> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # Register payment > [Small working example](/recipes/payment) **Integration note:** Records money already received; does not charge a card. Repeating a creation idempotency_key returned HTTP 400 with error.code resource_conflict in staging. Reconcile the existing payment. ppd_invoice_id is a SAT UUID and enables complement automation even with automation_type none. Registration success is not proof that the asynchronous complement finished. Register a payment with optional automation for invoice creation. **gigstack Connect:** Register payments for other teams using the `team` parameter. ## Automation Types Control what happens automatically when registering a payment: - **`pue_invoice`**: Creates a PUE (Pago en Una sola Exhibición) invoice immediately - **`none`**: No automation, registers payment only ## PPD Invoice Linking You can link a payment to an existing PPD (Pago en Parcialidades o Diferido) invoice by providing the `ppd_invoice_id` field. When set, a payment complement (complemento de pago) CFDI will be automatically generated and linked to the PPD invoice. The referenced invoice must have `payment_method='PPD'` and `status='valid'`. ## Payment Form The `payment_form` field specifies the Mexican SAT payment form code: Common codes include: `01` (cash), `02` (check), `03` (electronic transfer), `04` (credit card), etc. The payment will be marked as 'succeeded' immediately upon registration. ## Required fields `client`, `currency`, `items` (at least one), `payment_form` and **`automation_type`** are required. `automation_type` has no default — omitting it fails validation. Allowed values: `pue_invoice`, `ppd_invoice_and_complement`, `none`. ## `date` Optional, in **Unix epoch milliseconds** (13 digits). Compared against `Luxon.now().toMillis()`; a future value returns `400`. ## `transfer_data` — all-or-nothing `transfer_data` is optional, but **when it is present all four of `master`, `connect`, `master_to` and `connect_to` are required**; omitting any one fails validation. | field | type | constraint | |---|---|---| | `master` | number | required, `0 ≤ master ≤ 100` (percentage retained by the master team) | | `connect` | string | required, non-empty — RFC of the connected team | | `master_to` | enum | required — `client` or `connect` | | `connect_to` | enum | required — `client` or `master` | | `connect_custom_config` | object | optional; every field inside it is optional except `type`, `rate` and `withholding` on each `taxes[]` entry | ## `invoice_config` All nested fields are optional: | field | type | meaning | |---|---|---| | `serie` | string | invoice series | | `folio` | number | invoice folio number | | `date` | number | invoice issue date, Unix epoch **milliseconds** | | `global.year` | number | fiscal year of the global (EOM) invoice, e.g. `2026` | | `global.months` | string | SAT `c_Meses` code, e.g. `01` for January or `13` for Jan–Feb | | `global.periodicity` | string | SAT `c_Periodicidad` code — `01` daily, `02` weekly, `03` fortnightly, `04` monthly, `05` bimonthly | | `validUntil` | number | expiry of the self-invoicing window, Unix epoch **milliseconds** | ## Email suppression `ignore_emails: true` suppresses notification emails. On this endpoint `send_email` is accepted but has no effect — only `ignore_emails` is persisted onto the payment. ## Unknown fields Body validation runs in strict allowlist mode — any undeclared key is rejected with `400 validation_failed` / `unexpected_key`. ## OpenAPI ````yaml openapi.json POST /payments/register openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Signup requires its separately documented internal credential; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] tags: - name: gigstack Connect description: > **Multi-Team Resource Access** gigstack Connect lets a master team act on other teams that share its billing account. ## 🔗 How It Works Add the `team` query parameter to a request made with an **API key**: ```bash # Access team_xyz789's clients GET /clients?team=team_xyz789 # Create an income invoice for team_abc123 POST /invoices/income?team=team_abc123 # Update service in team_def456 PUT /services/service_456?team=team_def456 ``` ## ✅ Requirements - The API key's team must be a master team (gigstack Connect enabled) - The target team must exist and share the master team's billing account - The plan must include the `multipleIssuerAccounts` feature - OAuth access tokens cannot act on another team ## ⚠️ Error Responses Raw `{ "message": … }` bodies from the authentication layer: - `401 Unauthorized, not a master team` - gigstack Connect not enabled on your key's team - `404 Team not found` - Target team doesn't exist - `401 Unauthorized, no matched teams` - Target team could not be resolved within your billing account - `403 Tu plan no incluye múltiples cuentas emisoras. …` - Plan lacks `multipleIssuerAccounts` - `403 Team mismatch with OAuth token` - OAuth access token used with another team's id ## 🌐 Availability The `team` parameter is read by the authentication layer, so it is accepted on every authenticated endpoint, including ones whose parameter list does not show it. - name: Clients description: Client management operations with Mexican tax compliance - name: Services description: Service and product catalog management with SAT product keys - name: Invoices description: Invoice management with CFDI 4.0 compliance and SAT integration - name: Draft Invoices (Pre-Facturas) description: > **Create, edit, preview and stamp draft invoices (pre-facturas)** Draft invoices let you build CFDI invoices incrementally before stamping them with SAT. Use them as **pre-facturas** — generate a preview PDF with a "Sin Validez Fiscal" watermark to share with your client for approval, then stamp the draft to create a valid CFDI when ready. ## Typical Workflow 1. `POST /invoices/draft` — Create a draft with minimal data 2. `PUT /invoices/draft/{id}` — Update as more data becomes available 3. `POST /invoices/draft/{id}/preview` — Generate a preview PDF (pre-factura) 4. `POST /invoices/draft/{id}/stamp` — Finalize into a valid CFDI invoice - name: Descarga Masiva SAT description: > **SAT bulk invoice download via FIEL authentication** Download all your issued and received CFDI invoices directly from the SAT (Servicio de Administración Tributaria) using your FIEL (Firma Electrónica Avanzada). ## Setup flow 1. `GET /invoices/download/activate/status` — Check if activated and what's needed 2. `POST /invoices/download/activate` — Activate billing (adds Stripe meter/add-on) 3. `POST /invoices/download/fiel` — Upload `.cer` + `.key` files (auto-registers with SAT) 4. `PUT /invoices/download/schedule` — Configure daily auto-sync 5. `POST /invoices/download/request` — Submit manual download requests ## Pricing - Included in Pro/Business plans: only the download meter ($0.20 MXN/XML) - Other paid plans: the same $0.20 MXN/XML download meter, no monthly base fee - name: Payments description: Payment processing, tracking, and refund management - name: Receipts description: Receipt creation and management with CFDI stamping capabilities - name: Retentions description: >- Tax retention documents (CFDI Retenciones 2.0) — creation, stamping, cancellation, and file retrieval - name: Platform Payouts description: > **Plan and stamp a marketplace's provider payouts from two files.