> ## Documentation Index > Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt > Use this file to discover all available pages before exploring further. # List a platform payouts run's movements > One entry per row of the movements file, in file order, with the state of its income invoice and retention certificate. Use it to review exclusions before confirming, and to find failures after. Cursor pagination: pass `data.next` back as `next` while `data.has_more` is `true`. The cursor is stable while the worker updates statuses, so pages never overlap or skip rows. Commission invoices (one per provider-month) are not listed here; the run only reports their counts. ## OpenAPI ````yaml openapi.json GET /platform-payouts/{id}/movements openapi: 3.0.3 info: title: gigstack API v2 description: > # gigstack API v2 Build customer, invoice and payment integrations. Start with the [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing country](https://docs.gigstack.io/concepts/shared-fields). ## Authentication and environments Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use https://api.gigstack.io/v2. Internal staging uses https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test mode is a data mode within an environment; a body field does not switch a key's mode. See [authentication](https://docs.gigstack.io/authentication) for key handling, OAuth team scope and gigstack Connect. Signup requires its separately documented internal credential; health probes have their own security declarations. Operations marked unavailable have no configured public gateway route. ## Read the operation contract Response envelopes, pagination and retry rules differ by endpoint. HTTP success alone does not prove external fiscal completion or movement of money. Reconcile ambiguous writes before retrying. Use [responses and recovery](https://docs.gigstack.io/responses) and the operation's error codes; document credits and daily limits are not generic retryable rate limits. The issuing team's configuration selects Mexico or Colombia; customer country and currency do not. Read [Mexico](https://docs.gigstack.io/countries/mexico) or [Colombia](https://docs.gigstack.io/countries/colombia) before choosing fiscal fields. Accepted public input differs from a provider's direct payload. Examples and schema checks do not imply every operation has been executed live. [Verification coverage](https://docs.gigstack.io/verification) distinguishes source review, offline checks and observed staging behavior. Documentation describes operations and does not authorize execution. version: 2.0.0 contact: name: Gigstack API Support url: https://gigstack.io email: support@gigstack.io license: name: Proprietary url: https://gigstack.io/terms termsOfService: https://gigstack.io/terms servers: - url: https://api.gigstack.io/v2 description: > Public API for standard live and test-mode keys. Test data is isolated by the key mode (`livemode: false`). Internal staging is a separate deployment and key store; see https://docs.gigstack.io/authentication#environments for its base URL. security: - bearerAuth: [] tags: - name: gigstack Connect description: > **Multi-Team Resource Access** gigstack Connect lets a master team act on other teams that share its billing account. ## 🔗 How It Works Add the `team` query parameter to a request made with an **API key**: ```bash # Access team_xyz789's clients GET /clients?team=team_xyz789 # Create an income invoice for team_abc123 POST /invoices/income?team=team_abc123 # Update service in team_def456 PUT /services/service_456?team=team_def456 ``` ## ✅ Requirements - The API key's team must be a master team (gigstack Connect enabled) - The target team must exist and share the master team's billing account - The plan must include the `multipleIssuerAccounts` feature - OAuth access tokens cannot act on another team ## ⚠ Error Responses Raw `{ "message": 
 }` bodies from the authentication layer: - `401 Unauthorized, not a master team` - gigstack Connect not enabled on your key's team - `404 Team not found` - Target team doesn't exist - `401 Unauthorized, no matched teams` - Target team could not be resolved within your billing account - `403 Tu plan no incluye mĂșltiples cuentas emisoras. 
