curl --request POST \
--url https://api.gigstack.io/v2/teams/{id}/invoice-portal-operations \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"livemode": true,
"replaces_operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"expiresIn": "1h",
"scopes": [
"invoices:read"
]
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
operation_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
livemode: true,
replaces_operation_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
expiresIn: '1h',
scopes: ['invoices:read']
})
};
fetch('https://api.gigstack.io/v2/teams/{id}/invoice-portal-operations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/teams/{id}/invoice-portal-operations"
payload = {
"operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"livemode": True,
"replaces_operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"expiresIn": "1h",
"scopes": ["invoices:read"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"family": "customer",
"team_id": "<string>",
"client_id": "<string>",
"replaces_operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"livemode": true,
"status": "prepared",
"created_at": 1,
"preparation_expires_at": 1,
"expires_at": 1,
"access_lifetime_seconds": 216000,
"exchanged_session_lifetime_seconds": 259200,
"scopes": [
"customer:read"
],
"effects": [
"customer_data_read"
],
"secret_available": false,
"browser_handoff": {
"kind": "private_browser_review",
"url": "<string>"
},
"recovery": "first_response_secret_not_replayed"
}
}prepare invoices portal operation
Safe metadata only. Persist caller UUID before prepare; same immutable input can be reconciled with GET. Preparation emits no credential. Original verified grant and exact current target/mode authorize independently. Active access requires private reviewed revocation.
curl --request POST \
--url https://api.gigstack.io/v2/teams/{id}/invoice-portal-operations \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"livemode": true,
"replaces_operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"expiresIn": "1h",
"scopes": [
"invoices:read"
]
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
operation_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
livemode: true,
replaces_operation_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
expiresIn: '1h',
scopes: ['invoices:read']
})
};
fetch('https://api.gigstack.io/v2/teams/{id}/invoice-portal-operations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/teams/{id}/invoice-portal-operations"
payload = {
"operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"livemode": True,
"replaces_operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"expiresIn": "1h",
"scopes": ["invoices:read"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"family": "customer",
"team_id": "<string>",
"client_id": "<string>",
"replaces_operation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"livemode": true,
"status": "prepared",
"created_at": 1,
"preparation_expires_at": 1,
"expires_at": 1,
"access_lifetime_seconds": 216000,
"exchanged_session_lifetime_seconds": 259200,
"scopes": [
"customer:read"
],
"effects": [
"customer_data_read"
],
"secret_available": false,
"browser_handoff": {
"kind": "private_browser_review",
"url": "<string>"
},
"recovery": "first_response_secret_not_replayed"
}
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Path Parameters
Query Parameters
Assertion only; current verified credential and browser selected mode must independently agree.
Body
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$Finite duration, maximum 24h
1invoices:read