> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # Get team onboarding status > Where a team stands between test mode and production, in one read. Built for agents (MCP, CLI) that guide a person from a first test invoice to going live. - `stage`: `sandbox_unclaimed` (agent sandbox not claimed yet), `test` (Pricing v3, not live yet) or `live`. Accounts on legacy plans are always `live`. - `checklist`: what going live needs: own RFC and fiscal data, a valid CSD that is not a SAT test certificate, the signed SAT manifest, and the payment method added at go-live (nothing is charged then). - `next_step`: `issue_test_invoice`, `claim_sandbox`, `complete_fiscal_data`, `upload_csd`, `sign_manifest`, `go_live` or `live`. - `go_live_url`: the app page where the person goes live; null once live. Read-only and free of credential material, so the test key of an unclaimed sandbox can read it. Prices are in the public `GET /v2/pricing`. ## OpenAPI ````yaml openapi.json GET /teams/{id}/onboarding openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Internal partner provisioning is outside this public contract; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /teams/{id}/onboarding: get: tags: - Teams summary: Get team onboarding status description: > Where a team stands between test mode and production, in one read. Built for agents (MCP, CLI) that guide a person from a first test invoice to going live. - `stage`: `sandbox_unclaimed` (agent sandbox not claimed yet), `test` (Pricing v3, not live yet) or `live`. Accounts on legacy plans are always `live`. - `checklist`: what going live needs: own RFC and fiscal data, a valid CSD that is not a SAT test certificate, the signed SAT manifest, and the payment method added at go-live (nothing is charged then). - `next_step`: `issue_test_invoice`, `claim_sandbox`, `complete_fiscal_data`, `upload_csd`, `sign_manifest`, `go_live` or `live`. - `go_live_url`: the app page where the person goes live; null once live. Read-only and free of credential material, so the test key of an unclaimed sandbox can read it. Prices are in the public `GET /v2/pricing`. operationId: getTeamsByIdOnboarding parameters: - name: id in: path required: true schema: type: string description: Team ID example: team_1234567890 responses: '200': description: Onboarding status content: application/json: schema: type: object properties: data: type: object properties: team_id: type: string stage: type: string enum: - sandbox_unclaimed - test - live pricing_version: type: string nullable: true live_since: type: integer nullable: true sandbox: type: object nullable: true properties: status: type: string expires_at: type: integer nullable: true checklist: type: object properties: fiscal_data: type: object properties: done: type: boolean rfc: type: string nullable: true test_rfc: type: boolean legal_name: type: string nullable: true tax_system: type: string nullable: true zip: type: string nullable: true missing: type: array items: type: string csd: type: object properties: done: type: boolean state: type: string enum: - missing - test - invalid - expired - valid expires_at: type: integer nullable: true manifest: type: object properties: done: type: boolean payment_method: type: object properties: done: type: boolean test_invoices: type: object properties: count: type: integer nullable: true last_id: type: string nullable: true live_invoices: type: object properties: count: type: integer nullable: true credits: type: object nullable: true description: >- Credit balance of a live Pricing v3 account (same as the billing summary `credits`) next_step: type: string enum: - issue_test_invoice - claim_sandbox - complete_fiscal_data - upload_csd - sign_manifest - go_live - live go_live_url: type: string nullable: true app_url: type: string message: type: string example: data: team_id: team_1234567890 stage: test pricing_version: v3 live_since: null sandbox: null checklist: fiscal_data: done: true rfc: GOMA800101AB1 test_rfc: false legal_name: ANA GOMEZ tax_system: '612' zip: '06600' missing: [] csd: done: false state: missing expires_at: null manifest: done: false payment_method: done: false test_invoices: count: 1 last_id: inv_test_123 live_invoices: count: 0 credits: null next_step: upload_csd go_live_url: https://app.gigstack.pro/home app_url: https://app.gigstack.pro message: Onboarding status retrieved successfully '401': $ref: '#/components/responses/Unauthorized' '404': description: Team not found or outside the authorized account '500': $ref: '#/components/responses/ServerError' security: - bearerAuth: [] components: responses: Unauthorized: description: > Authentication failed. Two different bodies can come back with a `401`: 1. **From the authentication layer**, before the endpoint runs: a raw object with `message` and — for OAuth access tokens only — `error` / `error_description`. It does **not** use the standardized envelope (`success` and `timestamp` are absent). Messages: `Unauthorized` (missing header, missing `Bearer ` prefix, unparseable token), `Unauthorized, missing team in token`, `Unauthorized, not a master team` and `Unauthorized, no matched teams` (gigstack Connect), `Invalid access token`, `Access token has expired. Please refresh your token.