> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # Create payment complement (complemento de pago) > Stamp a CFDI type "P" payment complement (complemento de pago, Pagos 2.0) that registers one or more payments against PPD (Pago en Parcialidades o Diferido) invoices. Each entry in `complements[].data` is a payment. Each payment links one or more PPD invoices through `related_documents`, supplying the amount paid, the installment number and the previous balance so the SAT can compute the remaining balance. **Fixed by the SAT** and therefore not required in the body: the comprobante currency (`XXX`), the receptor `UsoCFDI` (`CP01`), and the line concept. The per-payment currency lives in each payment's `currency` field. The series defaults to the team's payments series (`invoice_serie_payments`). **gigstack Connect:** Create for other teams using the `team` parameter. ## OpenAPI ````yaml openapi.json POST /invoices/payment openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Signup requires its separately documented internal credential; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] tags: - name: gigstack Connect description: > **Multi-Team Resource Access** gigstack Connect lets a master team act on other teams that share its billing account. ## 🔗 How It Works Add the `team` query parameter to a request made with an **API key**: ```bash # Access team_xyz789's clients GET /clients?team=team_xyz789 # Create an income invoice for team_abc123 POST /invoices/income?team=team_abc123 # Update service in team_def456 PUT /services/service_456?team=team_def456 ``` ## ✅ Requirements - The API key's team must be a master team (gigstack Connect enabled) - The target team must exist and share the master team's billing account - The plan must include the `multipleIssuerAccounts` feature - OAuth access tokens cannot act on another team ## ⚠ Error Responses Raw `{ "message": 
 }` bodies from the authentication layer: - `401 Unauthorized, not a master team` - gigstack Connect not enabled on your key's team - `404 Team not found` - Target team doesn't exist - `401 Unauthorized, no matched teams` - Target team could not be resolved within your billing account - `403 Tu plan no incluye mĂșltiples cuentas emisoras. 
` - Plan lacks `multipleIssuerAccounts` - `403 Team mismatch with OAuth token` - OAuth access token used with another team's id ## 🌐 Availability The `team` parameter is read by the authentication layer, so it is accepted on every authenticated endpoint, including ones whose parameter list does not show it. - name: Clients description: Client management operations with Mexican tax compliance - name: Services description: Service and product catalog management with SAT product keys - name: Invoices description: Invoice management with CFDI 4.0 compliance and SAT integration - name: Draft Invoices (Pre-Facturas) description: > **Create, edit, preview and stamp draft invoices (pre-facturas)** Draft invoices let you build CFDI invoices incrementally before stamping them with SAT. Use them as **pre-facturas** — generate a preview PDF with a "Sin Validez Fiscal" watermark to share with your client for approval, then stamp the draft to create a valid CFDI when ready. ## Typical Workflow 1. `POST /invoices/draft` — Create a draft with minimal data 2. `PUT /invoices/draft/{id}` — Update as more data becomes available 3. `POST /invoices/draft/{id}/preview` — Generate a preview PDF (pre-factura) 4. `POST /invoices/draft/{id}/stamp` — Finalize into a valid CFDI invoice - name: Descarga Masiva SAT description: > **SAT bulk invoice download via FIEL authentication** Download all your issued and received CFDI invoices directly from the SAT (Servicio de AdministraciĂłn Tributaria) using your FIEL (Firma ElectrĂłnica Avanzada). ## Setup flow 1. `GET /invoices/download/activate/status` — Check if activated and what's needed 2. `POST /invoices/download/activate` — Activate billing (adds Stripe meter/add-on) 3. `POST /invoices/download/fiel` — Upload `.cer` + `.key` files (auto-registers with SAT) 4. `PUT /invoices/download/schedule` — Configure daily auto-sync 5. `POST /invoices/download/request` — Submit manual download requests ## Pricing - Included in Pro/Business plans: only the download meter ($0.20 MXN/XML) - Other paid plans: the same $0.20 MXN/XML download meter, no monthly base fee - name: Payments description: Payment processing, tracking, and refund management - name: Receipts description: Receipt creation and management with CFDI stamping capabilities - name: Retentions description: >- Tax retention documents (CFDI Retenciones 2.0) — creation, stamping, cancellation, and file retrieval - name: Platform Payouts description: > **Plan and stamp a marketplace's provider payouts from two files.