> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # Read an existing authorized historical PDF or XML > Independently rechecks the original credential, current payment-link and target module viewing permission, exact document ID, team and current mode. Saved and nested references grant no authority. Current runtime project bucket and exact invoice/files-subdocument storage path are enforced. No document generation, download-token minting, Storage metadata writes or provider writes occur. Current authority and document/files snapshots are checked again after read-only Storage awaits. Returns existing inline/offloaded bytes only on this explicit file-read request; absent or unreadable files return available:false and file:null without retry. Filename and MIME type are pinned to the authorized resource and selected PDF/XML kind. ## OpenAPI ````yaml openapi.json GET /payments/links/{linkId}/history/{resourceType}/{resourceId}/files/{fileType} openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Internal partner provisioning is outside this public contract; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /payments/links/{linkId}/history/{resourceType}/{resourceId}/files/{fileType}: get: tags: - Payments summary: Read an existing authorized historical PDF or XML description: >- Independently rechecks the original credential, current payment-link and target module viewing permission, exact document ID, team and current mode. Saved and nested references grant no authority. Current runtime project bucket and exact invoice/files-subdocument storage path are enforced. No document generation, download-token minting, Storage metadata writes or provider writes occur. Current authority and document/files snapshots are checked again after read-only Storage awaits. Returns existing inline/offloaded bytes only on this explicit file-read request; absent or unreadable files return available:false and file:null without retry. Filename and MIME type are pinned to the authorized resource and selected PDF/XML kind. operationId: getPaymentLinkHistoryFileV2 parameters: - name: linkId in: path required: true schema: type: string - name: resourceType in: path required: true schema: enum: - invoices - receipts type: string - name: resourceId in: path required: true schema: pattern: ^[A-Za-z0-9_-]{1,160}$ type: string - name: fileType in: path required: true schema: enum: - pdf - xml type: string - $ref: '#/components/parameters/TeamParameter' responses: '200': description: Existing authorized file bytes or truthful unavailability content: application/json: schema: $ref: '#/components/schemas/PaymentLinkHistoryFileResponse' '400': description: Invalid kind or identifier '403': description: Current credential or module permission refused '404': description: Missing or out-of-scope link, saved reference or resource '409': description: Resource, files or selected mode changed while reading '503': description: Read unconfirmed components: parameters: TeamParameter: name: team in: query required: false schema: type: string description: > **gigstack Connect:** Target team ID for multi-team access. Requires gigstack Connect enabled on your team and shared billing account. Also requires the `multipleIssuerAccounts` feature on your plan. Requests targeting a team other than the one your API key belongs to return `403` without it. Only API keys can use it: an OAuth access token sent with another team's id is rejected with `403 Team mismatch with OAuth token`. **Optional — omit it entirely** unless you are acting on another team. It deliberately carries no example value so generated snippets do not emit `?team=undefined`; when the parameter is absent, the team is derived from your API key. **Example:** `?team=team_xyz789` schemas: PaymentLinkHistoryFileResponse: type: object additionalProperties: false required: - success - data properties: success: type: boolean enum: - true data: properties: resource_type: enum: - invoices - receipts type: string resource_id: type: string team_id: type: string livemode: type: boolean storage_project_id: pattern: ^[a-z][a-z0-9-]{4,62}$ type: string available: type: boolean file: anyOf: - properties: kind: enum: - pdf - xml type: string filename: type: string type: enum: - application/pdf - application/xml type: string content: type: string size_bytes: type: integer minimum: 0 additionalProperties: false required: - kind - filename - type - content - size_bytes type: object - type: object nullable: true enum: - null additionalProperties: false required: - resource_type - resource_id - team_id - livemode - storage_project_id - available - file type: object securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": … }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.