> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # Create retention > Create and stamp a new tax retention document (CFDI Retenciones 2.0). The API accepts a **simplified format** — the backend handles: - **Client lookup** by ID (fetches RFC, legal name, address automatically) - **Nationality detection** from client's country - **Tax code mapping** (`ISR` → 001, `IVA` → 002, `IEPS` → 003) - **Payment type defaults** per tax (ISR → provisional, IVA/IEPS → definitivo) - **Totals auto-calculation** (taxable = operation − exempt, retained = sum of taxes) - **Folio auto-generation** - SAT stamping, PDF and XML generation **gigstack Connect:** Create retentions for other teams using the `team` parameter. ## Conditional requirements per `retention_key` `retention_key` is validated as a free-form string — any SAT key is accepted — but three keys carry extra requirements enforced before the document is stamped. A violation returns `400` with `error.code: invalid_request_body` and the message quoted below. | `retention_key` | additional requirement | error message on violation | |---|---|---| | `16` — Intereses | `interest` object is required | `interest object is required for retention key 16 (Intereses)` | | `25` — Otro tipo de retenciones | `retention_description` is required and non-empty | `retention_description is required for retention key 25 (Otro tipo de retenciones)` | | `26` — Plataformas Tecnológicas | `platform_services` object is required **and** `taxes` must contain at least one entry whose `tax` is not `IVA` (i.e. `ISR` or `IEPS`) | `platform_services object is required for retention key 26 (Plataformas Tecnológicas)` / `At least one non-IVA tax (ISR or IEPS) is required for Plataformas Tecnológicas` | Every other key requires only the base fields (`retention_key`, `client`, `period_start`, `period_end`, `period_year`, `total_operation`, `taxes`). Within `interest`, `financial_system`, `nominal_interest` and `real_interest` are required. Within `platform_services`, `periodicity` and `services` are required, and each entry in `services` requires `payment_form`, `service_type`, `service_date` and `price_without_tax`. > Unlike the other modules, this endpoint **strips** unknown keys instead of rejecting > them (`stripUnknown: true`), so an undeclared field is silently discarded rather than > returning `400`. ## OpenAPI ````yaml openapi.json POST /retentions openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Signup requires its separately documented internal credential; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] tags: - name: gigstack Connect description: > **Multi-Team Resource Access** gigstack Connect lets a master team act on other teams that share its billing account. ## 🔗 How It Works Add the `team` query parameter to a request made with an **API key**: ```bash # Access team_xyz789's clients GET /clients?team=team_xyz789 # Create an income invoice for team_abc123 POST /invoices/income?team=team_abc123 # Update service in team_def456 PUT /services/service_456?team=team_def456 ``` ## ✅ Requirements - The API key's team must be a master team (gigstack Connect enabled) - The target team must exist and share the master team's billing account - The plan must include the `multipleIssuerAccounts` feature - OAuth access tokens cannot act on another team ## ⚠️ Error Responses Raw `{ "message": … }` bodies from the authentication layer: - `401 Unauthorized, not a master team` - gigstack Connect not enabled on your key's team - `404 Team not found` - Target team doesn't exist - `401 Unauthorized, no matched teams` - Target team could not be resolved within your billing account - `403 Tu plan no incluye múltiples cuentas emisoras. …` - Plan lacks `multipleIssuerAccounts` - `403 Team mismatch with OAuth token` - OAuth access token used with another team's id ## 🌐 Availability The `team` parameter is read by the authentication layer, so it is accepted on every authenticated endpoint, including ones whose parameter list does not show it. - name: Clients description: Client management operations with Mexican tax compliance - name: Services description: Service and product catalog management with SAT product keys - name: Invoices description: Invoice management with CFDI 4.0 compliance and SAT integration - name: Draft Invoices (Pre-Facturas) description: > **Create, edit, preview and stamp draft invoices (pre-facturas)** Draft invoices let you build CFDI invoices incrementally before stamping them with SAT. Use them as **pre-facturas** — generate a preview PDF with a "Sin Validez Fiscal" watermark to share with your client for approval, then stamp the draft to create a valid CFDI when ready. ## Typical Workflow 1. `POST /invoices/draft` — Create a draft with minimal data 2. `PUT /invoices/draft/{id}` — Update as more data becomes available 3. `POST /invoices/draft/{id}/preview` — Generate a preview PDF (pre-factura) 4. `POST /invoices/draft/{id}/stamp` — Finalize into a valid CFDI invoice - name: Descarga Masiva SAT description: > **SAT bulk invoice download via FIEL authentication** Download all your issued and received CFDI invoices directly from the SAT (Servicio de Administración Tributaria) using your FIEL (Firma Electrónica Avanzada). ## Setup flow 1. `GET /invoices/download/activate/status` — Check if activated and what's needed 2. `POST /invoices/download/activate` — Activate billing (adds Stripe meter/add-on) 3. `POST /invoices/download/fiel` — Upload `.cer` + `.key` files (auto-registers with SAT) 4. `PUT /invoices/download/schedule` — Configure daily auto-sync 5. `POST /invoices/download/request` — Submit manual download requests ## Pricing - Included in Pro/Business plans: only the download meter ($0.20 MXN/XML) - Other paid plans: the same $0.20 MXN/XML download meter, no monthly base fee - name: Payments description: Payment processing, tracking, and refund management - name: Receipts description: Receipt creation and management with CFDI stamping capabilities - name: Retentions description: >- Tax retention documents (CFDI Retenciones 2.0) — creation, stamping, cancellation, and file retrieval - name: Platform Payouts description: > **Plan and stamp a marketplace's provider payouts from two files.** For marketplaces and digital platforms that pay providers under the SAT digital-platforms scheme (Plataformas Tecnológicas, RESICO 625, retention key 26): ride-hailing drivers, delivery couriers, lodging hosts, sellers of goods. Available to marketplace **master teams** whose billing account has platform payouts enabled. Upload a movements file and a commissions file. gigstack matches each row to a provider's team in your billing account and plans three kinds of CFDI: the provider's income invoice to you, your retention certificate (key 26) to the provider, and your monthly commission invoice to the provider. **Not for your own sales.** This is for a platform invoicing on behalf of its providers. A company invoicing its own sales, one CFDI per sale, should use `POST /invoices/income`. **Tax policy per account.** Which documents are issued, and with which SAT keys and rates, is set per master account at onboarding: allowed tax regimes, CSD requirement, service type (`tipoDeServ` / `subTipServ`), ISR and IVA withholding rates, product keys and concept descriptions. The defaults are for ground passenger transport (service type `01`, 2.1% ISR withholding). Contact support to configure your account's policy; it can't be changed through the API. 1. `POST /platform-payouts` with an `Idempotency-Key` - upload and plan (synchronous) 2. `GET /platform-payouts/{id}` and `GET /platform-payouts/{id}/movements` - review the plan 3. `POST /platform-payouts/{id}/confirm` - irreversible hand-off to the stamping worker 4. `GET /platform-payouts/{id}` - poll until `completed` or `failed`, then read `result` (`completed`, `partially_completed` or `failed`) Error messages and exclusion reasons are Spanish sentences for end users; branch on `error.code`, `reason_code` and `exclusion_codes`. - name: Documents description: > SAT supporting documentation (contracts, delivery/payment proofs, communications) — upload metadata, compliance review, AI extraction, and linking to invoices, payments, receipts and clients. - name: Teams description: Team management, settings, and member administration - name: Users description: User account management and password operations - name: Auth description: > **API-only signup for AI agents and partner integrations.