curl --request GET \
--url https://api.gigstack.io/v2/users/me/account-approvals/{id} \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/account-approvals/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/account-approvals/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": {
"id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"operation_id": "00000000-0000-4000-8000-000000000001",
"action": "managed_users.issue_session",
"team": {
"id": "team_example",
"legal_name": null,
"tax_id": null
},
"billing_account_id": "billing_example",
"payload": {
"user_id": "managed_example"
},
"requested_modes": [],
"effect_scope": "managed_session",
"status": "unknown",
"created_at": 1700000000000,
"expires_at": 1700000600000,
"completed_at": null,
"review_url": "https://app.gigstack.pro/account/approvals/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"can_cancel": false,
"disclosure_version": "managed-session-v1",
"existing_key_ids": [],
"terms": null,
"receipt": null,
"error": null,
"membership_change": null,
"invitation_change": null,
"managed_identity_change": null,
"managed_identity_execution": null,
"managed_session_change": {
"user_id": "managed_example",
"email": "managed@example.test",
"auth_creation_time": "2026-01-01T00:00:00Z",
"billing_account_id": "billing_example",
"teams": [
{
"id": "team_example",
"role": "editor"
}
],
"billing_accounts": [
{
"id": "billing_example",
"role": "member"
}
],
"delivery": "browser_once",
"session_scope": "firebase_identity",
"prior_attempts": []
},
"managed_session_execution": {
"phase": "unknown",
"attempted_at": 1700000000000,
"custom_token_expires_at": 1700003600000,
"delivery": "not_observable"
}
},
"timestamp": 1700000000000
}Read a account approval
Requires a verified personal Firebase or MCP identity and current action authority. Team API/OAuth keys cannot prepare approvals. Reads and cancellation bind the creator and originating MCP credential/mode. Browser confirmation rechecks current authority, credential validity and relevant account state. Preparation never issues a credential or accepts terms.
Read safe state and a metadata receipt. Pending requests need human browser confirmation. Completed requests never reveal secrets, even if their browser response was lost. There is no secret retrieval route. Select an authorized current team with the team query parameter for authentication context; preparation should use the same team as body.team_id. This does not alter the originating credential or mode.
Membership actions require the current team owner. Prepare a transfer with payload , or an admin promotion/addition with payload . The browser reviews the frozen target identity, current role and account-wide consequences. Team membership is shared across production and test: requested_modes is empty for these actions, not a sandbox-only promise. The old owner remains an administrator after transfer; billing-account ownership is unchanged. Membership execution returns no credentials. Ordinary editor/viewer changes and permissions-only patches retain their existing direct routes and authority. Managed session processing/unknown states are safe metadata only. A completed issued receipt does not prove delivery or sign-in. custom_token_expires_at is an exchange deadline, not session expiry. Read status after a lost response; never replay issuance or start a replacement solely because this deadline elapsed. A new intent requires a new explicit human review of the frozen prior attempts.
curl --request GET \
--url https://api.gigstack.io/v2/users/me/account-approvals/{id} \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/account-approvals/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/account-approvals/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": {
"id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"operation_id": "00000000-0000-4000-8000-000000000001",
"action": "managed_users.issue_session",
"team": {
"id": "team_example",
"legal_name": null,
"tax_id": null
},
"billing_account_id": "billing_example",
"payload": {
"user_id": "managed_example"
},
"requested_modes": [],
"effect_scope": "managed_session",
"status": "unknown",
"created_at": 1700000000000,
"expires_at": 1700000600000,
"completed_at": null,
"review_url": "https://app.gigstack.pro/account/approvals/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"can_cancel": false,
"disclosure_version": "managed-session-v1",
"existing_key_ids": [],
"terms": null,
"receipt": null,
"error": null,
"membership_change": null,
"invitation_change": null,
"managed_identity_change": null,
"managed_identity_execution": null,
"managed_session_change": {
"user_id": "managed_example",
"email": "managed@example.test",
"auth_creation_time": "2026-01-01T00:00:00Z",
"billing_account_id": "billing_example",
"teams": [
{
"id": "team_example",
"role": "editor"
}
],
"billing_accounts": [
{
"id": "billing_example",
"role": "member"
}
],
"delivery": "browser_once",
"session_scope": "firebase_identity",
"prior_attempts": []
},
"managed_session_execution": {
"phase": "unknown",
"attempted_at": 1700000000000,
"custom_token_expires_at": 1700003600000,
"delivery": "not_observable"
}
},
"timestamp": 1700000000000
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Path Parameters
^[a-f0-9]{64}$Query Parameters
gigstack Connect: Target team ID for multi-team access.
Requires gigstack Connect enabled on your team and shared billing account.
Also requires the multipleIssuerAccounts feature on your plan. Requests targeting a
team other than the one your API key belongs to return 403 without it.
Only API keys can use it: an OAuth access token sent with another team's id is rejected with
403 Team mismatch with OAuth token.
Optional — omit it entirely unless you are acting on another team. It deliberately
carries no example value so generated snippets do not emit ?team=undefined; when the
parameter is absent, the team is derived from your API key.
Example: ?team=team_xyz789