** For marketplaces and digital platforms that pay providers under the SAT digital-platforms scheme (Plataformas TecnolĂłgicas, RESICO 625, retention key 26): ride-hailing drivers, delivery couriers, lodging hosts, sellers of goods. Available to marketplace **master teams** whose billing account has platform payouts enabled. Upload a movements file and a commissions file. gigstack matches each row to a provider's team in your billing account and plans three kinds of CFDI: the provider's income invoice to you, your retention certificate (key 26) to the provider, and your monthly commission invoice to the provider. **Not for your own sales.** This is for a platform invoicing on behalf of its providers. A company invoicing its own sales, one CFDI per sale, should use `POST /invoices/income`. **Tax policy per account.** Which documents are issued, and with which SAT keys and rates, is set per master account at onboarding: allowed tax regimes, CSD requirement, service type (`tipoDeServ` / `subTipServ`), ISR and IVA withholding rates, product keys and concept descriptions. The defaults are for ground passenger transport (service type `01`, 2.1% ISR withholding). Contact support to configure your account's policy; it can't be changed through the API. 1. `POST /platform-payouts` with an `Idempotency-Key` - upload and plan (synchronous) 2. `GET /platform-payouts/{id}` and `GET /platform-payouts/{id}/movements` - review the plan 3. `POST /platform-payouts/{id}/confirm` - irreversible hand-off to the stamping worker 4. `GET /platform-payouts/{id}` - poll until `completed` or `failed`, then read `result` (`completed`, `partially_completed` or `failed`) Error messages and exclusion reasons are Spanish sentences for end users; branch on `error.code`, `reason_code` and `exclusion_codes`. - name: Documents description: > SAT supporting documentation (contracts, delivery/payment proofs, communications) — upload metadata, compliance review, AI extraction, and linking to invoices, payments, receipts and clients. - name: Teams description: Team management, settings, and member administration - name: Users description: User account management and password operations - name: Auth description: > **API-only signup for AI agents and partner integrations.** A single `POST /v2/auth/signup` call provisions a Firebase Auth user, billing account, team, plan subscription, and returns API keys — no UI, no FIEL upload, no human onboarding required. Designed for the AI-agents-as-customers use case. RFC defaults to genĂ©rico (`XAXX010101000`) so agents can transact under pĂșblico en general until/unless their customer uploads their own RFC. Authenticated with `X-Internal-API-Key` (partner-issued) — Bearer tokens are team-scoped and a brand-new caller doesn't have one yet. See `AGENTS.md` in the gigstack-cli repo for end-to-end integration guide. - name: Webhooks description: Webhook management for real-time event notifications - name: Catalogs description: > **Read-only search over the SAT catalogs** Look up the SAT codes required on CFDI line items without hardcoding them: - `GET /catalogs/product-keys` — `c_ClaveProdServ`, the item `product_key` - `GET /catalogs/unit-keys` — `c_ClaveUnidad`, the item `unit_key` / `unit_name` Both are typo-tolerant full-text searches ranked by relevance. The catalogs are published by the SAT and identical for every team, so results carry no team data and ignore `livemode` — but a valid API key is still required. - name: SAT Lists description: > Read-only access to the RFC lists the SAT publishes under ArtĂ­culo 69, 69-B and 69-B Bis. gigstack re-syncs all 22 lists from the SAT's published CSVs every Sunday, so you can screen a counterparty's RFC before invoicing it without scraping the SAT yourself. externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /invoices/payment: post: tags: - Invoices summary: Create payment complement (complemento de pago) description: > Stamp a CFDI type "P" payment complement (complemento de pago, Pagos 2.0) that registers one or more payments against PPD (Pago en Parcialidades o Diferido) invoices. Each entry in `complements[].data` is a payment. Each payment links one or more PPD invoices through `related_documents`, supplying the amount paid, the installment number and the previous balance so the SAT can compute the remaining balance. **Fixed by the SAT** and therefore not required in the body: the comprobante currency (`XXX`), the receptor `UsoCFDI` (`CP01`), and the line concept. The per-payment currency lives in each payment's `currency` field. The series defaults to the team's payments series (`invoice_serie_payments`). **gigstack