** A single `POST /v2/auth/signup` call provisions a Firebase Auth user, billing account, team, plan subscription, and returns API keys — no UI, no FIEL upload, no human onboarding required. Designed for the AI-agents-as-customers use case. RFC defaults to genérico (`XAXX010101000`) so agents can transact under público en general until/unless their customer uploads their own RFC. Authenticated with `X-Internal-API-Key` (partner-issued) — Bearer tokens are team-scoped and a brand-new caller doesn't have one yet. See `AGENTS.md` in the gigstack-cli repo for end-to-end integration guide. - name: Webhooks description: Webhook management for real-time event notifications - name: Catalogs description: > **Read-only search over the SAT catalogs** Look up the SAT codes required on CFDI line items without hardcoding them: - `GET /catalogs/product-keys` — `c_ClaveProdServ`, the item `product_key` - `GET /catalogs/unit-keys` — `c_ClaveUnidad`, the item `unit_key` / `unit_name` Both are typo-tolerant full-text searches ranked by relevance. The catalogs are published by the SAT and identical for every team, so results carry no team data and ignore `livemode` — but a valid API key is still required. - name: SAT Lists description: > Read-only access to the RFC lists the SAT publishes under Artículo 69, 69-B and 69-B Bis. gigstack re-syncs all 22 lists from the SAT's published CSVs every Sunday, so you can screen a counterparty's RFC before invoicing it without scraping the SAT yourself. externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /retentions: post: tags: - Retentions summary: Create retention description: > Create and stamp a new tax retention document (CFDI Retenciones 2.0). The API accepts a **simplified format** — the backend handles: - **Client lookup** by ID (fetches RFC, legal name, address automatically) - **Nationality detection** from client's country - **Tax code mapping** (`ISR` → 001, `IVA` → 002, `IEPS` → 003) - **Payment type defaults** per tax (ISR → provisional, IVA/IEPS → definitivo) - **Totals auto-calculation** (taxable = operation − exempt, retained = sum of taxes) - **Folio auto-generation** - SAT stamping, PDF and XML generation **gigstack Connect:** Create retentions for other teams using the `team` parameter. ## Conditional requirements per `retention_key` `retention_key` is validated as a free-form string — any SAT key is accepted — but three keys carry extra requirements enforced before the document is stamped. A violation returns `400` with `error.code: invalid_request_body` and the message quoted below. | `retention_key` | additional requirement | error message on violation | |---|---|---| | `16` — Intereses | `interest` object is required | `interest object is required for retention key 16 (Intereses)` | | `25` — Otro tipo de retenciones | `retention_description` is required and non-empty | `retention_description is required for retention key 25 (Otro tipo de retenciones)` | | `26` — Plataformas Tecnológicas | `platform_services` object is required **and** `taxes` must contain at least one entry whose `tax` is not `IVA` (i.e. `ISR` or `IEPS`) | `platform_services object is required for retention key 26 (Plataformas Tecnológicas)` / `At least one non-IVA tax (ISR or IEPS) is required for Plataformas Tecnológicas` | Every other key requires only the base fields (`retention_key`, `client`, `period_start`, `period_end`, `period_year`, `total_operation`, `taxes`). Within `interest`, `financial_system`, `nominal_interest` and `real_interest` are required. Within `platform_services`, `periodicity` and `services` are required, and each entry in `services` requires `payment_form`, `service_type`, `service_date` and `price_without_tax`. > Unlike the other modules, this endpoint **strips** unknown keys instead of rejecting > them (`stripUnknown: true`), so an undeclared field is silently discarded rather than > returning `400`. operationId: createRetentions parameters: - $ref: '#/components/parameters/TeamParameter' requestBody: required: true content: application/json: schema: type: object required: - retention_key - client - period_start - period_end - period_year - total_operation - taxes properties: retention_key: type: string description: >- SAT retention type code (01-26). E.g. "26" for Plataformas Tecnológicas example: '26' client: type: object description: > Client reference. Same format as invoices/payments. Three modes: - **By ID:** `{ id: "client_123" }` — looks up existing client - **By search:** `{ search: { on_key: "tax_id", on_value: "XAXX010101000", auto_create: true } }` — finds or creates - **Inline:** `{ tax_id: "XAXX010101000", legal_name: "EMPRESA SA", address: { zip: "06700" } }` — creates on-the-fly properties: id: type: string description: Existing client ID search: type: object description: Search for client by field value properties: on_key: type: string description: Field to search on (e.g. "tax_id", "email", "rfc") on_value: type: string description: Value to match auto_create: type: boolean description: Create client if not found (default false) safety_check: type: boolean description: Fail if multiple clients match (default false) tax_id: type: string description: RFC / Tax ID (for inline creation) legal_name: type: string description: Legal name (for inline creation) email: type: string name: type: string address: type: object properties: zip: type: string country: type: string street: type: string state: type: string tax_system: type: string description: Tax system code (e.g. "601") period_start: type: number description: Start month (1-12) example: 1 period_end: type: number description: End month (1-12) example: 3 period_year: type: number description: Fiscal year example: 2026 total_operation: type: number description: >- Total operation amount. Taxable amount is auto-calculated as `total_operation - total_exempt` example: 93116.98 total_exempt: type: number nullable: true description: Total exempt amount (defaults to 0) example: 0 taxes: type: array description: >- Retained taxes. Use friendly names (ISR, IVA, IEPS) — SAT codes are mapped automatically items: type: object required: - tax - base - amount properties: tax: type: string description: >- Tax name: ISR, IVA, or IEPS (mapped to SAT codes 001, 002, 003) example: ISR base: type: number description: Tax base amount example: 93116.98 amount: type: number description: Retained amount example: 2327.92 payment_type: type: string nullable: true description: >- Override payment type (01=Definitivo, 03=Provisional). Defaults: ISR→03, IVA→01, IEPS→01 series: type: string nullable: true description: Series for folio management (defaults to "RET") metadata: type: object nullable: true description: Custom metadata idempotency_key: type: string nullable: true description: >- Optional stored reference. This handler does not claim or replay this key to prevent duplicate issuance. Reconcile an ambiguous result before another request; do not assume retry safety. retention_description: type: string nullable: true description: >- Required only for key "25" (Otro tipo de retenciones). Free-text description of the retention type. interest: type: object nullable: true description: >- Required only for key "16" (Intereses). Financial interest complement data. properties: financial_system: type: string description: Financial system flag (SI/NO) enum: - SI - 'NO' withdrawal_aores: type: string nullable: true description: Retiro AORES flag (SI/NO) enum: - SI - 'NO' - null financial_derivatives: type: string nullable: true description: Financial derivatives flag (SI/NO) enum: - SI - 'NO' - null nominal_interest: type: number description: Nominal interest amount (3 decimal places) real_interest: type: number description: Real interest amount (3 decimal places) loss: type: number nullable: true description: Loss amount (3 decimal places) platform_services: type: object nullable: true description: >- Required only for key "26" (Plataformas Tecnológicas). Service details for technology platform retentions. Header totals (IVA trasladado, ISR retenido, etc.) are auto-calculated. required: - periodicity - services properties: periodicity: type: string description: >- Reporting periodicity: 01=Diario, 02=Semanal, 03=Quincenal, 04=Mensual, 05=Bimestral example: '04' services: type: array description: Individual service entries items: type: object required: - payment_form - service_type - service_date - price_without_tax properties: payment_form: type: string description: >- Payment form: 01=Efectivo, 02=Transferencia, 03=Tarjeta débito, 04=Tarjeta crédito, 05=Monedero electrónico example: '02' service_type: type: string description: >- Service type: 01=Transporte terrestre, 02=Entrega alimentos, 03=Hospedaje, 04=Otros example: '01' service_date: type: string description: Service date (YYYY-MM-DD) example: '2026-01-15' price_without_tax: type: number description: Service price without IVA example: 500 tax_rate: type: number nullable: true description: IVA tax rate (defaults to 0.16 = 16%) example: 0.16 commission: type: number nullable: true description: Platform commission amount example: 125 government_contribution: type: number nullable: true description: Government contribution amount (if applicable) examples: plataformas_tecnologicas: summary: Plataformas Tecnológicas (key 26) — with services complement description: >- Digital platform retention (Uber, Rappi, etc.). Requires platform_services with service details. Header totals are auto-calculated from services and taxes. value: retention_key: '26' client: id: abc123clientId period_start: 1 period_end: 1 period_year: 2026 total_operation: 93116.98 total_exempt: 0 taxes: - tax: ISR base: 93116.98 amount: 2327.92 - tax: IVA base: 14898.71 amount: 7449.35 platform_services: periodicity: '04' services: - payment_form: '02' service_type: '01' service_date: '2026-01-10' price_without_tax: 46558.49 tax_rate: 0.16 commission: 11639.62 - payment_form: '02' service_type: '01' service_date: '2026-01-20' price_without_tax: 46558.49 tax_rate: 0.16 commission: 11639.62 intereses: summary: Intereses (key 16) — with interest complement description: >- Interest income retention. Requires the interest object with financial system details. value: retention_key: '16' client: search: on_key: tax_id on_value: BNK200101ABC auto_create: false period_start: 1 period_end: 12 period_year: 2026 total_operation: 150000 total_exempt: 0 taxes: - tax: ISR base: 150000 amount: 3000 interest: financial_system: SI withdrawal_aores: 'NO' financial_derivatives: 'NO' nominal_interest: 8500.5 real_interest: 5200.3 loss: 0 honorarios_profesionales: summary: Honorarios profesionales (key 01) — ISR only description: >- Professional fees retention. Only ISR is withheld (typically 10% of the gross amount). value: retention_key: '01' client: id: client_professional_abc period_start: 1 period_end: 3 period_year: 2026 total_operation: 50000 total_exempt: 0 taxes: - tax: ISR base: 50000 amount: 5000 arrendamiento: summary: Arrendamiento (key 02) — ISR + IVA description: >- Rental income retention. ISR (10%) and IVA (2/3 of IVA) are withheld. value: retention_key: '02' client: id: client_landlord_xyz period_start: 1 period_end: 1 period_year: 2026 total_operation: 30000 total_exempt: 0 taxes: - tax: ISR base: 30000 amount: 3000 - tax: IVA base: 4800 amount: 3200 with_exempt_and_metadata: summary: With exempt amount, series, and metadata description: >- Full example with all optional fields. Taxable amount is auto-calculated as total_operation minus total_exempt. value: retention_key: '14' client: tax_id: EMP200101ABC legal_name: EMPRESA EJEMPLO SA DE CV address: zip: '06700' country: MEX period_start: 1 period_end: 6 period_year: 2026 total_operation: 100000 total_exempt: 20000 taxes: - tax: ISR base: 80000 amount: 8000 - tax: IVA base: 12800 amount: 8533.33 series: RET-A metadata: internal_ref: Q1-2026-RETENTION department: finance idempotency_key: ret-2026-q1-client456 otro_tipo_retenciones: summary: Otro tipo de retenciones (key 25) — with description description: >- Generic retention type. Requires retention_description to describe the type of retention. value: retention_key: '25' client: id: client_misc_abc period_start: 1 period_end: 6 period_year: 2026 total_operation: 40000 total_exempt: 0 taxes: - tax: ISR base: 40000 amount: 4000 retention_description: >- Retención por servicios de consultoría especializada en seguridad informática isr_only_with_custom_payment_type: summary: ISR with custom payment type override description: >- Override the default payment type. By default ISR uses "03" (provisional), but you can set it to "01" (definitivo) if needed. value: retention_key: '01' client: id: client_consultant_789 period_start: 3 period_end: 3 period_year: 2026 total_operation: 25000 taxes: - tax: ISR base: 25000 amount: 2500 payment_type: '01' responses: '201': description: Retention created and stamped successfully content: application/json: schema: $ref: '#/components/schemas/StandardSuccessResponse' examples: success: summary: Retention stamped successfully value: message: Retention created successfully data: id: 9d9b0e5b-034c-42f7-bd21-3a868a57c13e uuid: 9d9b0e5b-034c-42f7-bd21-3a868a57c13e status: valid document_type: retenciones retention_key: '26' folio_number: '1' series: RET issuer: legal_name: MI EMPRESA SA DE CV tax_id: MEE200101ABC tax_system: '601' receiver: legal_name: GRUPO JINIM tax_id: EKU9003173C9 nationality: Nacional period: start: 1 end: 1 year: 2026 totals: total_operation: 93116.98 total_taxable: 93116.98 total_exempt: 0 total_retained: 9777.27 tax_retained: - tax: '001' base: 93116.98 amount: 2327.92 payment_type: '03' - tax: '002' base: 14898.71 amount: 7449.35 payment_type: '01' stamp: uuid: 9d9b0e5b-034c-42f7-bd21-3a868a57c13e stamped_at: '2026-01-15T10:30:45.000Z' verification_url: >- https://verificacfdi.facturaelectronica.sat.gob.mx/default.aspx?id=9d9b0e5b-034c-42f7-bd21-3a868a57c13e&re=MEE200101ABC&rr=EKU9003173C9&tt=93116.98&fe=abcd1234 livemode: true created_at: 1736942445000 