
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              description: >
                Stable machine-readable code. Values emitted by the shared
                helpers:

                `unauthorized`, `forbidden`, `invalid_token`,
                `validation_failed`,

                `invalid_request_body`, `missing_required_field`,
                `invalid_field_value`,

                `resource_not_found`, `resource_already_exists`,
                `resource_conflict`,

                `business_rule_violation`, `operation_not_allowed`,

                `insufficient_permissions`, `external_service_error`,

                `payment_processor_error`, `cfdi_service_error`,

                `internal_server_error`, `service_unavailable`,
                `rate_limit_exceeded`,

                `database_error`, `data_integrity_error`, `file_not_found`,

                `file_upload_error`, `invalid_file_format`. Individual handlers
                may

                emit additional endpoint-specific codes, documented per
                operation.
              example: validation_failed
            message:
              type: string
              example: Request validation failed
            details:
              oneOf:
                - type: string
                - type: array
                  items:
                    type: string
              description: >
                Present only when the handler supplies detail. Validation
                failures

                emit an array of `"<field path>: <message>"` strings.
              example:
                - 'currency: Field is required'
        timestamp:
          type: integer
          format: int64
          description: Server time in epoch milliseconds.
          example: 1767225600000
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        **Authentication Method:** HTTP Bearer token.


        The runtime requires the literal `Bearer ` prefix — a bare token in the

        `Authorization` header is rejected with `401 unauthorized`.


        **Header Format:** `Authorization: Bearer YOUR_API_KEY`


        Your API key is a JWT. Live keys operate on live data (`livemode:
        true`);

        test keys operate on isolated test data (`livemode: false`).


        **Get your key at:**
        [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api)


        **Errors:** credential failures are answered by the authentication layer
        with a raw

        `{ "message": … }` body, not the standardized envelope — `401` for a
        missing, malformed or

        expired token, `403` for a revoked key or a plan without API access. See
        the `Unauthorized`

        and `AuthForbidden` responses.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.