Connect:** Create for other teams using the `team` parameter. operationId: createInvoicesPayment parameters: - $ref: '#/components/parameters/TeamParameter' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PaymentComplementInput' example: client: id: client_1234567890 date: 1784915988000 complements: - type: pago data: - payment_form: '03' date: '2026-07-24T12:00:00' currency: MXN exchange: 1 related_documents: - uuid: A1B2C3D4-E5F6-7890-ABCD-1234567890AB amount: 116 installment: 1 last_balance: 116 currency: MXN taxes: - base: 100 rate: '0.16' factor: Tasa type: IVA withholding: false inclusive: false return_files: false responses: '200': description: Payment complement created successfully content: application/json: schema: type: object properties: message: type: string example: Payment complement created data: $ref: '#/components/schemas/ApiPublicIncomeInvoice' example: message: Payment complement created data: uuid: D2E3F4A5-3C4D-4E5F-9A0B-234567890CDE idempotency_key: null client: id: client_1234567890 name: ESCUELA KEMPER URGATE legal_name: ESCUELA KEMPER URGATE email: contabilidad@ejemplo.com bcc: [] phone: '+524421234567' tax_id: EKU9003173C9 tax_system: '601' use: G03 address: street: Av. Constituyentes exterior: '1000' neighborhood: Centro city: QuerĂ©taro state: QRO zip: '76000' country: MEX is_valid: true efos: is_valid: true metadata: {} livemode: true from: api owner: user_1234567890 team: team_1234567890 created_at: 1767225600000 created_at: 1767225600000 date: 1767225600000 currency: XXX exchange_rate: 1 total: 0 subtotal: 0 discount: 0 taxes: 0 withholding_taxes: 0 series: P folio_number: 45 invoice_type: P use: CP01 livemode: true owner: user_1234567890 team: team_1234567890 from: api status: valid payments: [] invoices: [] items: - id: item_pago description: Pago quantity: 1 unit_price: 0 product_key: '84111506' unit_key: ACT metadata: {} emails: - contabilidad@ejemplo.com cancellation: null stamp: sello: kQ3xZ9vR2mP7tL4wN8cB1yH6 stamp_at: 1767225600000 verification_url: >- https://verificacfdi.facturaelectronica.sat.gob.mx/default.aspx?id=D2E3F4A5-3C4D-4E5F-9A0B-234567890CDE&re=MEE200101ABC&rr=EKU9003173C9&tt=0.00&fe=kQ3xZ9 related_documents: [] '400': description: Invalid body content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/AuthForbidden' '500': $ref: '#/components/responses/ServerError' security: - bearerAuth: [] components: parameters: TeamParameter: name: team in: query required: false schema: type: string description: > **gigstack Connect:** Target team ID for multi-team access. Requires gigstack Connect enabled on your team and shared billing account. Also requires the `multipleIssuerAccounts` feature on your plan. Requests targeting a team other than the one your API key belongs to return `403` without it. Only API keys can use it: an OAuth access token sent with another team's id is rejected with `403 Team mismatch with OAuth token`. **Optional — omit it entirely** unless you are acting on another team. It deliberately carries no example value so generated snippets do not emit `?team=undefined`; when the parameter is absent, the team is derived from your API key. **Example:** `?team=team_xyz789` schemas: PaymentComplementInput: type: object additionalProperties: false required: - client - complements properties: date: description: Comprobante date in epoch milliseconds. Defaults to now. example: 1784915988000 type: number client: $ref: '#/components/schemas/EmbeddedClientInput' return_files: description: When true, includes base64 XML + PDF in the response. type: boolean currency: type: string exchange_rate: type: number folio_number: description: Optional custom folio. When set, stamps with that exact folio. type: number series: description: >- Override the series. Defaults to the team's payments series (invoice_serie_payments). type: string idempotency_key: type: string nullable: true use: type: string exports: type: string enum: - '01' - '02' - '03' - '04' - null nullable: true complements: description: >- Payment complement groups. Normally a single entry with type 'payment'. type: array items: type: object additionalProperties: false required: - data properties: type: description: >- Complement type. Defaults to 'pago' (required so the parent PPD balance updates). example: pago type: string data: type: array items: type: object additionalProperties: false required: - payment_form - date - currency - related_documents properties: payment_form: type: string description: >- SAT c_FormaPago code (FormaDePagoP), e.g. '03' for transfer. example: '03' date: description: Payment date/time (FechaPago), ISO 8601. example: '2026-07-24T12:00:00.000Z' type: string currency: type: string description: Payment currency (MonedaP). example: MXN exchange: type: number description: >- Payment exchange rate to MXN (TipoCambioP). Defaults to 1. example: 1 numOperacion: type: string nullable: true rfcEmisorCtaOrd: type: string nullable: true nomBancoOrdExt: type: string nullable: true ctaOrdenante: type: string nullable: true rfcEmisorCtaBen: type: string nullable: true ctaBeneficiario: type: string nullable: true related_documents: type: array items: type: object additionalProperties: false required: - uuid - amount - installment - last_balance - currency properties: uuid: type: string description: UUID (folio fiscal) of the PPD invoice being paid. example: A1B2C3D4-E5F6-7890-ABCD-1234567890AB amount: type: number description: >- Amount paid against this invoice in this payment (ImpPagado). example: 116 installment: description: >- Payment number for this invoice (NumParcialidad), starting at 1. example: 1 type: number last_balance: type: number description: >- Outstanding balance before this payment (ImpSaldoAnt). example: 116 currency: type: string description: Currency of the related invoice (MonedaDR). example: MXN exchange: type: number description: >- Exchange rate to the payment currency (EquivalenciaDR). Defaults to 1 when currencies match. example: 1 series: type: string nullable: true description: Series of the related invoice (optional). folio_number: type: string nullable: true description: Folio of the related invoice (optional). taxes: description: >- Taxes carried by this related document, mirrored onto the payment (ImpuestosDR). type: array items: type: object additionalProperties: false required: - base - rate - factor - type properties: base: type: number example: 100 rate: type: string description: Tax rate as a string, e.g. '0.16'. example: '0.16' factor: example: Tasa type: string type: example: IVA type: string key: type: string nullable: true withholding: example: false type: boolean inclusive: example: false type: boolean nullable: true minItems: 1 minItems: 1 minItems: 1 related_documents: description: Optional CFDI relations (CfdiRelacionados) at the comprobante level. type: array items: type: object additionalProperties: false required: - relationship - documents properties: relationship: description: SAT c_TipoRelacion code. type: string documents: type: array items: type: string nullable: true invoice_pdf_notes: type: string addenda: type: string nullable: true send_email: type: boolean ignore_emails: type: boolean nullable: true emails: type: array items: type: string format: email metadata: type: object additionalProperties: true properties: {} ApiPublicIncomeInvoice: type: object properties: uuid: type: string example: B0C3E4F2-1A2B-4C5D-9E8F-0123456789AB description: SAT UUID (folio fiscal) client: $ref: '#/components/schemas/ApiPublicClient' created_at: type: number example: 1677651234 description: Invoice creation timestamp currency: type: string example: MXN description: Invoice currency exchange_rate: type: number example: 1 description: Exchange rate used total: type: number example: 1160 description: Total invoice amount subtotal: type: number example: 1000 description: Subtotal before taxes taxes: type: number example: 160 description: Total tax amount discount: type: number example: 0 description: Total discount amount withholding_taxes: type: number example: 0 description: Total withholding tax amount series: description: Invoice series example: A type: string folio_number: type: number example: 123 description: Invoice folio number invoice_type: type: string enum: - I - E - P - 'N' example: I description: Invoice type (I=Income, E=Egress, P=Payment, N=Nomina) use: type: string example: G03 description: Mexican SAT usage code payment_form: type: string example: '03' description: Mexican SAT payment form code payment_method: type: string example: PUE description: Payment method (PUE/PPD) status: type: string enum: - draft - pending - valid - canceled - cancelled example: valid description: > Invoice status as stored. A stamped invoice is `valid`; a cancelled one is `canceled`. `cancelled` (double L) appears only on older records — new writes always use `canceled`. `draft` is a pre-factura that has not been stamped. livemode: type: boolean example: true description: Whether this is a live invoice owner: type: string example: user_1234567890 description: User who created the invoice from: type: string example: api description: >- Source of invoice creation. Documents created through the public API are stored with `api`; requests carrying the `X-Gigstack-Client: mcp` header (the gigstack MCP server) are stored with `mcp` and behave identically. items: type: array items: type: object properties: id: type: string example: item_1234567890 description: type: string example: Professional consulting services product_key: type: string example: '80141503' quantity: type: number example: 1 unit_price: type: number example: 1000 unit_key: type: string example: E48 unit_name: type: string example: Servicio sku: type: string example: CONS-001 taxability: type: string enum: - '01' - '02' example: '01' taxes: type: array items: $ref: '#/components/schemas/TaxSchema' payments: type: array items: type: string example: - payment_1234567890 description: Associated payment IDs invoices: type: array items: type: string example: [] description: Related invoice IDs stamp: type: object nullable: true properties: sello: type: string example: ABC123... stamp_at: type: number example: 1677651234 cancellation: type: object nullable: true properties: cancellation_status: type: string example: cancelled cancelled_at: type: number example: 1677651234 motive: type: string example: '02' code: type: string example: '201' verification_url: type: string example: https://verificacfdi.facturaelectronica.sat.gob.mx/default.aspx description: SAT verification URL exports: type: string example: '01' description: Export indicator addenda: type: string example: '' description: Additional XML addenda invoice_pdf_notes: type: string example: Additional notes for PDF description: Custom notes for PDF generation files: type: object nullable: true description: Base64 encoded files (only returned when return_files=true) properties: pdf: type: string example: JVBERi0xLjQKJeLjz9MKMSAwIG9ia... description: Base64 encoded PDF file xml: type: string example: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4... description: Base64 encoded XML file idempotency_key: type: string nullable: true team: type: string example: team_1234567890 billing_account: type: string nullable: true date: type: integer format: int64 nullable: true description: Comprobante date, epoch ms. payment_conditions: type: string nullable: true global: type: object nullable: true description: Global-invoice period (see the Global Invoices guide). properties: periodicity: type: string months: type: string year: type: integer related_documents: type: array nullable: true items: type: object properties: relationship: type: string documents: type: array items: type: string complements: type: array nullable: true items: type: object metadata: type: object nullable: true additionalProperties: true emails: type: array nullable: true items: type: string issuer_info: type: object nullable: true properties: legal_name: type: string tax_id: type: string tax_system: type: string zip: type: string namespaces: type: array nullable: true items: type: object properties: prefix: type: string uri: type: string schema_location: type: string ValidationErrorResponse: allOf: - $ref: '#/components/schemas/StandardErrorResponse' description: > Body validation failure. Unknown top-level keys are rejected — the validator runs in strict allowlist mode (`allowUnknown: false`), so a field not declared in the request schema produces an `unexpected_key` detail rather than being ignored. example: success: false error: code: validation_failed message: Request validation failed details: - 'currency: Field is required' - 'client_id: Unexpected field' timestamp: 1767225600000 EmbeddedClientInput: type: object additionalProperties: false properties: id: type: string nullable: true search: type: object additionalProperties: false required: - on_key - on_value properties: on_key: type: string on_value: type: string auto_create: type: boolean nullable: true safety_check: type: boolean nullable: true update: type: boolean nullable: true nullable: true address: type: object additionalProperties: false properties: country: type: string nullable: true maxLength: 3 street: type: string nullable: true zip: type: string nullable: true city: type: string nullable: true state: type: string nullable: true exterior: type: string nullable: true interior: type: string nullable: true municipality: type: string nullable: true neighborhood: type: string nullable: true nullable: true name: type: string nullable: true company: type: string nullable: true phone: type: string nullable: true email: type: string nullable: true bcc: type: array items: type: string metadata: type: object additionalProperties: true properties: {} legal_name: type: string nullable: true tax_id: type: string nullable: true use: type: string nullable: true tax_system: type: string nullable: true document_type: description: DIAN identification document code type: string enum: - '' - '11' - '12' - '13' - '21' - '22' - '31' - '41' - '42' - '47' - '48' - '50' - '91' - null nullable: true organization_type: description: 1 = persona jurĂ­dica, 2 = persona natural oneOf: - type: string enum: - '' - '1' - '2' - null nullable: true - type: number enum: - 1 - 2 tribute_code: description: '''01'' = responsable de IVA, ''ZZ'' = no aplica' type: string enum: - '' - '01' - ZZ - null nullable: true fiscal_responsibilities: description: >- DIAN responsabilidades fiscales (lista 53). Omitted means 'R-99-PN' (no responsable) type: array items: type: string enum: - O-13 - O-15 - O-23 - O-47 - R-99-PN nullable: true dv: description: NIT verification digit type: string nullable: true pattern: ^[0-9]?