metadata: null success: true timestamp: 1767225600000 '400': description: Bad request or stamping error content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' examples: validation_error: summary: Missing required fields value: error: code: bad_request message: >- retention_key: Missing required field; taxes: Missing required field success: false timestamp: 1767225600000 client_not_found: summary: Client ID not found value: error: code: bad_request message: 'Client not found: invalid_client_id' success: false timestamp: 1767225600000 no_provider: summary: No SAT provider configured value: error: code: bad_request message: No SAT provider configured for this team success: false timestamp: 1767225600000 stamping_error: summary: SAT stamping failed value: error: code: cfdi_service_error message: >- CFDI33184 - El valor del atributo RFC del receptor no existe en la lista de RFC inscritos no cancelados del SAT success: false timestamp: 1767225600000 '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/AuthForbidden' security: - bearerAuth: [] components: parameters: TeamParameter: name: team in: query required: false schema: type: string description: > **gigstack Connect:** Target team ID for multi-team access. Requires gigstack Connect enabled on your team and shared billing account. Also requires the `multipleIssuerAccounts` feature on your plan. Requests targeting a team other than the one your API key belongs to return `403` without it. Only API keys can use it: an OAuth access token sent with another team's id is rejected with `403 Team mismatch with OAuth token`. **Optional — omit it entirely** unless you are acting on another team. It deliberately carries no example value so generated snippets do not emit `?team=undefined`; when the parameter is absent, the team is derived from your API key. **Example:** `?team=team_xyz789` schemas: StandardSuccessResponse: type: object description: | Standardized success envelope emitted by `sendSuccessResponse`. required: - success - data - timestamp properties: success: type: boolean enum: - true example: true data: type: object description: The operation payload. message: type: string description: Human-readable summary. Present only when the handler supplies one. example: Operation completed successfully timestamp: type: integer format: int64 description: Server time in **epoch milliseconds** (`Luxon.now().toMillis()`). example: 1767225600000 ValidationErrorResponse: allOf: - $ref: '#/components/schemas/StandardErrorResponse' description: > Body validation failure. Unknown top-level keys are rejected — the validator runs in strict allowlist mode (`allowUnknown: false`), so a field not declared in the request schema produces an `unexpected_key` detail rather than being ignored. example: success: false error: code: validation_failed message: Request validation failed details: - 'currency: Field is required' - 'client_id: Unexpected field' timestamp: 1767225600000 StandardErrorResponse: type: object description: > Standardized error envelope emitted by `sendErrorResponse` and its helpers (`sendValidationError`, `sendNotFoundError`, `sendUnauthorizedError`, `sendForbiddenError`, `sendConflictError`, `sendBadRequestError`, `sendInternalServerError`). required: - success - error - timestamp properties: success: type: boolean enum: - false example: false error: type: object required: - code - message properties: code: type: string description: > Stable machine-readable code. Values emitted by the shared helpers: `unauthorized`, `forbidden`, `invalid_token`, `validation_failed`, `invalid_request_body`, `missing_required_field`, `invalid_field_value`, `resource_not_found`, `resource_already_exists`, `resource_conflict`, `business_rule_violation`, `operation_not_allowed`, `insufficient_permissions`, `external_service_error`, `payment_processor_error`, `cfdi_service_error`, `internal_server_error`, `service_unavailable`, `rate_limit_exceeded`, `database_error`, `data_integrity_error`, `file_not_found`, `file_upload_error`, `invalid_file_format`. Individual handlers may emit additional endpoint-specific codes, documented per operation. example: validation_failed message: type: string example: Request validation failed details: oneOf: - type: string - type: array items: type: string description: > Present only when the handler supplies detail. Validation failures emit an array of `": "` strings. example: - 'currency: Field is required' timestamp: type: integer format: int64 description: Server time