** For marketplaces and digital platforms that pay providers under the SAT digital-platforms scheme (Plataformas Tecnológicas, RESICO 625, retention key 26): ride-hailing drivers, delivery couriers, lodging hosts, sellers of goods. Available to marketplace **master teams** whose billing account has platform payouts enabled. Upload a movements file and a commissions file. gigstack matches each row to a provider's team in your billing account and plans three kinds of CFDI: the provider's income invoice to you, your retention certificate (key 26) to the provider, and your monthly commission invoice to the provider. **Not for your own sales.** This is for a platform invoicing on behalf of its providers. A company invoicing its own sales, one CFDI per sale, should use `POST /invoices/income`. **Tax policy per account.** Which documents are issued, and with which SAT keys and rates, is set per master account at onboarding: allowed tax regimes, CSD requirement, service type (`tipoDeServ` / `subTipServ`), ISR and IVA withholding rates, product keys and concept descriptions. The defaults are for ground passenger transport (service type `01`, 2.1% ISR withholding). Contact support to configure your account's policy; it can't be changed through the API. 1. `POST /platform-payouts` with an `Idempotency-Key` - upload and plan (synchronous) 2. `GET /platform-payouts/{id}` and `GET /platform-payouts/{id}/movements` - review the plan 3. `POST /platform-payouts/{id}/confirm` - irreversible hand-off to the stamping worker 4. `GET /platform-payouts/{id}` - poll until `completed` or `failed`, then read `result` (`completed`, `partially_completed` or `failed`) Error messages and exclusion reasons are Spanish sentences for end users; branch on `error.code`, `reason_code` and `exclusion_codes`. - name: Documents description: > SAT supporting documentation (contracts, delivery/payment proofs, communications) — upload metadata, compliance review, AI extraction, and linking to invoices, payments, receipts and clients. - name: Teams description: Team management, settings, and member administration - name: Users description: User account management and password operations - name: Auth description: > **API-only signup for AI agents and partner integrations.** A single `POST /v2/auth/signup` call provisions a Firebase Auth user, billing account, team, plan subscription, and returns API keys — no UI, no FIEL upload, no human onboarding required. Designed for the AI-agents-as-customers use case. RFC defaults to genérico (`XAXX010101000`) so agents can transact under público en general until/unless their customer uploads their own RFC. Authenticated with `X-Internal-API-Key` (partner-issued) — Bearer tokens are team-scoped and a brand-new caller doesn't have one yet. See `AGENTS.md` in the gigstack-cli repo for end-to-end integration guide. - name: Webhooks description: Webhook management for real-time event notifications - name: Catalogs description: > **Read-only search over the SAT catalogs** Look up the SAT codes required on CFDI line items without hardcoding them: - `GET /catalogs/product-keys` — `c_ClaveProdServ`, the item `product_key` - `GET /catalogs/unit-keys` — `c_ClaveUnidad`, the item `unit_key` / `unit_name` Both are typo-tolerant full-text searches ranked by relevance. The catalogs are published by the SAT and identical for every team, so results carry no team data and ignore `livemode` — but a valid API key is still required. - name: SAT Lists description: > Read-only access to the RFC lists the SAT publishes under Artículo 69, 69-B and 69-B Bis. gigstack re-syncs all 22 lists from the SAT's published CSVs every Sunday, so you can screen a counterparty's RFC before invoicing it without scraping the SAT yourself. externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /payments/register: post: tags: - Payments summary: Register payment description: > [Small working example](/recipes/payment) **Integration note:** Records money already received; does not charge a card. Repeating a creation idempotency_key returned HTTP 400 with error.code resource_conflict in staging. Reconcile the existing payment. ppd_invoice_id is a SAT UUID and enables complement automation even with automation_type none. Registration success is not proof that the asynchronous complement finished. Register a payment with optional automation for invoice creation. **gigstack Connect:** Register payments for other teams using the `team` parameter. ## Automation Types Control what happens automatically when registering a payment: - **`pue_invoice`**: Creates a PUE (Pago en Una sola Exhibición) invoice immediately - **`none`**: No automation, registers payment only ## PPD Invoice Linking You can link a payment to an existing PPD (Pago en Parcialidades o Diferido) invoice by providing the `ppd_invoice_id` field. When set, a payment complement (complemento de pago) CFDI will be automatically generated and linked to the PPD invoice. The referenced invoice must have `payment_method='PPD'` and `status='valid'`. ## Payment Form The `payment_form` field specifies the Mexican SAT payment form code: Common codes include: `01` (cash), `02` (check), `03` (electronic transfer), `04` (credit card), etc. The payment will be marked as 'succeeded' immediately upon registration. ## Required fields `client`, `currency`, `items` (at least one), `payment_form` and **`automation_type`** are required. `automation_type` has no default — omitting it fails validation. Allowed values: `pue_invoice`, `ppd_invoice_and_complement`, `none`. ## `date` Optional, in **Unix epoch milliseconds** (13 digits). Compared against `Luxon.now().toMillis()`; a future value returns `400`. ## `transfer_data` — all-or-nothing `transfer_data` is optional, but **when it is present all four of `master`, `connect`, `master_to` and `connect_to` are required**; omitting any one fails validation. | field | type | constraint | |---|---|---| | `master` | number | required, `0 ≤ master ≤ 100` (percentage retained by the master team) | | `connect` | string | required, non-empty — RFC of the connected team | | `master_to` | enum | required — `client` or `connect` | | `connect_to` | enum | required — `client` or `master` | | `connect_custom_config` | object | optional; every field inside it is optional except `type`, `rate` and `withholding` on each `taxes[]` entry | ## `invoice_config` All nested fields are optional: | field | type | meaning | |---|---|---| | `serie` | string | invoice series | | `folio` | number | invoice folio number | | `date` | number | invoice issue date, Unix epoch **milliseconds** | | `global.year` | number | fiscal year of the global (EOM) invoice, e.g. `2026` | | `global.months` | string | SAT `c_Meses` code, e.g. `01` for January or `13` for Jan–Feb | | `global.periodicity` | string | SAT `c_Periodicidad` code — `01` daily, `02` weekly, `03` fortnightly, `04` monthly, `05` bimonthly | | `validUntil` | number | expiry of the self-invoicing window, Unix epoch **milliseconds** | ## Email suppression `ignore_emails: true` suppresses notification emails. On this endpoint `send_email` is accepted but has no effect — only `ignore_emails` is persisted onto the payment. ## Unknown fields Body validation runs in strict allowlist mode — any undeclared key is rejected with `400 validation_failed` / `unexpected_key`. operationId: createPaymentsRegister parameters: - $ref: '#/components/parameters/TeamParameter' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RegisterPaymentInput' examples: standard_payment: summary: Standard payment without splitting value: client: id: client_1234567890 automation_type: pue_invoice currency: MXN exchange_rate: 1 payment_form: '03' items: - id: service_1234567890 quantity: 1 unit_price: 1000 percentage_split: summary: Payment with percentage-based splitting value: client: id: client_1234567890 automation_type: pue_invoice currency: MXN payment_form: '03' items: - id: service_1234567890 quantity: 1 unit_price: 1000 transfer_data: master: 30 connect: EMP800101ABC master_to: client connect_to: master ppd_complement: summary: Payment linked to an existing PPD invoice description: >- Register a payment and automatically generate a payment complement (complemento de pago) linked to an existing PPD invoice value: client: id: client_1234567890 automation_type: none currency: MXN exchange_rate: 1 payment_form: '03' ppd_invoice_id: invoice_ppd_1234567890 items: - id: service_1234567890 quantity: 1 unit_price: 1000 fixed_commission: summary: Payment with fixed commission fee description: >- Use custom_price to charge a fixed commission instead of percentage value: client: id: client_1234567890 automation_type: pue_invoice currency: MXN payment_form: '03' items: - id: service_1234567890 quantity: 1 unit_price: 1000 transfer_data: master: 0 connect: EMP800101ABC master_to: client connect_to: master connect_custom_config: custom_price: 50 custom_description: Platform service fee responses: '201': description: > Payment registered successfully. **Both** the standard path and the `transfer_data` split path return `201` with the standardized success envelope. content: application/json: schema: allOf: - $ref: '#/components/schemas/StandardSuccessResponse' - type: object properties: message: type: string description: >- `Payment registered successfully` on the standard path, `Split payments registered successfully` on the split path. example: Payment registered successfully data: oneOf: - $ref: '#/components/schemas/ApiPublicPayment' - type: object description: >- Split payment result (returned when `transfer_data` is present) properties: split_reference: type: string example: split_abc123xyz master_payment_id: type: string example: payment_master_123 connect_payment_id: type: string example: payment_connect_456 master_amount: type: number example: 696 connect_amount: type: number example: 464 total_amount: type: number example: 1160 master_payment: type: object connect_payment: type: object connect_team: type: object nullable: true properties: id: type: string tax_id: type: string legal_name: type: string is_newly_created: type: boolean onboarding_url: type: string examples: standard_payment: summary: Standard payment response value: success: true message: Payment registered successfully timestamp: 1767225600000 data: id: payment_1234567890 client: id: client_1234567890 name: Juan Pérez García email: juan.perez@ejemplo.com tax_id: PEGJ800101ABC status: succeeded currency: MXN exchange_rate: 1 payment_form: '03' total: 1160 subtotal: 1000 taxes: 160 discount: 0 items: - id: service_1234567890 description: Professional consulting services quantity: 1 unit_price: 1000 product_key: '80141503' unit_key: E48 invoices: - B0C3E4F2-1A2B-4C5D-9E8F-0123456789AB created_at: 1677651234 succeeded_at: 1677651234 payment_processor: api livemode: true team: team_1234567890 owner: user_1234567890 split_payment: summary: Split payment response description: Response when using transfer_data to split payments value: success: true message: Split payments registered successfully timestamp: 1767225600000 data: split_reference: split_abc123xyz master_payment_id: payment_master_123 connect_payment_id: payment_connect_456 master_amount: 696 connect_amount: 464 total_amount: 1160 master_payment: id: payment_master_123 client: client_1234567890 amount: 696 team: team_master_123 split_role: master connect_payment: id: payment_connect_456 client: client_connect_789 amount: 464 team: team_connect_456 split_role: connect connect_team: id: team_connect_456 tax_id: EMP800101ABC legal_name: Empresa Ejemplo SA de CV is_newly_created: true onboarding_url: >- https://embeded.gigstack.pro/?sessionId=otpOnboarding_7Kd2Pq&c=193847 '400': description: > Bad Request. Emitted with `error.code`: - `validation_failed` — body failed schema validation (missing required field, bad enum value, or an unknown key: the validator rejects fields it does not declare). - `invalid_request_body` — `Invalid automation type`, `PPD invoice not found with uuid: …`, `The referenced invoice is not valid (stamped)`, `Payment date cannot be in the future`, or `Exchange rate not found for the specified currency`. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': $ref: '#/components/responses/Unauthorized' '403': description: > Forbidden — the referenced client or service belongs to another team, or its `livemode` does not match the API key. Raised by resource resolution with `error.code: resource_resolution_failed`. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' '404': description: Referenced client or service id was not found. content: application/json: schema: $ref: '#/components/schemas/NotFoundError' '409': description: > Conflict — the supplied `idempotency_key` has already been used (`error.code: resource_conflict`, message `Idempotency key error`). On the split path either the master or the connect payment can trigger this. Resource resolution also returns 409 when a concurrent create for the same client/service holds the lock; retry the request. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' '500': $ref: '#/components/responses/ServerError' security: - bearerAuth: [] components: parameters: TeamParameter: name: team in: query required: false schema: type: string description: > **gigstack Connect:** Target team ID for multi-team access. Requires gigstack Connect enabled on your team and shared billing account. Also requires the `multipleIssuerAccounts` feature on your plan. Requests targeting a team other than the one your API key belongs to return `403` without it. Only API keys can use it: an OAuth access token sent with another team's id is rejected with `403 Team mismatch with OAuth token`. **Optional — omit it entirely** unless you are acting on another team. It deliberately carries no example value so generated snippets do not emit `?team=undefined`; when the parameter is absent, the team is derived from your API key. **Example:** `?team=team_xyz789` schemas: RegisterPaymentInput: description: > Unknown top-level keys are rejected (`400 validation_failed` / `unexpected_key`). `team`, `livemode` and `owner` are reserved and injected by the auth middleware. type: object