` - Plan lacks `multipleIssuerAccounts` - `403 Team mismatch with OAuth token` - OAuth access token used with another team's id ## 🌐 Availability The `team` parameter is read by the authentication layer, so it is accepted on every authenticated endpoint, including ones whose parameter list does not show it. - name: Clients description: Client management operations with Mexican tax compliance - name: Services description: Service and product catalog management with SAT product keys - name: Invoices description: Invoice management with CFDI 4.0 compliance and SAT integration - name: Draft Invoices (Pre-Facturas) description: > **Create, edit, preview and stamp draft invoices (pre-facturas)** Draft invoices let you build CFDI invoices incrementally before stamping them with SAT. Use them as **pre-facturas** — generate a preview PDF with a "Sin Validez Fiscal" watermark to share with your client for approval, then stamp the draft to create a valid CFDI when ready. ## Typical Workflow 1. `POST /invoices/draft` — Create a draft with minimal data 2. `PUT /invoices/draft/{id}` — Update as more data becomes available 3. `POST /invoices/draft/{id}/preview` — Generate a preview PDF (pre-factura) 4. `POST /invoices/draft/{id}/stamp` — Finalize into a valid CFDI invoice - name: Descarga Masiva SAT description: > **SAT bulk invoice download via FIEL authentication** Download all your issued and received CFDI invoices directly from the SAT (Servicio de AdministraciĂłn Tributaria) using your FIEL (Firma ElectrĂłnica Avanzada). ## Setup flow 1. `GET /invoices/download/activate/status` — Check if activated and what's needed 2. `POST /invoices/download/activate` — Activate billing (adds Stripe meter/add-on) 3. `POST /invoices/download/fiel` — Upload `.cer` + `.key` files (auto-registers with SAT) 4. `PUT /invoices/download/schedule` — Configure daily auto-sync 5. `POST /invoices/download/request` — Submit manual download requests ## Pricing - Included in Pro/Business plans: only the download meter ($0.20 MXN/XML) - Other paid plans: the same $0.20 MXN/XML download meter, no monthly base fee - name: Payments description: Payment processing, tracking, and refund management - name: Receipts description: Receipt creation and management with CFDI stamping capabilities - name: Retentions description: >- Tax retention documents (CFDI Retenciones 2.0) — creation, stamping, cancellation, and file retrieval - name: Platform Payouts description: > **Plan and stamp a marketplace's provider payouts from two files.** For marketplaces and digital platforms that pay providers under the SAT digital-platforms scheme (Plataformas TecnolĂłgicas, RESICO 625, retention key 26): ride-hailing drivers, delivery couriers, lodging hosts, sellers of goods. Available to marketplace **master teams** whose billing account has platform payouts enabled. Upload a movements file and a commissions file. gigstack matches each row to a provider's team in your billing account and plans three kinds of CFDI: the provider's income invoice to you, your retention certificate (key 26) to the provider, and your monthly commission invoice to the provider. **Not for your own sales.** This is for a platform invoicing on behalf of its providers. A company invoicing its own sales, one CFDI per sale, should use `POST /invoices/income`. **Tax policy per account.** Which documents are issued, and with which SAT keys and rates, is set per master account at onboarding: allowed tax regimes, CSD requirement, service type (`tipoDeServ` / `subTipServ`), ISR and IVA withholding rates, product keys and concept descriptions. The defaults are for ground passenger transport (service type `01`, 2.1% ISR withholding). Contact support to configure your account's policy; it can't be changed through the API. 1. `POST /platform-payouts` with an `Idempotency-Key` - upload and plan (synchronous) 2. `GET /platform-payouts/{id}` and `GET /platform-payouts/{id}/movements` - review the plan 3. `POST /platform-payouts/{id}/confirm` - irreversible hand-off to the stamping worker 4. `GET /platform-payouts/{id}` - poll until `completed` or `failed`, then read `result` (`completed`, `partially_completed` or `failed`) Error messages and exclusion reasons are Spanish sentences for end users; branch on `error.code`, `reason_code` and `exclusion_codes`. - name: Documents description: > SAT supporting documentation (contracts, delivery/payment proofs, communications) — upload metadata, compliance review, AI extraction, and linking to invoices, payments, receipts and clients. - name: Teams description: Team management, settings, and member administration - name: Users description: User account management and password operations - name: Auth description: > **API-only signup for AI agents and partner integrations.