curl --request GET \
--url https://api.gigstack.io/v2/teams/{id}/api-logs \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/teams/{id}/api-logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/teams/{id}/api-logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": [
{
"id": "log_example",
"timestamp": 1700000000000,
"method": "POST",
"endpoint": "/v2/invoices/:id",
"status_code": 400,
"livemode": false,
"redaction": "metadata_and_body_shape",
"team_id": "team_example"
}
],
"has_more": false,
"next_cursor": null,
"scanned_count": 1,
"livemode": false
}List API logs
Read retained logs for the authorized target team and credential mode. Firebase/MCP callers need current viewer-or-higher access; team API/OAuth credentials remain subject to target/sibling-team authorization. Signed API, MCP and OAuth credentials keep their issued mode. Output excludes raw bodies, headers, credentials, signed URLs and arbitrary provider text. This is a metadata/structure view, not a complete original-payload export. A filtered page can be empty while has_more is true. Continue with next_cursor until null; cursor includes timestamp and ID so deleting the anchor does not restart pagination. Unsupported stored cursor timestamps return log_pagination_unavailable rather than falsely claiming the history ended. Logs use the same teamId field as the web API-log view; legacy records using only another team field are not silently merged. Existing retention applies. The browser may supply livemode only with an independently reverified Firebase ID token; the selector must equal the authenticated request mode. Signed API, MCP and OAuth credentials cannot use this selector, even to repeat their own mode. API details additionally retain allowlisted fiscal amounts, flags and catalog values with explicit redaction/truncation markers. Requests revalidate the original credential and current account/team/mode after asynchronous reads.
curl --request GET \
--url https://api.gigstack.io/v2/teams/{id}/api-logs \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/teams/{id}/api-logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/teams/{id}/api-logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": [
{
"id": "log_example",
"timestamp": 1700000000000,
"method": "POST",
"endpoint": "/v2/invoices/:id",
"status_code": 400,
"livemode": false,
"redaction": "metadata_and_body_shape",
"team_id": "team_example"
}
],
"has_more": false,
"next_cursor": null,
"scanned_count": 1,
"livemode": false
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Path Parameters
^[A-Za-z0-9_-]{1,160}$Query Parameters
gigstack Connect: Target team ID for multi-team access.
Requires gigstack Connect enabled on your team and shared billing account.
Also requires the multipleIssuerAccounts feature on your plan. Requests targeting a
team other than the one your API key belongs to return 403 without it.
Only API keys can use it: an OAuth access token sent with another team's id is rejected with
403 Team mismatch with OAuth token.
Optional — omit it entirely unless you are acting on another team. It deliberately
carries no example value so generated snippets do not emit ?team=undefined; when the
parameter is absent, the team is derived from your API key.
Example: ?team=team_xyz789
Maximum rows scanned, not number of matching results.
1 <= x <= 100Use next_cursor with the same team, credential mode and all filters, including limit.
Inclusive epoch milliseconds.
x >= 0Inclusive epoch milliseconds.
x >= 0Result filter applied within each bounded scan.
2xx, 3xx, 4xx, 5xx HTTP method.
GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD Prefix of the redacted route; variable segments are :id. Current and historical leading-slash forms are normalized.
^/[A-Za-z0-9_/:.-]{0,255}$Firebase browser transport only: select live (true) or test (false) history. The original Firebase token is reverified, including revocation, and the selected mode must match its authenticated request context. Omit for API, MCP and OAuth credentials; they use their issued mode.