> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # Read a account approval > Requires a verified personal Firebase or MCP identity and current action authority. Team API/OAuth keys cannot prepare approvals. Reads and cancellation bind the creator and originating MCP credential/mode. Browser confirmation rechecks current authority, credential validity and relevant account state. Preparation never issues a credential or accepts terms. Read safe state and a metadata receipt. Pending requests need human browser confirmation. Completed requests never reveal secrets, even if their browser response was lost. There is no secret retrieval route. Select an authorized current team with the team query parameter for authentication context; preparation should use the same team as body.team_id. This does not alter the originating credential or mode. Membership actions require the current team owner. Prepare a transfer with payload {new_owner_id}, or an admin promotion/addition with payload {member_id}. The browser reviews the frozen target identity, current role and account-wide consequences. Team membership is shared across production and test: requested_modes is empty for these actions, not a sandbox-only promise. The old owner remains an administrator after transfer; billing-account ownership is unchanged. Membership execution returns no credentials. Ordinary editor/viewer changes and permissions-only patches retain their existing direct routes and authority. Managed session processing/unknown states are safe metadata only. A completed issued receipt does not prove delivery or sign-in. custom_token_expires_at is an exchange deadline, not session expiry. Read status after a lost response; never replay issuance or start a replacement solely because this deadline elapsed. A new intent requires a new explicit human review of the frozen prior attempts. ## OpenAPI ````yaml openapi.json GET /users/me/account-approvals/{id} openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Internal partner provisioning is outside this public contract; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /users/me/account-approvals/{id}: get: tags: - Account Approvals summary: Read a account approval description: >- Requires a verified personal Firebase or MCP identity and current action authority. Team API/OAuth keys cannot prepare approvals. Reads and cancellation bind the creator and originating MCP credential/mode. Browser confirmation rechecks current authority, credential validity and relevant account state. Preparation never issues a credential or accepts terms. Read safe state and a metadata receipt. Pending requests need human browser confirmation. Completed requests never reveal secrets, even if their browser response was lost. There is no secret retrieval route. Select an authorized current team with the team query parameter for authentication context; preparation should use the same team as body.team_id. This does not alter the originating credential or mode. Membership actions require the current team owner. Prepare a transfer with payload {new_owner_id}, or an admin promotion/addition with payload {member_id}. The browser reviews the frozen target identity, current role and account-wide consequences. Team membership is shared across production and test: requested_modes is empty for these actions, not a sandbox-only promise. The old owner remains an administrator after transfer; billing-account ownership is unchanged. Membership execution returns no credentials. Ordinary editor/viewer changes and permissions-only patches retain their existing direct routes and authority. Managed session processing/unknown states are safe metadata only. A completed issued receipt does not prove delivery or sign-in. custom_token_expires_at is an exchange deadline, not session expiry. Read status after a lost response; never replay issuance or start a replacement solely because this deadline elapsed. A new intent requires a new explicit human review of the frozen prior attempts. operationId: getAccountApproval parameters: - name: id in: path schema: type: string pattern: ^[a-f0-9]{64}$ required: true - $ref: '#/components/parameters/TeamParameter' responses: '200': description: >- Safe approval state only. Cache-Control: no-store. Preparation is not issuance; GET and cancellation never return secrets or challenges. headers: Cache-Control: schema: type: string enum: - no-store content: application/json: schema: type: object additionalProperties: false properties: success: type: boolean enum: - true data: $ref: '#/components/schemas/AccountApproval' timestamp: type: number required: - success - data - timestamp example: success: true data: id: >- aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa operation_id: 00000000-0000-4000-8000-000000000001 action: managed_users.issue_session team: id: team_example legal_name: null tax_id: null billing_account_id: billing_example payload: user_id: managed_example requested_modes: [] effect_scope: managed_session status: unknown