in epoch milliseconds. example: 1767225600000 AuthMiddlewareError: type: object description: > Raw error body produced by the authentication layer (before any endpoint runs). It is not the standardized envelope: there is no `success` and no `timestamp`. required: - message properties: message: type: string description: >- Human-readable reason. Some messages are in Spanish; branch on the HTTP status, not on this text. example: Unauthorized error: type: string description: >- OAuth error code. Present only when an OAuth access token was presented. enum: - invalid_token - token_expired - token_revoked - server_error example: token_expired error_description: type: string description: Same text as `message`. Present only alongside `error`. example: Access token has expired. Please refresh your token. details: description: >- Extra detail, e.g. `Invalid API Key` when a revoked key is rejected with `403`. oneOf: - type: string - type: object example: Invalid API Key UnauthorizedError: allOf: - $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 responses: Unauthorized: description: > Authentication failed. Two different bodies can come back with a `401`: 1. **From the authentication layer**, before the endpoint runs: a raw object with `message` and — for OAuth access tokens only — `error` / `error_description`. It does **not** use the standardized envelope (`success` and `timestamp` are absent). Messages: `Unauthorized` (missing header, missing `Bearer ` prefix, unparseable token), `Unauthorized, missing team in token`, `Unauthorized, not a master team` and `Unauthorized, no matched teams` (gigstack Connect), `Invalid access token`, `Access token has expired. Please refresh your token.`, `Access token has been revoked`. 2. **From the endpoint itself**: the standardized envelope with `error.code: unauthorized`. Branch on the HTTP status, not on the body shape. content: application/json: schema: anyOf: - $ref: '#/components/schemas/AuthMiddlewareError' - $ref: '#/components/schemas/UnauthorizedError' examples: missing_or_invalid_key: summary: Authentication layer — missing or unparseable API key value: message: Unauthorized oauth_token_expired: summary: Authentication layer — expired OAuth access token value: message: Access token has expired. Please refresh your token. error: token_expired error_description: Access token has expired. Please refresh your token. connect_not_master_team: summary: >- Authentication layer — `team` sent by a team without gigstack Connect value: message: Unauthorized, not a master team endpoint_envelope: summary: Endpoint — standardized envelope value: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 AuthForbidden: description: > Rejected by the authentication layer after the credential was recognised. The body is a raw object (`message`, sometimes `details`), **not** the standardized envelope. Causes: - The API key was revoked or disabled: `message: "API Key inválida."`, `details: "Invalid API Key"`. - The billing account's plan does not include API access. `message` is a Spanish sentence containing an HTML link to `https://app.gigstack.pro/memberships`. Branch on the status code; do not display or match the text. - gigstack Connect: the plan lacks the `multipleIssuerAccounts` feature (Spanish message starting `Tu plan no incluye múltiples cuentas emisoras.`), or an OAuth access token was sent with a `team` other than its own (`Team mismatch with OAuth token`). An endpoint may also answer `403` for its own reasons; those are documented on the operation when they exist. content: application/json: schema: $ref: '#/components/schemas/AuthMiddlewareError' examples: revoked_api_key: summary: API key revoked or disabled value: message: API Key inválida. details: Invalid API Key plan_without_api_access: summary: Plan does not include API access value: message: >- La API se encuentra disponible para un plan más grande, por favor actualiza tu plan aquí o ponte en contacto con soporte. connect_plan_without_multiple_issuers: summary: gigstack Connect — plan lacks multipleIssuerAccounts value: message: >- Tu plan no incluye múltiples cuentas emisoras. Actualiza tu plan en https://app.gigstack.pro/memberships o ponte en contacto con soporte para operar sobre otros equipos. oauth_team_mismatch: summary: gigstack Connect — OAuth token used for another team value: message: Team mismatch with OAuth token securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": … }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.