** A single `POST /v2/auth/signup` call provisions a Firebase Auth user, billing account, team, plan subscription, and returns API keys — no UI, no FIEL upload, no human onboarding required. Designed for the AI-agents-as-customers use case. RFC defaults to genĂ©rico (`XAXX010101000`) so agents can transact under pĂșblico en general until/unless their customer uploads their own RFC. Authenticated with `X-Internal-API-Key` (partner-issued) — Bearer tokens are team-scoped and a brand-new caller doesn't have one yet. See `AGENTS.md` in the gigstack-cli repo for end-to-end integration guide. - name: Webhooks description: Webhook management for real-time event notifications - name: Catalogs description: > **Read-only search over the SAT catalogs** Look up the SAT codes required on CFDI line items without hardcoding them: - `GET /catalogs/product-keys` — `c_ClaveProdServ`, the item `product_key` - `GET /catalogs/unit-keys` — `c_ClaveUnidad`, the item `unit_key` / `unit_name` Both are typo-tolerant full-text searches ranked by relevance. The catalogs are published by the SAT and identical for every team, so results carry no team data and ignore `livemode` — but a valid API key is still required. - name: SAT Lists description: > Read-only access to the RFC lists the SAT publishes under ArtĂ­culo 69, 69-B and 69-B Bis. gigstack re-syncs all 22 lists from the SAT's published CSVs every Sunday, so you can screen a counterparty's RFC before invoicing it without scraping the SAT yourself. externalDocs: description: Complete API Documentation & Guides url: https://docs.gigstack.io paths: /platform-payouts/{id}/movements: get: tags: - Platform Payouts summary: List a platform payouts run's movements description: > One entry per row of the movements file, in file order, with the state of its income invoice and retention certificate. Use it to review exclusions before confirming, and to find failures after. Cursor pagination: pass `data.next` back as `next` while `data.has_more` is `true`. The cursor is stable while the worker updates statuses, so pages never overlap or skip rows. Commission invoices (one per provider-month) are not listed here; the run only reports their counts. operationId: listPlatformPayoutMovements parameters: - name: id in: path required: true description: Run id. schema: type: string pattern: ^batchrun_[A-Za-z0-9]{6,40}$ example: batchrun_3f9a1c7e2b4d6f8a0c1e3a5b7d9f1a2c - name: limit in: query required: false description: Movements per page (default **50**, 1-100). schema: type: integer minimum: 1 maximum: 100 default: 50 example: 50 - name: next in: query required: false description: >- Opaque cursor from the previous page's `data.next`. Omit for the first page. schema: type: string example: '51' responses: '200': description: > A page of movements. Note the nesting: the array is at `data.data`, the cursor at `data.next`. content: application/json: schema: allOf: - $ref: '#/components/schemas/StandardSuccessResponse' - type: object properties: data: $ref: >- #/components/schemas/ApiPublicPlatformPayoutMovementsPage example: success: true data: data: - id: P10482_2026-08-04_125000_0 line: 2 status: stamped provider: id: P10482 name: ESCUELA KEMPER URGATE email: proveedor@example.com tax_id: EKU9003173C9 team: team_0987654321 movement_type: Pago semanal date: '2026-08-04' month: 2026-08 subtotal: 1250 commission: 96.15 exclusion_reason: null exclusion_codes: [] error: null income: planned: true status: stamped reason: null reason_code: null invoice_id: 7C2E4B1A-9D3F-4E8A-B6C5-1F2A3B4C5D6E uuid: 7C2E4B1A-9D3F-4E8A-B6C5-1F2A3B4C5D6E total: 1323.75 error: null error_code: null certificate: planned: true status: stamped reason: null reason_code: null invoice_id: 0A1B2C3D-4E5F-4A6B-8C7D-9E0F1A2B3C4D uuid: 0A1B2C3D-4E5F-4A6B-8C7D-9E0F1A2B3C4D total: null error: null error_code: null - id: P20931_2026-08-04_98000_0 line: 3 status: excluded provider: id: P20931 name: ESCUELA KEMPER URGATE email: otro.proveedor@example.com tax_id: EKU9003173C9 team: team_1122334455 movement_type: Pago semanal date: '2026-08-04' month: 2026-08 subtotal: 980 commission: 75.38 exclusion_reason: Sin sellos (CSD) en Gigstack exclusion_codes: - missing_csd error: null income: planned: false status: skipped reason: Sin sellos (CSD) en Gigstack reason_code: missing_csd invoice_id: null uuid: null total: null error: null error_code: null certificate: planned: false status: skipped reason: Sin sellos (CSD) en Gigstack reason_code: missing_csd invoice_id: null uuid: null total: null error: null error_code: null - id: P30577_2026-08-05_110000_0 line: 4 status: failed provider: id: P30577 name: ESCUELA KEMPER URGATE email: tercer.proveedor@example.com tax_id: EKU9003173C9 team: team_5566778899 movement_type: Pago semanal date: '2026-08-05' month: 2026-08 subtotal: 1100 commission: 84.62 exclusion_reason: null exclusion_codes: [] error: >- Timbrado interrumpido: verificar en el PAC antes de reintentar income: planned: false status: skipped reason: Sin serie de facturaciĂłn configurada reason_code: missing_series invoice_id: null uuid: null total: null error: null error_code: null certificate: planned: true status: failed reason: null reason_code: null invoice_id: null uuid: null total: null error: >- Timbrado interrumpido: verificar en el PAC antes de reintentar error_code: interrupted_stamp next: '4' has_more: true timestamp: 1788224160000 '400': description: | `invalid_limit` - `limit` is not an integer between 1 and 100. `invalid_cursor` - `next` is not a cursor returned by this endpoint. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' examples: invalid_limit: summary: limit out of range value: success: false error: code: invalid_limit message: limit must be an integer between 1 and 100 timestamp: 1788221700000 invalid_cursor: summary: next is not a valid cursor value: success: false error: code: invalid_cursor message: next is not a valid cursor timestamp: 1788221700000 '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/AuthForbidden' '404': description: > No run with this id in your team and mode (`run_not_found`); `resource_not_found` for a user-scoped token whose user is not a member of the team. Checked before `limit` and `next`. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: run_not_found message: No encontramos esta corrida. timestamp: 1788221700000 '500': $ref: '#/components/responses/ServerError' security: - bearerAuth: [] components: schemas: StandardSuccessResponse: type: object description: | Standardized success envelope emitted by `sendSuccessResponse`. required: - success - data - timestamp properties: success: type: boolean enum: - true example: true data: type: object description: The operation payload. message: type: string description: Human-readable summary. Present only when the handler supplies one. example: Operation completed successfully timestamp: type: integer format: int64 description: Server time in **epoch milliseconds** (`Luxon.now().toMillis()`). example: 1767225600000 ApiPublicPlatformPayoutMovementsPage: type: object required: - data - next - has_more properties: data: type: array description: Movements in file order (ascending `line`). items: $ref: '#/components/schemas/ApiPublicPlatformPayoutMovement' next: type: string nullable: true description: >- Opaque cursor; send it back as `next` to get the following page. `null` on the last page. example: '51' has_more: type: boolean description: Whether another page follows. example: true StandardErrorResponse: type: object description: > Standardized error envelope emitted by `sendErrorResponse` and its helpers (`sendValidationError`, `sendNotFoundError`, `sendUnauthorizedError`, `sendForbiddenError`, `sendConflictError`, `sendBadRequestError`, `sendInternalServerError`). required: - success - error - timestamp properties: success: type: boolean enum: - false example: false error: type: object required: - code - message properties: code: type: string description: > Stable machine-readable code. Values emitted by the shared helpers: `unauthorized`, `forbidden`, `invalid_token`, `validation_failed`, `invalid_request_body`, `missing_required_field`, `invalid_field_value`, `resource_not_found`, `resource_already_exists`, `resource_conflict`, `business_rule_violation`, `operation_not_allowed`, `insufficient_permissions`, `external_service_error`, `payment_processor_error`, `cfdi_service_error`, `internal_server_error`, `service_unavailable`, `rate_limit_exceeded`, `database_error`, `data_integrity_error`, `file_not_found`, `file_upload_error`, `invalid_file_format`. Individual handlers may emit additional endpoint-specific codes, documented per operation. example: validation_failed message: type: string example: Request validation failed details: oneOf: - type: string - type: array items: type: string description: > Present only when the handler supplies detail. Validation failures emit an array of `": "` strings. example: - 