created_at: 1700000000000 expires_at: 1700000600000 completed_at: null review_url: >- https://app.gigstack.pro/account/approvals/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa can_cancel: false disclosure_version: managed-session-v1 existing_key_ids: [] terms: null receipt: null error: null membership_change: null invitation_change: null managed_identity_change: null managed_identity_execution: null managed_session_change: user_id: managed_example email: managed@example.test auth_creation_time: '2026-01-01T00:00:00Z' billing_account_id: billing_example teams: - id: team_example role: editor billing_accounts: - id: billing_example role: member delivery: browser_once session_scope: firebase_identity prior_attempts: [] managed_session_execution: phase: unknown attempted_at: 1700000000000 custom_token_expires_at: 1700003600000 delivery: not_observable timestamp: 1700000000000 '400': description: Invalid input, unknown fields, or action-specific payload mismatch. '401': description: Verified personal identity required. '403': description: >- Current authority, origin credential and mode, or enabled account checks failed. '404': description: Approval or account not found in authorized scope. '409': description: >- operation_conflict, changed account state, expired/cancelled approval, or active key conflict. '500': description: >- Preparation or state read failed. Preserve the operation ID and exact input; do not generate a replacement as an automatic retry. security: - bearerAuth: [] components: parameters: TeamParameter: name: team in: query required: false schema: type: string description: > **gigstack Connect:** Target team ID for multi-team access. Requires gigstack Connect enabled on your team and shared billing account. Also requires the `multipleIssuerAccounts` feature on your plan. Requests targeting a team other than the one your API key belongs to return `403` without it. Only API keys can use it: an OAuth access token sent with another team's id is rejected with `403 Team mismatch with OAuth token`. **Optional — omit it entirely** unless you are acting on another team. It deliberately carries no example value so generated snippets do not emit `?team=undefined`; when the parameter is absent, the team is derived from your API key. **Example:** `?team=team_xyz789` schemas: AccountApproval: type: object additionalProperties: false properties: id: type: string pattern: ^[a-f0-9]{64}$ operation_id: type: string pattern: >- ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ action: type: string enum: - api_keys.generate - api_keys.rotate - mcp_tokens.create - team.ownership.transfer - team.members.promote_admin - team.members.add_admin - team.invitations.create_admin - billing_account.invitations.create_admin - managed_users.create_admin - managed_users.issue_session - managed_users.revoke_sessions - api_keys.create_scoped - api_keys.rotate_scoped team: type: object additionalProperties: false properties: id: type: string legal_name: type: string nullable: true tax_id: type: string nullable: true required: - id - legal_name - tax_id nullable: true billing_account_id: type: string payload: type: object additionalProperties: false properties: name: type: string minLength: 1 maxLength: 64 livemode: type: boolean new_owner_id: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ member_id: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ email: type: string send_email: type: boolean existing_invitation_id: type: string first_name: type: string nullable: true maxLength: 100 last_name: type: string nullable: true maxLength: 100 phone: type: string nullable: true pattern: ^\+[1-9]\d{7,14}$ company_role: type: string nullable: true maxLength: 100 address: type: object additionalProperties: false properties: country: type: string nullable: true maxLength: 250 street: type: string nullable: true maxLength: 250 zip: type: string nullable: true maxLength: 250 city: type: string nullable: true maxLength: 250 state: type: string nullable: true maxLength: 250 exterior: type: string nullable: true maxLength: 250 municipality: type: string nullable: true maxLength: 250 neighborhood: type: string nullable: true maxLength: 250 nullable: true user_id: type: string billing_account_id: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ team_ids: type: array items: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ minItems: 1 maxItems: 100 action_ids: type: array items: type: string maxLength: 128 minItems: 1 maxItems: 200 expires_at: type: integer manager_user_ids: type: array items: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ maxItems: 100 key_id: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ overlap_seconds: type: integer minimum: 0 maximum: 86400 requested_modes: type: array items: type: boolean effect_scope: type: string enum: - team_credentials - user_access - team_membership - billing_account_membership - managed_identity - managed_session - scoped_api_key status: type: string enum: - pending - completed - cancelled - expired - invalidated - processing - unknown - failed - activation_required created_at: type: number expires_at: type: number completed_at: type: number nullable: true review_url: type: string format: uri can_cancel: type: boolean disclosure_version: type: string enum: - credential-approval-v1 - membership-approval-v1 - invitation-approval-v1 - managed-identity-v1 - managed-session-v1 existing_key_ids: type: array items: type: string terms: type: object additionalProperties: false properties: url: type: string format: uri acceptance_required: type: boolean enum: - true required: - url - acceptance_required nullable: true receipt: type: object additionalProperties: false properties: keys: type: array items: type: object additionalProperties: false properties: key_id: type: string type: type: string enum: - api - mcp livemode: type: boolean required: - key_id - type - livemode revoked_count: type: integer minimum: 0 membership: type: object additionalProperties: false properties: action: type: string enum: - team.ownership.transfer - team.members.promote_admin - team.members.add_admin member_id: type: string owner_id: type: string previous_owner_id: type: string role: type: string enum: - admin is_owner: type: boolean added: type: boolean required: - action - member_id - owner_id - previous_owner_id - role - is_owner - added nullable: true invitation: type: object additionalProperties: false properties: id: type: string type: type: string enum: - team - billingAccount team_id: type: string nullable: true billing_account_id: type: string email: type: string role: type: string enum: - admin expires_at: type: number approval_id: type: string required: - id - type - team_id - billing_account_id - email - role - expires_at - approval_id nullable: true managed_identity: type: object additionalProperties: false properties: user_id: type: string team_id: type: string billing_account_id: type: string role: type: string enum: - admin auth_state: type: string enum: - enabled membership_granted: type: boolean enum: - true required: - user_id - team_id - billing_account_id - role - auth_state - membership_granted nullable: true managed_session: type: object additionalProperties: false properties: user_id: type: string approval_id: type: string action: type: string enum: - managed_users.issue_session - managed_users.revoke_sessions custom_token_expires_at: type: number nullable: true description: >- Custom-token exchange deadline in epoch milliseconds, not the expiry of a redeemed Firebase session. Null for revocation. session_expiration: type: string enum: - not_bounded_by_custom_token revocation_scope: type: string enum: - refresh_tokens_only - null nullable: true required: - user_id - approval_id - action - custom_token_expires_at - session_expiration - revocation_scope nullable: true required: - keys - revoked_count - membership - invitation - managed_identity - managed_session nullable: true error: type: object additionalProperties: false properties: code: type: string message: type: string retryable: type: boolean enum: - false required: - code - message - retryable nullable: true membership_change: type: object additionalProperties: false properties: target: type: object additionalProperties: false properties: id: type: string email: type: string nullable: true display_name: type: string nullable: true required: - id - email - display_name previous_owner_id: type: string previous_role: type: string enum: - admin - editor - viewer - blocked - null nullable: true new_role: type: string enum: - admin transfers_ownership: type: boolean billing_ownership_changes: type: boolean enum: - false hidden_member: type: boolean enum: - false required: - target - previous_owner_id - previous_role - new_role - transfers_ownership - billing_ownership_changes - hidden_member nullable: true invitation_change: type: object additionalProperties: false properties: id: type: string type: type: string enum: - team - billingAccount email: type: string role: type: string enum: - admin team_id: type: string nullable: true billing_account_id: type: string billing_account_name: type: string nullable: true inviter: type: object additionalProperties: false properties: id: type: string email: type: string nullable: true display_name: type: string nullable: true required: - id - email - display_name send_email: type: boolean expires_at: type: number existing_invitation: type: boolean prior_delivery_status: type: string nullable: true required: - id - type - email - role - team_id - billing_account_id - billing_account_name - inviter - send_email - expires_at - existing_invitation - prior_delivery_status nullable: true managed_identity_change: type: object additionalProperties: false properties: user_id: type: string email: type: string profile: type: object additionalProperties: false properties: first_name: type: string nullable: true maxLength: 100 last_name: type: string nullable: true maxLength: 100 phone: type: string nullable: true pattern: ^\+[1-9]\d{7,14}$ company_role: type: string