curl --request GET \
--url https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}/audit \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}/audit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}/audit"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": {
"items": [
{
"id": "<string>",
"action": "<string>",
"timestamp": 1,
"actor_user_id": "<string>",
"key_id": "<string>",
"operation_id": "<string>"
}
],
"next_cursor": "<string>"
},
"timestamp": 1
}Read safe per-key lifecycle audit
Integration note: Requires current personal identity and billing-account/per-key ACLs. API keys never manage credentials. Safe metadata only; private browser approval alone reveals a new secret once. Legacy keys remain valid; no forced migration. See API credentials.
Requires an active personal Firebase/MCP identity and current billing-account/per-key management authority. API keys, including legacy keys, cannot manage credentials. Readback contains metadata only, never stored tokens, secret-once browser execution data or reviewer challenges. Follow non-null next_cursor including empty pages. New routes do not inherit key scope permission.
curl --request GET \
--url https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}/audit \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}/audit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}/audit"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"success": true,
"data": {
"items": [
{
"id": "<string>",
"action": "<string>",
"timestamp": 1,
"actor_user_id": "<string>",
"key_id": "<string>",
"operation_id": "<string>"
}
],
"next_cursor": "<string>"
},
"timestamp": 1
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Path Parameters
^[A-Za-z0-9_-]{1,128}$Query Parameters
^[A-Za-z0-9_-]{1,128}$1 <= x <= 100^[A-Za-z0-9_-]{1,128}$