'currency: Field is required' timestamp: type: integer format: int64 description: Server time in epoch milliseconds. example: 1767225600000 ApiPublicPlatformPayoutMovement: type: object description: One row of the movements file and the documents it produces. required: - id - line - status - provider - movement_type - date - month - subtotal - commission - exclusion_reason - exclusion_codes - error - income - certificate properties: id: type: string description: >- Movement id, unique within the run and stable across re-uploads of the same row. Treat it as opaque. example: P10482_2026-08-04_125000_0 line: type: integer description: Row number in the movements file, counting the header as line 1. example: 2 status: type: string description: > `planned` - has documents still to issue. `excluded` - nothing to issue (see `exclusion_reason`). `stamped` - every planned document was issued. `failed` - at least one planned document failed. enum: - planned - excluded - stamped - failed example: stamped provider: type: object description: >- The provider (for example a driver, courier, host or seller) the payout goes to. required: - id - name - email - tax_id - team properties: id: type: string description: >- `ID del proveedor` from the file (or its alternative `Provider ID` / `Driver ID`). example: P10482 name: type: string description: >- Legal name of the matched gigstack team, or the file's name when no team matched. example: ESCUELA KEMPER URGATE email: type: string description: E-mail from the file, lowercased. example: proveedor@example.com tax_id: type: string description: >- RFC of the matched gigstack team, or the file's RFC when no team matched. example: EKU9003173C9 team: type: string nullable: true description: > The provider's gigstack team in your billing account, matched by `ID del proveedor` (team `metadata.driverId`), then RFC, then e-mail. `null` when no team matched. example: team_0987654321 movement_type: type: string description: '`Tipo de movimiento` from the file.' example: Pago semanal date: type: string description: >- Movement date, `YYYY-MM-DD`. Empty when the file's date could not be read. example: '2026-08-04' month: type: string description: '`YYYY-MM` of `date`.' example: 2026-08 subtotal: type: number description: Subtotal from the file, rounded to the cent for display (MXN). example: 1250 commission: type: number description: >- This movement's share of the provider's monthly commission, prorated by subtotal across the provider's movements of the month (MXN). example: 96.15 exclusion_reason: type: string nullable: true description: > Why nothing is issued for this movement, in Spanish, for people (two reasons are joined with ` · `). `null` unless `status` is `excluded`. Branch on `exclusion_codes` instead. example: null exclusion_codes: type: array description: > The distinct codes behind `exclusion_reason`, one per distinct reason (at most one for the income invoice and one for the certificate). Empty when the movement is not excluded, and on movements planned before codes existed. items: $ref: '#/components/schemas/PlatformPayoutExclusionCode' example: [] error: type: string nullable: true description: Last stamping error on this movement, in Spanish. example: null income: $ref: '#/components/schemas/ApiPublicPlatformPayoutDocument' certificate: $ref: '#/components/schemas/ApiPublicPlatformPayoutDocument' AuthMiddlewareError: type: object description: > Raw error body produced by the authentication layer (before any endpoint runs). It is not the standardized envelope: there is no `success` and no `timestamp`. required: - message properties: message: type: string description: >- Human-readable reason. Some messages are in Spanish; branch on the HTTP status, not on this text. example: Unauthorized error: type: string description: >- OAuth error code. Present only when an OAuth access token was presented. enum: - invalid_token - token_expired - token_revoked - server_error example: token_expired error_description: type: string description: Same text as `message`. Present only alongside `error`. example: Access token has expired. Please refresh your token. details: description: >- Extra detail, e.g. `Invalid API Key` when a revoked key is rejected with `403`. oneOf: - type: string - type: object example: Invalid API Key UnauthorizedError: allOf: - $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 PlatformPayoutExclusionCode: type: string description: > Stable code for why a document is not