curl --request POST \
--url https://api.gigstack.io/v2/teams/{id}/fiscal-upload-sessions \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{}'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({})
};
fetch('https://api.gigstack.io/v2/teams/{id}/fiscal-upload-sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/teams/{id}/fiscal-upload-sessions"
payload = {}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"id": "<string>",
"team_id": "<string>",
"team": {
"id": "<string>",
"legal_name": "<string>",
"tax_id": "<string>"
},
"can_submit": true,
"recovery_available_at": 123,
"purpose": "csd",
"status": "pending",
"credential_livemode": true,
"effect_scope": "team_shared",
"provider_environment": "production",
"created_at": 123,
"expires_at": 123,
"completed_at": 123,
"upload_url": "<string>",
"completion_url": "<string>",
"manifest_consent": {
"text": "<string>",
"version": "<string>"
},
"resolution": {
"action": "released_for_new_upload",
"resolved_at": 123
},
"result": {
"team_id": "<string>",
"effect_scope": "team_shared",
"blocking_session_id": "<string>",
"csd": {
"configured": true,
"expires_at": 123,
"serial_number": "<string>",
"provider": "<string>"
},
"fiel": {
"configured": true,
"expires_at": 123,
"serial_number": "<string>",
"rfc": "<string>"
},
"sat_download": {
"registered": true,
"registered_at": 123,
"sync_enabled": true,
"sync_start_date": "<string>"
},
"manifest": {
"completed": true,
"signed_at": 123,
"provider_status": "<string>"
}
},
"error": {
"code": "<string>",
"message": "<string>",
"retryable": true
}
},
"timestamp": 123
}Create a secure fiscal upload session
Requires a verified Firebase or active signed personal MCP identity and current team owner authority. Team API keys and OAuth cannot impersonate their creator. Fiscal configuration is shared across live/test credential modes. FIEL/PFX provider calls use production even on staging; CSD affects shared future invoice configuration. The browser displays actual provider_environment and requires explicit consent.
Creates a 15-minute session bound to the actual user, team, purpose and credential mode. Returns a fixed authenticated browser URL. Manifest consent text and hash are frozen at creation. At most five pending sessions per owner/team.
curl --request POST \
--url https://api.gigstack.io/v2/teams/{id}/fiscal-upload-sessions \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{}'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({})
};
fetch('https://api.gigstack.io/v2/teams/{id}/fiscal-upload-sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/teams/{id}/fiscal-upload-sessions"
payload = {}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"id": "<string>",
"team_id": "<string>",
"team": {
"id": "<string>",
"legal_name": "<string>",
"tax_id": "<string>"
},
"can_submit": true,
"recovery_available_at": 123,
"purpose": "csd",
"status": "pending",
"credential_livemode": true,
"effect_scope": "team_shared",
"provider_environment": "production",
"created_at": 123,
"expires_at": 123,
"completed_at": 123,
"upload_url": "<string>",
"completion_url": "<string>",
"manifest_consent": {
"text": "<string>",
"version": "<string>"
},
"resolution": {
"action": "released_for_new_upload",
"resolved_at": 123
},
"result": {
"team_id": "<string>",
"effect_scope": "team_shared",
"blocking_session_id": "<string>",
"csd": {
"configured": true,
"expires_at": 123,
"serial_number": "<string>",
"provider": "<string>"
},
"fiel": {
"configured": true,
"expires_at": 123,
"serial_number": "<string>",
"rfc": "<string>"
},
"sat_download": {
"registered": true,
"registered_at": 123,
"sync_enabled": true,
"sync_start_date": "<string>"
},
"manifest": {
"completed": true,
"signed_at": 123,
"provider_status": "<string>"
}
},
"error": {
"code": "<string>",
"message": "<string>",
"retryable": true
}
},
"timestamp": 123
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Path Parameters
Body
csd, fiel, pfx, manifest