nullable: true maxLength: 100 address: type: object additionalProperties: false properties: country: type: string nullable: true maxLength: 250 street: type: string nullable: true maxLength: 250 zip: type: string nullable: true maxLength: 250 city: type: string nullable: true maxLength: 250 state: type: string nullable: true maxLength: 250 exterior: type: string nullable: true maxLength: 250 municipality: type: string nullable: true maxLength: 250 neighborhood: type: string nullable: true maxLength: 250 nullable: true team_id: type: string billing_account_id: type: string role: type: string enum: - admin auto_join: type: boolean enum: - true credential_delivery: type: string enum: - none initial_auth_state: type: string enum: - disabled bootstrap_effects: type: array items: type: string enum: - profile_initialization - membership_usage_initialization - support_identity_claims minItems: 3 maxItems: 3 required: - user_id - email - profile - team_id - billing_account_id - role - auto_join - credential_delivery - initial_auth_state - bootstrap_effects nullable: true managed_identity_execution: type: object additionalProperties: false properties: phase: type: string enum: - creating - activation_required - activating - complete - failed auth_state: type: string enum: - unknown - disabled - enabled membership_granted: type: boolean started_at: type: number updated_at: type: number error_code: type: string nullable: true required: - phase - auth_state - membership_granted - started_at - updated_at - error_code nullable: true managed_session_change: type: object additionalProperties: false properties: user_id: type: string email: type: string auth_creation_time: type: string billing_account_id: type: string teams: type: array items: type: object additionalProperties: false properties: id: type: string role: type: string description: >- Current access, including inherited billing_account_admin and master_team_billing_access. required: - id - role billing_accounts: type: array items: type: object additionalProperties: false properties: id: type: string role: type: string required: - id - role delivery: type: string enum: - browser_once - none session_scope: type: string enum: - firebase_identity prior_attempts: type: array items: type: object additionalProperties: false properties: approval_id: type: string action: type: string enum: - managed_users.issue_session - managed_users.revoke_sessions phase: type: string enum: - attempting - issued - revoked - unknown attempted_at: type: number custom_token_expires_at: type: number nullable: true description: >- Custom-token exchange deadline in epoch milliseconds, not the expiry of a redeemed Firebase session. Null for revocation. required: - approval_id - action - phase - attempted_at - custom_token_expires_at required: - user_id - email - auth_creation_time - billing_account_id - teams - billing_accounts - delivery - session_scope - prior_attempts nullable: true managed_session_execution: type: object additionalProperties: false properties: phase: type: string enum: - attempting - issued - revoked - unknown attempted_at: type: number custom_token_expires_at: type: number nullable: true description: >- Custom-token exchange deadline in epoch milliseconds, not the expiry of a redeemed Firebase session. Null for revocation. delivery: type: string enum: - not_observable - none required: - phase - attempted_at - custom_token_expires_at - delivery nullable: true scoped_key_change: type: object additionalProperties: false required: - name - livemode - billing_account_id - team_ids - action_ids - expires_at - manager_user_ids - action - previous_key_id - overlap_seconds - previous_revoke_at - unrelated_keys_affected - secret_disclosure properties: name: type: string minLength: 1 maxLength: 64 livemode: type: boolean billing_account_id: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ team_ids: type: array items: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ minItems: 1 maxItems: 100 action_ids: type: array items: type: string maxLength: 128 minItems: 1 maxItems: 200 expires_at: type: integer manager_user_ids: type: array items: type: string pattern: ^[A-Za-z0-9_-]{1,128}$ maxItems: 100 action: type: string enum: - create - rotate previous_key_id: type: string nullable: true overlap_seconds: type: integer minimum: 0 maximum: 86400 previous_revoke_at: type: integer minimum: 0 nullable: true unrelated_keys_affected: type: boolean enum: - false secret_disclosure: type: string enum: - once nullable: true required: - id - operation_id - action - team - billing_account_id - payload - requested_modes - effect_scope - status - created_at - expires_at - completed_at - review_url - can_cancel - disclosure_version - existing_key_ids - terms - receipt - error - membership_change - invitation_change - managed_identity_change - managed_identity_execution - managed_session_change - managed_session_execution securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": … }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.