planned, sent next to the Spanish sentence. Codes are never renamed; the sentences may be reworded at any time, so branch on the code. New codes may be added. - `invalid_row` - the row itself is malformed (bad date, amount or month). - `provider_not_found` - no gigstack team of the billing account matches the provider. - `missing_tax_id` - no RFC (on the team or in the file; for the commission invoice, in the file). - `missing_legal_name` - the provider's team has no legal name (certificate: neither team nor file). - `missing_zip` - the provider's team has no fiscal zip code. - `missing_fiscal_data` - commission invoice: no provider team, or it lacks legal name or fiscal zip. - `csd_expired` - the provider's CSD (sellos) in gigstack expired. - `missing_csd` - the provider's team has no CSD in gigstack. - `tax_system_not_allowed` - the provider's tax regime is not allowed by the account's tax policy. - `duplicate_tax_id` - the RFC matches more than one team of the billing account. - `name_mismatch` - `Nombre del proveedor` differs from the team's legal name (SAT registry check). - `missing_series` - the issuing team has no invoice series (the provider's for income, the master's for commissions). - `public_general_not_allowed` - the certificate would need the generic RFC and the policy forbids issuing to the general public. - `certificate_month_reserved` - an earlier run already certified this provider-month. - `missing_commission` - no commission for the month, so the certificate would be rejected (SPT147). - `zero_commission` - the month's commission in the commissions file is zero. enum: - invalid_row - provider_not_found - missing_tax_id - missing_legal_name - missing_zip - missing_fiscal_data - csd_expired - missing_csd - tax_system_not_allowed - duplicate_tax_id - name_mismatch - missing_series - public_general_not_allowed - certificate_month_reserved - missing_commission - zero_commission example: missing_csd ApiPublicPlatformPayoutDocument: type: object description: The state of one comprobante a movement may produce. required: - planned - status - reason - reason_code - invoice_id - uuid - total - error - error_code properties: planned: type: boolean description: Whether the plan issues this document. example: true status: type: string description: > `planned` - waiting for (or being retried by) the worker. `skipped` - not issued (see `reason`). `stamped` - issued. `failed` - given up on (see `error`). enum: - planned - skipped - stamped - failed example: stamped reason: type: string nullable: true description: > Why the document is not planned, in Spanish, for people. May be reworded; branch on `reason_code`. `null` when it is planned. example: null reason_code: type: string nullable: true description: > Why the document is not planned, as a stable code (see `PlatformPayoutExclusionCode`). `null` when it is planned, and on documents planned before codes existed. enum: - invalid_row - provider_not_found - missing_tax_id - missing_legal_name - missing_zip - missing_fiscal_data - csd_expired - missing_csd - tax_system_not_allowed - duplicate_tax_id - name_mismatch - missing_series - public_general_not_allowed - certificate_month_reserved - missing_commission - zero_commission - null example: null invoice_id: type: string nullable: true description: > Id of the stamped document. For `income` it is an invoice of the **provider's** team (`provider.team`); for `certificate` it is a retention of the master team (its UUID). example: 7C2E4B1A-9D3F-4E8A-B6C5-1F2A3B4C5D6E uuid: type: string nullable: true description: SAT folio fiscal (UUID) of the stamped document. example: 7C2E4B1A-9D3F-4E8A-B6C5-1F2A3B4C5D6E total: type: number nullable: true description: Total of the stamped income invoice, MXN. Not set for certificates. example: 1323.75 error: type: string nullable: true description: > Last stamping error, in Spanish. Can be set while `status` is still `planned` (a transient failure that will be retried). example: null error_code: type: string nullable: true description: > The stamping or PAC error code behind `error`: `interrupted_stamp` (sent to the PAC but never recorded; not retried), `NETWORK_ERROR` or `HTTP_` (e.g. `HTTP_503`, transient), `team_out_of_scope` (the provider's team is no longer one this run may issue for), or a CFDI error code such as `STAMPING_ERROR` or `PAC_UNAVAILABLE`. `null` when there is no error. example: null responses: Unauthorized: description: > Authentication failed. Two different bodies can come back with a `401`: 1. **From the authentication layer**, before the endpoint runs: a raw object with `message` and — for OAuth access tokens only — `error` / `error_description`. It does **not** use the standardized envelope (`success` and `timestamp` are absent). Messages: `Unauthorized` (missing header, missing `Bearer ` prefix, unparseable token), `Unauthorized, missing team in token`, `Unauthorized, not a master team` and `Unauthorized, no matched teams` (gigstack Connect), `Invalid access token`, `Access token has expired. Please refresh your token.