$ municipality_code: description: DANE municipality code, only for clients domiciled in Colombia type: string nullable: true pattern: ^([0-9]{5})?$ ApiPublicClient: type: object required: - id - email - from - livemode - owner - team - created_at properties: id: type: string example: client_1234567890 description: Unique client identifier address: $ref: '#/components/schemas/ClientAddress' name: type: string nullable: true example: Juan PĂ©rez GarcĂ­a description: Client name company: type: string nullable: true example: Empresa SA de CV description: Client company name phone: type: string nullable: true example: +52 55 1234 5678 description: Client phone number email: type: string format: email nullable: true example: juan.perez@ejemplo.com description: Client email address bcc: type: array items: type: string format: email nullable: true example: - admin@empresa.com description: BCC email addresses for client communications metadata: type: object additionalProperties: true nullable: true example: custom_field: value description: Additional metadata for the client is_valid: type: boolean nullable: true example: true description: Whether the client data is valid from: type: string example: api description: >- Source of client creation. Documents created through the public API are stored with `api`; requests carrying the `X-Gigstack-Client: mcp` header (the gigstack MCP server) are stored with `mcp` and behave identically. legal_name: type: string nullable: true example: Juan PĂ©rez GarcĂ­a description: Legal name for tax purposes livemode: type: boolean example: true description: Whether this client is in live mode owner: type: string example: user_1234567890 description: User ID who owns this client tax_id: type: string nullable: true example: PEGJ800101ABC description: RFC (Tax ID) for Mexican tax compliance use: type: string nullable: true example: G03 description: CFDI use code tax_system: type: string nullable: true example: '601' description: SAT tax system code team: type: string example: team_1234567890 description: Team ID this client belongs to created_at: type: number example: 1677651234 description: Unix timestamp of client creation efos: type: object nullable: true properties: is_valid: type: boolean nullable: true example: true description: >- true = RFC is NOT on the EFOS (Art. 69-B) blacklist (safe). false = RFC appears on the blacklist. description: >- EFOS (Art. 69-B CFF) blacklist check. Independent from `fiscal_validation` — an RFC can fail one and pass the other. fiscal_validation: type: object nullable: true description: >- Result of attempting to stamp a test CFDI against the PAC. Only returned on create/update/validate; not persisted on the client doc. properties: status: type: string enum: - valid - not_valid - skipped example: not_valid description: >- `valid` = PAC accepted; `not_valid` = PAC rejected (RFC/legal_name/CP do not match SAT registry); `skipped` = required fields missing. message: type: string nullable: true example: >- Fiscal info validation failed. El campo DomicilioFiscalReceptor del receptor, debe pertenecer al nombre asociado al RFC registrado en el campo Rfc del Receptor. description: Human-readable reason when status is not_valid or skipped. sat_status: type: object nullable: true description: > Unified SAT risk signal combining the EFOS check with 20 SAT Datos Abiertos lists (Art. 69, 69-B, 69-B Bis) synced weekly into Firestore. A hit on any "risky" list (Cancelados, No localizados, CSD sin efectos, Definitivos 69-B, Presuntos 69-B, etc.) or a failed EFOS check sets `is_risky: true`. properties: is_risky: type: boolean example: true description: true if any risky list hit OR `efos.is_valid === false`. efos: type: object nullable: true properties: is_valid: type: boolean nullable: true example: false description: EFOS check result (duplicated here for convenience). hits: type: array description: >- Every SAT list the RFC appears on, with the full row from the source CSV. items: type: object properties: list: type: string example: art_69b_definitivos description: >- List key (matches the source filename). See /sat_rfc_list_entries for all. label: type: string example: Definitivos 69-B source: type: string enum: - art_69 - art_69b - art_69b_bis example: art_69b is_risky: type: boolean example: true description: Whether a hit on this specific list marks the RFC unsafe. detail: type: object additionalProperties: true description: >- Full SAT record (razĂłn social, situaciĂłn, dates, oficios DOF, etc.). Shape varies per list. checked_at: type: number example: 1776887458784 description: Unix timestamp (ms) of when this check was run. defaults: type: object nullable: true properties: keep_full_legal_name: type: boolean nullable: true example: false description: Keep full legal name in documents issue_automatic_invoices: type: boolean nullable: true example: false description: Issue automatic invoices issue_invoiceable_receipts: type: boolean nullable: true example: true description: Issue invoiceable receipts description: Client default settings document_type: type: string nullable: true description: >- Colombia (DIAN) only: identification document code (`11`, `12`, `13`, `21`, `22`, `31`, `41`, `42`, `47`, `48`, `50`, `91`). organization_type: anyOf: - description: 'Colombia (DIAN) only: `1` legal entity, `2` natural person.' oneOf: - type: integer - type: string - type: object nullable: true enum: - null tribute_code: type: string nullable: true description: 'Colombia (DIAN) only: `01` IVA responsible, `ZZ` not applicable.' fiscal_responsibilities: type: array nullable: true items: type: string description: >- Colombia (DIAN) only: fiscal responsibilities (list 53), e.g. `O-13`, `R-99-PN`. dv: type: string nullable: true description: 'Colombia (DIAN) only: NIT verification digit (informational).' municipality_code: type: string nullable: true description: 'Colombia (DIAN) only: 5-digit DANE municipality code.' TaxSchema: type: object additionalProperties: false properties: base: description: >- Taxable base amount. Accepts number or numeric string. If null, calculated automatically from item price. example: 100 oneOf: - type: number nullable: true - type: string description: Numeric string accepted by the request validator. factor: example: Tasa type: string nullable: true inclusive: type: boolean nullable: true example: false rate: example: 0.16 type: number nullable: true type: example: IVA type: string enum: - IVA - ISR - IEPS - null nullable: true withholding: type: boolean nullable: true example: false StandardErrorResponse: type: object description: > Standardized error envelope emitted by `sendErrorResponse` and its helpers (`sendValidationError`, `sendNotFoundError`, `sendUnauthorizedError`, `sendForbiddenError`, `sendConflictError`, `sendBadRequestError`, `sendInternalServerError`). required: - success - error - timestamp properties: success: type: boolean enum: - false example: false error: type: object required: - code - message properties: code: type: string description: > Stable machine-readable code. Values emitted by the shared helpers: `unauthorized`, `forbidden`, `invalid_token`, `validation_failed`, `invalid_request_body`, `missing_required_field`, `invalid_field_value`, `resource_not_found`, `resource_already_exists`, `resource_conflict`, `business_rule_violation`, `operation_not_allowed`, `insufficient_permissions`, `external_service_error`, `payment_processor_error`, `cfdi_service_error`, `internal_server_error`, `service_unavailable`, `rate_limit_exceeded`, `database_error`, `data_integrity_error`, `file_not_found`, `file_upload_error`, `invalid_file_format`. Individual handlers may emit additional endpoint-specific codes, documented per operation. example: validation_failed message: type: string example: Request validation failed details: oneOf: - type: string - type: array items: type: string description: > Present only when the handler supplies detail. Validation failures emit an array of `": "` strings. example: - 'currency: Field is required' timestamp: type: integer format: int64 description: Server time in epoch milliseconds. example: 1767225600000 AuthMiddlewareError: type: object description: > Raw error body produced by the authentication layer (before any endpoint runs). It is not the standardized envelope: there is no `success` and no `timestamp`. required: - message properties: message: type: string description: >- Human-readable reason. Some messages are in Spanish; branch on the HTTP status, not on this text. example: Unauthorized error: type: string description: >- OAuth error code. Present only when an OAuth access token was presented. enum: - invalid_token - token_expired - token_revoked - server_error example: token_expired error_description: type: string description: Same text as `message`. Present only alongside `error`. example: Access token has expired. Please refresh your token. details: description: >- Extra detail, e.g. `Invalid API Key` when a revoked key is rejected with `403`. oneOf: - type: string - type: object example: Invalid API Key UnauthorizedError: allOf: - $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 ClientAddress: type: object additionalProperties: false properties: country: example: MEX type: string nullable: true maxLength: 3 street: example: Av. Insurgentes Sur type: string nullable: true zip: example: '03100' type: string nullable: true city: example: Ciudad de MĂ©xico type: string nullable: true state: example: CDMX type: string nullable: true exterior: example: '123' type: string nullable: true interior: example: 4B type: string nullable: true municipality: example: Benito JuĂĄrez type: string nullable: true neighborhood: example: Del Valle type: string nullable: true responses: Unauthorized: description: > Authentication failed. Two different bodies can come back with a `401`: 1. **From the authentication layer**, before the endpoint runs: a raw object with `message` and — for OAuth access tokens only — `error` / `error_description`. It does **not** use the standardized envelope (`success` and `timestamp` are absent). Messages: `Unauthorized` (missing header, missing `Bearer ` prefix, unparseable token), `Unauthorized, missing team in token`, `Unauthorized, not a master team` and `Unauthorized, no matched teams` (gigstack Connect), `Invalid access token`, `Access token has expired. Please refresh your token.`, `Access token has been revoked`. 2. **From the endpoint itself**: the standardized envelope with `error.code: unauthorized`. Branch on the HTTP status, not on the body shape. content: application/json: schema: anyOf: - $ref: '#/components/schemas/AuthMiddlewareError' - $ref: '#/components/schemas/UnauthorizedError' examples: missing_or_invalid_key: summary: Authentication layer — missing or unparseable API key value: message: Unauthorized oauth_token_expired: summary: Authentication layer — expired OAuth access token value: message: Access token has expired. Please refresh your token. error: token_expired error_description: Access token has expired. Please refresh your token. connect_not_master_team: summary: >- Authentication layer — `team` sent by a team without gigstack Connect value: message: Unauthorized, not a master team endpoint_envelope: summary: Endpoint — standardized envelope value: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 AuthForbidden: description: > Rejected by the authentication layer after the credential was recognised. The body is a raw object (`message`, sometimes `details`), **not** the standardized envelope. Causes: - The API key was revoked or disabled: `message: "API Key invĂĄlida."`, `details: "Invalid API Key"`. - The billing account's plan does not include API access. `message` is a Spanish sentence containing an HTML link to `https://app.gigstack.pro/memberships`. Branch on the status code; do not display or match the text. - gigstack Connect: the plan lacks the `multipleIssuerAccounts` feature (Spanish message starting `Tu plan no incluye mĂșltiples cuentas emisoras.`), or an OAuth access token was sent with a `team` other than its own (`Team mismatch with OAuth token`). An endpoint may also answer `403` for its own reasons; those are documented on the operation when they exist. content: application/json: schema: $ref: '#/components/schemas/AuthMiddlewareError' examples: revoked_api_key: summary: API key revoked or disabled value: message: API Key invĂĄlida. details: Invalid API Key plan_without_api_access: summary: Plan does not include API access value: message: >- La API se encuentra disponible para un plan mĂĄs grande, por favor actualiza tu plan aquĂ­ o ponte en contacto con soporte. connect_plan_without_multiple_issuers: summary: gigstack Connect — plan lacks multipleIssuerAccounts value: message: >- Tu plan no incluye mĂșltiples cuentas emisoras. Actualiza tu plan en https://app.gigstack.pro/memberships o ponte en contacto con soporte para operar sobre otros equipos. oauth_team_mismatch: summary: gigstack Connect — OAuth token used for another team value: message: Team mismatch with OAuth token ServerError: description: >- Unexpected server error (`error.code: internal_server_error`). The failure is logged on gigstack's side. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: internal_server_error message: An internal server error occurred timestamp: 1767225600000 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": 
 }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.