`, `Access token has been revoked`. 2. **From the endpoint itself**: the standardized envelope with `error.code: unauthorized`. Branch on the HTTP status, not on the body shape. content: application/json: schema: anyOf: - $ref: '#/components/schemas/AuthMiddlewareError' - $ref: '#/components/schemas/UnauthorizedError' examples: missing_or_invalid_key: summary: Authentication layer — missing or unparseable API key value: message: Unauthorized oauth_token_expired: summary: Authentication layer — expired OAuth access token value: message: Access token has expired. Please refresh your token. error: token_expired error_description: Access token has expired. Please refresh your token. connect_not_master_team: summary: >- Authentication layer — `team` sent by a team without gigstack Connect value: message: Unauthorized, not a master team endpoint_envelope: summary: Endpoint — standardized envelope value: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 ServerError: description: >- Unexpected server error (`error.code: internal_server_error`). The failure is logged on gigstack's side. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: internal_server_error message: An internal server error occurred timestamp: 1767225600000 schemas: AuthMiddlewareError: type: object description: > Raw error body produced by the authentication layer (before any endpoint runs). It is not the standardized envelope: there is no `success` and no `timestamp`. required: - message properties: message: type: string description: >- Human-readable reason. Some messages are in Spanish; branch on the HTTP status, not on this text. example: Unauthorized error: type: string description: >- OAuth error code. Present only when an OAuth access token was presented. enum: - invalid_token - token_expired - token_revoked - server_error example: token_expired error_description: type: string description: Same text as `message`. Present only alongside `error`. example: Access token has expired. Please refresh your token. details: description: >- Extra detail, e.g. `Invalid API Key` when a revoked key is rejected with `403`. oneOf: - type: string - type: object example: Invalid API Key UnauthorizedError: allOf: - $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 StandardErrorResponse: type: object description: > Standardized error envelope emitted by `sendErrorResponse` and its helpers (`sendValidationError`, `sendNotFoundError`, `sendUnauthorizedError`, `sendForbiddenError`, `sendConflictError`, `sendBadRequestError`, `sendInternalServerError`). required: - success - error - timestamp properties: success: type: boolean enum: - false example: false error: type: object required: - code - message properties: code: type: string description: > Stable machine-readable code. Values emitted by the shared helpers: `unauthorized`, `forbidden`, `invalid_token`, `validation_failed`, `invalid_request_body`, `missing_required_field`, `invalid_field_value`, `resource_not_found`, `resource_already_exists`, `resource_conflict`, `business_rule_violation`, `operation_not_allowed`, `insufficient_permissions`, `external_service_error`, `payment_processor_error`, `cfdi_service_error`, `internal_server_error`, `service_unavailable`, `rate_limit_exceeded`, `database_error`, `data_integrity_error`, `file_not_found`, `file_upload_error`, `invalid_file_format`. Individual handlers may emit additional endpoint-specific codes, documented per operation. example: validation_failed message: type: string example: Request validation failed details: oneOf: - type: string - type: array items: type: string - type: object description: > Present only when the handler supplies detail. Validation failures emit an array of `": "` strings. An object only where an operation documents its keys: account billing answers `409` `billing_operation_pending` with `{ "operation_id": "" }`, the operation holding the account lock, to reconcile (`POST /teams/{id}/billing/operations/{operationId}/reconcile`). example: - 'currency: Field is required' timestamp: type: integer format: int64 description: Server time in epoch milliseconds. example: 1767225600000 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": … }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.