additionalProperties: false required: - client - automation_type - currency - items - payment_form properties: client: $ref: '#/components/schemas/EmbeddedClientInput' automation_type: description: > Payment automation type: - `pue_invoice`: Create PUE (Pago en Una sola Exhibición) invoice immediately when payment succeeds - `ppd_invoice_and_complement`: Create PPD (Pago en Parcialidades o Diferido) invoice immediately, then payment complement when payment succeeds - `none`: No automation, register payment only example: pue_invoice type: string enum: - pue_invoice - ppd_invoice_and_complement - none currency: description: Currency code (ISO 4217) example: MXN type: string exchange_rate: description: >- Exchange rate for currency conversion. If not provided, the rate from the payment date (or current date if no date specified) will be fetched automatically from our rates collection. example: 1 type: number nullable: true idempotency_key: description: >- Stable key for one business event. A duplicate returns HTTP 400 with error.code resource_conflict, not the existing payment as a successful response. Reconcile the existing record and retain this key; do not create a new key for a retry. example: payment-register-12345 type: string nullable: true items: type: array items: $ref: '#/components/schemas/ItemSchema' minItems: 1 payment_form: description: | Mexican SAT payment form code: - `01`: Cash - `02`: Check - `03`: Electronic transfer - `04`: Credit card - `05`: Electronic money - `06`: Digital money - `08`: Gift voucher - `12`: Credit for unregistered bills - `13`: Payment by subrogation - `14`: Payment by consignment - `15`: Condonation - `17`: Compensation - `23`: Novation - `24`: Confusion - `25`: Remission of debt - `26`: Prescription or expiration - `27`: To creditor's satisfaction - `28`: Credit card - `29`: Debit card - `30`: Service card - `31`: Applicable only to the complementary concept of donations - `99`: To be defined example: '03' type: string enum: - '01' - '02' - '03' - '04' - '05' - '06' - '08' - '12' - '13' - '14' - '15' - '17' - '23' - '24' - '25' - '26' - '27' - '28' - '29' - '30' - '31' - '99' metadata: description: Additional metadata to store with the payment type: object additionalProperties: true properties: {} nullable: true invoice_config: description: > Optional invoice configuration. Every field is optional. Controls the folio/serie the generated invoice will use, its issue date, the global (EOM) period it belongs to, and how long the self-invoicing window stays open. type: object additionalProperties: false properties: serie: description: >- Invoice serie. Will set/create the series for the team if provided. example: A type: string nullable: true folio: description: >- Invoice folio number. If omitted, the automatic incrementing folio is used. When provided, duplicates may occur. example: 123 type: number nullable: true date: description: >- Invoice issue date as a Unix epoch timestamp in **milliseconds**. example: 1767225600000 type: number nullable: true global: description: >- Period of the global (factura global / EOM) invoice this document belongs to. type: object additionalProperties: false properties: year: description: Fiscal year, four digits. example: 2026 type: number nullable: true months: description: > SAT `c_Meses` code. `01`–`12` for a single month; `13`–`18` for the bimonthly periods (`13` = Jan–Feb … `18` = Nov–Dec). example: '01' type: string nullable: true periodicity: description: > SAT `c_Periodicidad` code: `01` daily, `02` weekly, `03` fortnightly, `04` monthly, `05` bimonthly. example: '04' type: string nullable: true nullable: true validUntil: description: >- Expiry of the self-invoicing window, Unix epoch **milliseconds**. example: 1769817600000 type: number nullable: true nullable: true date: description: >- Unix epoch timestamp in **milliseconds** (13 digits) for when the payment was received. Must be in the past. Defaults to now. example: 1767225600000 type: number nullable: true send_email: description: > Accepted for compatibility, but on this endpoint it has **no effect** — only `ignore_emails` is persisted onto the payment. Use `ignore_emails` to suppress mail. example: true type: boolean nullable: true ignore_emails: description: > Suppress email and WhatsApp notifications for this payment and any documents it automates (invoices, receipts). Defaults to `false`. example: false type: boolean nullable: true ppd_invoice_id: description: >- UUID of an existing PPD invoice to link this payment to. When provided, a payment complement (complemento de pago) will be automatically generated and linked to the PPD invoice. The referenced invoice must have payment_method='PPD', status='valid' and invoice_type='I' — a payment complement only ever settles an income CFDI, never an egress one. example: invoice_ppd_1234567890 type: string nullable: true transfer_data: description: > Configuration for splitting payments between master and connect teams in a marketplace. Only available for master teams with marketplace-enabled billing accounts. **All-or-nothing:** the object itself is optional, but when it is present `master`, `connect`, `master_to` and `connect_to` are **all required**. Sending `transfer_data` with any of them missing fails validation with `400 validation_failed`. `connect_custom_config` stays optional. type: object additionalProperties: false required: - master - connect - master_to - connect_to properties: master: description: >- Required when `transfer_data` is present. Percentage of the payment retained by the master team. Must be between 0 and 100 inclusive. example: 10 type: number minimum: 0 maximum: 100 connect: description: >- Required when `transfer_data` is present. Tax ID (RFC) or Team ID of the connect team. If not found, a new team will be created. example: ABC123456789 type: string minLength: 1 master_to: description: > Determines which client to assign to the master payment: - `client`: Use the original client from the request - `connect`: Create the connect team as a client for the master payment example: client type: string enum: - client - connect connect_to: description: > Determines which client to assign to the connect payment: - `client`: Use the original client from the request - `master`: Create the master team as a client for the connect payment example: client type: string enum: - client - master connect_custom_config: description: Optional configuration to customize items in the connect payment type: object additionalProperties: false properties: product_key: description: SAT product key to use for connect payment items example: '01010101' type: string nullable: true unit_key: description: SAT unit key to use for connect payment items example: E48 type: string nullable: true taxes: description: >- Custom tax configuration for connect payment items (uses same schema as regular item taxes) type: array items: type: object additionalProperties: false required: - type - rate - withholding properties: type: description: Tax type example: IVA type: string enum: - IVA - ISR - IEPS rate: description: Tax rate as decimal (0.16 = 16%) example: 0.16 type: number withholding: description: >- true = retention (deducted from total), false = regular tax (added to subtotal) example: false type: boolean base: description: Optional tax base amount type: number nullable: true factor: description: Optional tax factor example: Tasa type: string nullable: true inclusive: description: Whether tax is included in the price type: boolean nullable: true nullable: true custom_description: description: Custom description for connect payment items example: Professional consulting services type: string nullable: true custom_price: description: >- Fixed amount for connect payment (overrides percentage calculation). When set, connect gets this exact amount and master gets the remainder. example: 250 type: number nullable: true minimum: 0 nullable: true nullable: true StandardSuccessResponse: type: object description: | Standardized success envelope emitted by `sendSuccessResponse`. required: - success - data - timestamp properties: success: type: boolean enum: - true example: true data: type: object description: The operation payload. message: type: string description: Human-readable summary. Present only when the handler supplies one. example: Operation completed successfully timestamp: type: integer format: int64 description: Server time in **epoch milliseconds** (`Luxon.now().toMillis()`). example: 1767225600000 ApiPublicPayment: type: object required: - id - client - currency - exchange_rate - items - team - idempotency_key - from - invoices - livemode - owner - payment_form - payments - receipts - refunds - short_url - status - total - total_refunded - subtotal - taxes - discount - withholding_taxes - created_at - succeeded_at - payment_processor properties: id: type: string example: payment_1234567890 description: Unique payment identifier client: $ref: '#/components/schemas/ApiPublicClient' emails: type: array items: type: string format: email nullable: true example: - client@example.com description: Email addresses to notify currency: type: string example: MXN description: Payment currency allowed_payment_methods: type: array items: $ref: '#/components/schemas/PaymentAllowedMethod' nullable: true description: Allowed payment methods exchange_rate: type: number example: 1 description: Exchange rate used for currency conversion items: type: array items: $ref: '#/components/schemas/PaymentItem' description: Items included in this payment metadata: type: object additionalProperties: type: string example: order_id: '12345' description: Additional metadata for the payment invoice_config: $ref: '#/components/schemas/ApiPublicInvoiceConfig' team: type: string example: team_1234567890 description: Team ID this payment belongs to idempotency_key: type: string example: unique_key_123 description: Idempotency key to prevent duplicate payments from: type: string example: api description: >- Source of payment creation. Documents created through the public API are stored with `api`; requests carrying the `X-Gigstack-Client: mcp` header (the gigstack MCP server) are stored with `mcp` and behave identically. invoices: type: array items: type: string example: - B0C3E4F2-1A2B-4C5D-9E8F-0123456789AB description: >- Associated invoice ids. Invoices stamped by the API are stored under their SAT UUID (folio fiscal). livemode: type: boolean example: true description: Whether this payment is in live mode owner: type: string example: user_1234567890 description: User ID who owns this payment payment_form: type: string example: '03' description: SAT payment form code payments: type: array items: type: string example: [] description: Related payment IDs receipts: type: array items: type: string example: - receipt_1234567890 description: Associated receipt IDs refunds: type: array items: $ref: '#/components/schemas/ApiPublicRefund' description: Refunds associated with this payment short_url: type: string example: https://gigstack.xyz/Xk3mP9 description: Short URL for payment page success_url: type: string nullable: true example: https://tienda.com/pedido/1234/gracias description: >- Where the payment page returns the payer after a successful payment. Null when not set. status: type: string enum: - requires_payment_method - succeeded - partially_paid - canceled example: succeeded description: > Current payment status. `partially_paid` means the payment was topped up for less than its full amount via `POST /payments/{id}/paid` with `amount_received` set below the total — see that endpoint's `amount_received` field. total: type: number example: 1160 description: Total payment amount including taxes total_refunded: type: number example: 0 description: >- Cumulative refunds in minor units (cents), unlike total which is in currency units. Divide by 100 when comparing these fields for the documented MXN flow. subtotal: type: number example: 1000 description: Subtotal before taxes taxes: type: number example: 160 description: Total tax amount discount: type: number example: 0 description: Discount applied withholding_taxes: type: number example: 0 description: Withholding taxes amount created_at: type: number example: 1677651234 description: Unix timestamp of payment creation succeeded_at: type: number nullable: true example: 1677651234 description: Unix timestamp when payment succeeded payment_processor: type: string example: stripe description: Payment processor used payment_processor_details: $ref: '#/components/schemas/ApiPublicPaymentProcessorDetails' transfer_data: type: object nullable: true description: >- Split-payment transfer configuration (gigstack Connect marketplaces). split_reference: type: string nullable: true split_role: type: string nullable: true enum: - master - connect - null counterpart_payment_id: type: string nullable: true original_transfer_data: type: object nullable: true split_payment_ids: type: array nullable: true items: type: string parent_payment_id: type: string nullable: true ValidationErrorResponse: allOf: - $ref: '#/components/schemas/StandardErrorResponse' description: > Body validation failure. Unknown top-level keys are rejected — the validator runs in strict allowlist mode (`allowUnknown: false`), so a field not declared in the request schema produces an `unexpected_key` detail rather than being ignored. example: success: false error: code: validation_failed message: Request validation failed details: - 'currency: Field is required' - 'client_id: Unexpected field' timestamp: 1767225600000 StandardErrorResponse: type: object description: > Standardized error envelope emitted by `sendErrorResponse` and its helpers (`sendValidationError`, `sendNotFoundError`, `sendUnauthorizedError`, `sendForbiddenError`, `sendConflictError`, `sendBadRequestError`, `sendInternalServerError`). required: - success - error - timestamp properties: success: type: boolean enum: - false example: false error: type: object required: - code - message properties: code: type: string description: > Stable machine-readable code. Values emitted by the shared helpers: `unauthorized`, `forbidden`, `invalid_token`, `validation_failed`, `invalid_request_body`, `missing_required_field`, `invalid_field_value`, `resource_not_found`, `resource_already_exists`, `resource_conflict`, `business_rule_violation`, `operation_not_allowed`, `insufficient_permissions`, `external_service_error`, `payment_processor_error`, `cfdi_service_error`, `internal_server_error`, `service_unavailable`, `rate_limit_exceeded`, `database_error`, `data_integrity_error`, `file_not_found`, `file_upload_error`, `invalid_file_format`. Individual handlers may emit additional endpoint-specific codes, documented per operation. example: validation_failed message: type: string example: Request validation failed details: oneOf: - type: string - type: array items: type: string description: > Present only when the handler supplies detail. Validation failures emit an array of `": "` strings. example: - 'currency: Field is required' timestamp: type: integer format: int64 description: Server time in epoch milliseconds. example: 1767225600000 NotFoundError: allOf: - $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: resource_not_found message: Resource not found timestamp: 1767225600000 EmbeddedClientInput: type: object additionalProperties: false properties: id: type: string nullable: true search: type: object additionalProperties: false required: - on_key - on_value properties: on_key: type: string on_value: type: string auto_create: type: boolean nullable: true safety_check: type: boolean nullable: true update: type: boolean nullable: true nullable: true address: type: object additionalProperties: false properties: country: type: string nullable: true maxLength: 3 street: type: string nullable: true zip: type: string nullable: true city: type: string nullable: true state: type: string nullable: true exterior: type: string nullable: true interior: type: string nullable: true municipality: type: string nullable: true neighborhood: type: string nullable: true nullable: true name: type: string nullable: true company: type: string nullable: true phone: type: string nullable: true email: type: string nullable: true bcc: type: array items: type: string metadata: type: object additionalProperties: true properties: {} legal_name: type: string nullable: true tax_id: type: string nullable: true use: type: string nullable: true tax_system: type: string nullable: true document_type: description: DIAN identification document code type: string enum: - '' - '11' - '12' - '13' - '21' - '22' - '31' - '41' - '42' - '47' - '48' - '50' - '91' - null nullable: true organization_type: description: 1 = persona jurídica, 2 = persona natural oneOf: - type: string enum: - '' - '1' - '2' - null nullable: true - type: number enum: - 1 - 2 tribute_code: description: '''01'' = responsable de IVA, ''ZZ'' = no aplica' type: string enum: - '' - '01' - ZZ - null nullable: true fiscal_responsibilities: description: >- DIAN responsabilidades fiscales (lista 53). Omitted means 'R-99-PN' (no responsable) type: array items: type: string enum: - O-13 - O-15 - O-23 - O-47 - R-99-PN nullable: true dv: description: NIT verification digit type: string nullable: true pattern: ^[0-9]?$ municipality_code: description: DANE municipality code, only for clients domiciled in Colombia type: string nullable: true pattern: ^([0-9]{5})?$ ItemSchema: description: > A line item on an invoice, receipt or payment. Only `quantity` is required; everything else is optional, or resolved from the referenced service when `id`/`search` is used. `id` and `search` are mutually exclusive — supplying both is a `400`. Unknown keys are rejected. Note there is no per-item `metadata` field. type: object additionalProperties: false required: - quantity properties: id: description: Service/product ID reference example: service_1234567890 type: string nullable: true search: type: object additionalProperties: false required: - on_key - on_value properties: on_key: description: Field to search on (sku, name, etc.) example: sku type: string on_value: description: Value to search for example: CONS-001 type: string auto_create: description: Create service if not found example: true type: boolean nullable: true safety_check: description: >- When true, prevents using multiple matching results (returns error). When false, uses the first result found. Default: false example: false type: boolean nullable: true update: type: boolean nullable: true nullable: true quantity: description: Item quantity example: 1 type: number description: description: Item description example: Consulting services type: string nullable: true sku: description: Stock keeping unit example: CONS-001 type: string nullable: true product_key: description: SAT product key (c_ClaveProdServ) example: '80141503' type: string nullable: true unit_key: description: SAT unit key (c_ClaveUnidad) example: E48 type: string nullable: true unit_name: description: Unit name example: Servicio type: string nullable: true unit_price: description: Unit price example: 1000 type: number nullable: true discount: description: >- Discount amount (absolute value in the item currency, not a percentage) example: 0 type: number nullable: true taxability: description: SAT `c_ObjetoImp` — whether the item is subject to tax. example: '02' type: string enum: - '01' - '02' - '03' - '04' - '05' - '06' - '07' - '08' - null nullable: true taxes: description: Tax elements applied to this item type: array items: type: object additionalProperties: false properties: base: description: >- Taxable base amount. Accepts number or numeric string. If null, calculated automatically from item price. example: 100 oneOf: - type: number nullable: true - type: string description: Numeric string accepted by the request validator. factor: type: string nullable: true example: Tasa description: SAT tax factor (Tasa, Cuota, Exento) inclusive: type: boolean nullable: true example: false description: Whether the tax is included in the unit price rate: description: Tax rate (e.g., 0.16 for 16% IVA) example: 0.16 type: number nullable: true type: description: Type of tax example: IVA type: string enum: - IVA - ISR - IEPS - null nullable: true withholding: type: boolean nullable: true example: false description: Whether this is a withholding tax nullable: true third_party: description: Third party information for items provided by external parties type: object additionalProperties: false properties: legal_name: description: Third party legal name example: Third Party SA type: string nullable: true tax_id: description: Third party RFC (tax ID) example: TPR800101ABC type: string nullable: true tax_system: description: Third party tax system example: '601' type: string nullable: true zip: description: Third party ZIP code example: '03100' type: string nullable: true nullable: true item_complement: description: CFDI item-level complement. type: object additionalProperties: false properties: hydrocarbons: description: >- Complemento de hidrocarburos. All four fields are required when this object is present. type: object additionalProperties: false required: - permit_type - permit_number - fuel_code - fuel_sub_product properties: permit_type: example: PL/12345/EXP/ES/2020 type: string permit_number: example: '12345' type: string fuel_code: example: PR03 type: string fuel_sub_product: example: '10' type: string nullable: true nullable: true ApiPublicClient: type: object required: - id - email - from - livemode - owner - team - created_at properties: id: type: string example: client_1234567890 description: Unique client identifier address: $ref: '#/components/schemas/ClientAddress' name: type: string nullable: true example: Juan Pérez García description: Client name company: type: string nullable: true example: Empresa SA de CV description: Client company name phone: type: string nullable: true example: +52 55 1234 5678 description: Client phone number email: type: string format: email nullable: true example: juan.perez@ejemplo.com description: Client email address bcc: type: array items: type: string format: email nullable: true example: - admin@empresa.com description: BCC email addresses for client communications metadata: type: object additionalProperties: true nullable: true example: custom_field: value description: Additional metadata for the client is_valid: type: boolean nullable: true example: true description: Whether the client data is valid from: type: string example: api description: >- Source of client creation. Documents created through the public API are stored with `api`; requests carrying the `X-Gigstack-Client: mcp` header (the gigstack MCP server) are stored with `mcp` and behave identically. legal_name: type: string nullable: true example: Juan Pérez García description: Legal name for tax purposes livemode: type: boolean example: true description: Whether this client is in live mode owner: type: string example: user_1234567890 description: User ID who owns this client tax_id: type: string nullable: true example: PEGJ800101ABC description: RFC (Tax ID) for Mexican tax compliance use: type: string nullable: true example: G03 description: CFDI use code tax_system: type: string nullable: true example: '601' description: SAT tax system code team: type: string example: team_1234567890 description: Team ID this client belongs to created_at: type: number example: 1677651234 description: Unix timestamp of client creation efos: type: object nullable: true properties: is_valid: type: boolean nullable: true example: true description: >- true = RFC is NOT on the EFOS (Art. 69-B) blacklist (safe). false = RFC appears on the blacklist. description: >- EFOS (Art. 69-B CFF) blacklist check. Independent from `fiscal_validation` — an RFC can fail one and pass the other. fiscal_validation: type: object nullable: true description: >- Result of attempting to stamp a test CFDI against the PAC. Only returned on create/update/validate; not persisted on the client doc. properties: status: type: string enum: - valid - not_valid - skipped example: not_valid description: >- `valid` = PAC accepted; `not_valid` = PAC rejected (RFC/legal_name/CP do not match SAT registry); `skipped` = required fields missing. message: type: string nullable: true example: >- Fiscal info validation failed. El campo DomicilioFiscalReceptor del receptor, debe pertenecer al nombre asociado al RFC registrado en el campo Rfc del Receptor. description: Human-readable reason when status is not_valid or skipped. sat_status: type: object nullable: true description: > Unified SAT risk signal combining the EFOS check with 20 SAT Datos Abiertos lists (Art. 69, 69-B, 69-B Bis) synced weekly into Firestore. A hit on any "risky" list (Cancelados, No localizados, CSD sin efectos, Definitivos 69-B, Presuntos 69-B, etc.) or a failed EFOS check sets `is_risky: true`. properties: is_risky: type: boolean example: true description: true if any risky list hit OR `efos.is_valid === false`. efos: type: object nullable: true properties: is_valid: type: boolean nullable: true example: false description: EFOS check result (duplicated here for convenience). hits: type: array description: >- Every SAT list the RFC appears on, with the full row from the source CSV. items: type: object properties: list: type: string example: art_69b_definitivos description: >- List key (matches the source filename). See /sat_rfc_list_entries for all. label: type: string example: Definitivos 69-B source: type: string enum: - art_69 - art_69b - art_69b_bis example: art_69b is_risky: type: boolean example: true description: Whether a hit on this specific list marks the RFC unsafe. detail: type: object additionalProperties: true description: >- Full SAT record (razón social, situación, dates, oficios DOF, etc.). Shape varies per list. checked_at: type: number example: 1776887458784 description: Unix timestamp (ms) of when this check was run. defaults: type: object nullable: true properties: keep_full_legal_name: type: boolean nullable: true example: false description: Keep full legal name in documents issue_automatic_invoices: type: boolean nullable: true example: false description: Issue automatic invoices issue_invoiceable_receipts: type: boolean nullable: true example: true description: Issue invoiceable receipts description: Client default settings document_type: type: string nullable: true description: >- Colombia (DIAN) only: identification document code (`11`, `12`, `13`, `21`, `22`, `31`, `41`, `42`, `47`, `48`, `50`, `91`). organization_type: anyOf: - description: 'Colombia (DIAN) only: `1` legal entity, `2` natural person.' oneOf: - type: integer - type: string - type: object nullable: true enum: - null tribute_code: type: string nullable: true description: 'Colombia (DIAN) only: `01` IVA responsible, `ZZ` not applicable.' fiscal_responsibilities: type: array nullable: true items: type: string description: >- Colombia (DIAN) only: fiscal responsibilities (list 53), e.g. `O-13`, `R-99-PN`. dv: type: string nullable: true description: 'Colombia (DIAN) only: NIT verification digit (informational).' municipality_code: type: string nullable: true description: 'Colombia (DIAN) only: 5-digit DANE municipality code.' PaymentAllowedMethod: type: object required: - id properties: id: type: string example: card description: Payment method identifier PaymentItem: allOf: - $ref: '#/components/schemas/ApiPublicService' - type: object properties: third_party: $ref: '#/components/schemas/ApiPublicThirdParty' search: $ref: '#/components/schemas/ApiPublicSearch' ApiPublicInvoiceConfig: type: object properties: serie: type: string nullable: true example: A description: Invoice series folio: type: string nullable: true example: '123' description: Invoice folio number ApiPublicRefund: type: object required: - id - reason - created_at - total properties: id: type: string example: refund_1234567890 description: Unique refund identifier items: type: array items: $ref: '#/components/schemas/ApiPublicService' nullable: true description: Items being refunded reason: description: Reason for the refund example: Customer requested cancellation type: string created_at: type: number example: 1677651234 description: Unix timestamp of when the refund was created total: type: number example: 1160 description: Total refund amount ApiPublicPaymentProcessorDetails: type: object additionalProperties: type: object properties: payment_intent: type: string example: pi_1234567890 description: Payment processor intent ID charge: type: string example: ch_1234567890 description: Payment processor charge ID invoice: type: string example: in_1234567890 description: Payment processor invoice ID example: stripe: payment_intent: pi_1234567890 charge: ch_1234567890 invoice: in_1234567890 AuthMiddlewareError: type: object description: > Raw error body produced by the authentication layer (before any endpoint runs). It is not the standardized envelope: there is no `success` and no `timestamp`. required: - message properties: message: type: string description: >- Human-readable reason. Some messages are in Spanish; branch on the HTTP status, not on this text. example: Unauthorized error: type: string description: >- OAuth error code. Present only when an OAuth access token was presented. enum: - invalid_token - token_expired - token_revoked - server_error example: token_expired error_description: type: string description: Same text as `message`. Present only alongside `error`. example: Access token has expired. Please refresh your token. details: description: >- Extra detail, e.g. `Invalid API Key` when a revoked key is rejected with `403`. oneOf: - type: string - type: object example: Invalid API Key UnauthorizedError: allOf: - $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 ClientAddress: type: object additionalProperties: false properties: country: example: MEX type: string nullable: true maxLength: 3 street: example: Av. Insurgentes Sur type: string nullable: true zip: example: '03100' type: string nullable: true city: example: Ciudad de México type: string nullable: true state: example: CDMX type: string nullable: true exterior: example: '123' type: string nullable: true interior: example: 4B type: string nullable: true municipality: example: Benito Juárez type: string nullable: true neighborhood: example: Del Valle type: string nullable: true ApiPublicService: type: object required: - team - created_at properties: id: type: string nullable: true example: service_1234567890 description: Unique service identifier description: type: string nullable: true example: Consulting services description: Service description from: type: string nullable: true example: api description: >- Source of service creation. Documents created through the public API are stored with `api`; requests carrying the `X-Gigstack-Client: mcp` header (the gigstack MCP server) are stored with `mcp` and behave identically. sku: type: string nullable: true example: CONS-001 description: Stock Keeping Unit identifier product_key: type: string nullable: true example: '80141503' description: SAT product key for tax compliance unit_key: type: string nullable: true example: E48 description: SAT unit key for tax compliance unit_name: type: string nullable: true example: Servicio description: Unit name for the service unit_price: type: number nullable: true example: 1000 description: Price per unit taxes: type: array items: $ref: '#/components/schemas/TaxElement' nullable: true description: Tax configuration for this service team: type: string example: team_1234567890 description: Team ID this service belongs to created_at: type: number example: 1677651234 description: Unix timestamp of service creation quantity: type: number nullable: true example: 1 description: Quantity (used in transactions) discount: type: number nullable: true description: Discount applied to the item. third_party: type: object nullable: true description: >- Third party on whose behalf the item is billed (A cuenta de terceros). properties: legal_name: type: string tax_id: type: string tax_system: type: string zip: type: string item_complement: type: object nullable: true description: Item-level CFDI complement, when configured. ApiPublicThirdParty: type: object required: - legal_name - tax_id - tax_system - zip properties: legal_name: type: string example: Third Party SA de CV description: Legal name of the third party tax_id: type: string example: TPR800101ABC description: RFC (Tax ID) of the third party tax_system: type: string example: '601' description: SAT tax system code zip: type: string example: '03100' description: Postal code of the third party ApiPublicSearch: type: object required: - on_key - on_value - auto_create properties: on_key: type: string example: tax_id description: Field to search on on_value: type: string example: PEGJ800101ABC description: Value to search for auto_create: type: boolean example: true description: Whether to create the resource if not found safety_check: type: boolean example: false description: >- When true, prevents using multiple matching results (returns error). When false, uses the first result found. Default: false TaxElement: type: object required: - type - rate properties: base: oneOf: - type: number nullable: true - type: string nullable: true example: 100 description: >- Taxable base amount. Accepts number or numeric string. If null, calculated automatically from item price. factor: type: string nullable: true example: Tasa description: SAT tax factor (Tasa, Cuota, Exento) inclusive: type: boolean nullable: true example: false description: Whether the tax is included in the unit price rate: type: number example: 0.16 description: Tax rate (e.g., 0.16 for 16% IVA) type: type: string enum: - IVA - ISR - IEPS example: IVA description: Type of tax withholding: type: boolean nullable: true example: false description: Whether this is a withholding tax responses: Unauthorized: description: > Authentication failed. Two different bodies can come back with a `401`: 1. **From the authentication layer**, before the endpoint runs: a raw object with `message` and — for OAuth access tokens only — `error` / `error_description`. It does **not** use the standardized envelope (`success` and `timestamp` are absent). Messages: `Unauthorized` (missing header, missing `Bearer ` prefix, unparseable token), `Unauthorized, missing team in token`, `Unauthorized, not a master team` and `Unauthorized, no matched teams` (gigstack Connect), `Invalid access token`, `Access token has expired. Please refresh your token.`, `Access token has been revoked`. 2. **From the endpoint itself**: the standardized envelope with `error.code: unauthorized`. Branch on the HTTP status, not on the body shape. content: application/json: schema: anyOf: - $ref: '#/components/schemas/AuthMiddlewareError' - $ref: '#/components/schemas/UnauthorizedError' examples: missing_or_invalid_key: summary: Authentication layer — missing or unparseable API key value: message: Unauthorized oauth_token_expired: summary: Authentication layer — expired OAuth access token value: message: Access token has expired. Please refresh your token. error: token_expired error_description: Access token has expired. Please refresh your token. connect_not_master_team: summary: >- Authentication layer — `team` sent by a team without gigstack Connect value: message: Unauthorized, not a master team endpoint_envelope: summary: Endpoint — standardized envelope value: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 ServerError: description: >- Unexpected server error (`error.code: internal_server_error`). The failure is logged on gigstack's side. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: internal_server_error message: An internal server error occurred timestamp: 1767225600000 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": … }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.