`, `Access token has been revoked`. 2. **From the endpoint itself**: the standardized envelope with `error.code: unauthorized`. Branch on the HTTP status, not on the body shape. content: application/json: schema: anyOf: - $ref: '#/components/schemas/AuthMiddlewareError' - $ref: '#/components/schemas/UnauthorizedError' examples: missing_or_invalid_key: summary: Authentication layer — missing or unparseable API key value: message: Unauthorized oauth_token_expired: summary: Authentication layer — expired OAuth access token value: message: Access token has expired. Please refresh your token. error: token_expired error_description: Access token has expired. Please refresh your token. connect_not_master_team: summary: >- Authentication layer — `team` sent by a team without gigstack Connect value: message: Unauthorized, not a master team endpoint_envelope: summary: Endpoint — standardized envelope value: success: false error: code: unauthorized message: Unauthorized access timestamp: 1767225600000 AuthForbidden: description: > Rejected by the authentication layer after the credential was recognised. The body is a raw object (`message`, sometimes `details`), **not** the standardized envelope. Causes: - The API key was revoked or disabled: `message: "API Key invĂĄlida."`, `details: "Invalid API Key"`. - The billing account's plan does not include API access. `message` is a Spanish sentence containing an HTML link to `https://app.gigstack.pro/memberships`. Branch on the status code; do not display or match the text. - gigstack Connect: the plan lacks the `multipleIssuerAccounts` feature (Spanish message starting `Tu plan no incluye mĂșltiples cuentas emisoras.`), or an OAuth access token was sent with a `team` other than its own (`Team mismatch with OAuth token`). An endpoint may also answer `403` for its own reasons; those are documented on the operation when they exist. content: application/json: schema: $ref: '#/components/schemas/AuthMiddlewareError' examples: revoked_api_key: summary: API key revoked or disabled value: message: API Key invĂĄlida. details: Invalid API Key plan_without_api_access: summary: Plan does not include API access value: message: >- La API se encuentra disponible para un plan mĂĄs grande, por favor actualiza tu plan aquĂ­ o ponte en contacto con soporte. connect_plan_without_multiple_issuers: summary: gigstack Connect — plan lacks multipleIssuerAccounts value: message: >- Tu plan no incluye mĂșltiples cuentas emisoras. Actualiza tu plan en https://app.gigstack.pro/memberships o ponte en contacto con soporte para operar sobre otros equipos. oauth_team_mismatch: summary: gigstack Connect — OAuth token used for another team value: message: Team mismatch with OAuth token ServerError: description: >- Unexpected server error (`error.code: internal_server_error`). The failure is logged on gigstack's side. content: application/json: schema: $ref: '#/components/schemas/StandardErrorResponse' example: success: false error: code: internal_server_error message: An internal server error occurred timestamp: 1767225600000 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > **Authentication Method:** HTTP Bearer token. The runtime requires the literal `Bearer ` prefix — a bare token in the `Authorization` header is rejected with `401 unauthorized`. **Header Format:** `Authorization: Bearer YOUR_API_KEY` Your API key is a JWT. Live keys operate on live data (`livemode: true`); test keys operate on isolated test data (`livemode: false`). **Get your key at:** [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api) **Errors:** credential failures are answered by the authentication layer with a raw `{ "message": 
 }` body, not the standardized envelope — `401` for a missing, malformed or expired token, `403` for a revoked key or a plan without API access. See the `Unauthorized` and `AuthForbidden` responses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.