> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gigstack.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Reconcile managed identity provisioning evidence

> Using the originating personal Firebase/MCP credential, read Auth by the reserved user ID and update this managed creation receipt. No creation, activation, membership grant, email or credential issuance occurs. Missing identity after a timeout remains unknown. activation_required means return to the private browser for a new review; only completed confirms enabled Auth and the recorded membership grant. API/OAuth team keys cannot use this personal account operation.



## OpenAPI

````yaml openapi.json POST /users/me/account-approvals/{id}/reconcile
openapi: 3.0.3
info:
  title: gigstack API v2
  description: >
    # gigstack API v2


    Build customer, invoice and payment integrations. Start with the
    [quickstart](https://docs.gigstack.io/quickstart), then select the [issuing
    country](https://docs.gigstack.io/concepts/shared-fields).


    ## Authentication and environments


    Use Authorization: Bearer YOUR_API_KEY. Standard live and test keys use
    https://api.gigstack.io/v2. Internal staging uses
    https://gigstack-staging-9z9nnaat.uc.gateway.dev/v2 and separate keys. Test
    mode is a data mode within an environment; a body field does not switch a
    key's mode.


    See [authentication](https://docs.gigstack.io/authentication) for key
    handling, OAuth team scope and gigstack Connect. Internal partner
    provisioning is outside this public contract; health probes have their own
    security declarations. Operations marked unavailable have no configured
    public gateway route.


    ## Read the operation contract


    Response envelopes, pagination and retry rules differ by endpoint. HTTP
    success alone does not prove external fiscal completion or movement of
    money. Reconcile ambiguous writes before retrying. Use [responses and
    recovery](https://docs.gigstack.io/responses) and the operation's error
    codes; document credits and daily limits are not generic retryable rate
    limits.


    The issuing team's configuration selects Mexico or Colombia; customer
    country and currency do not. Read
    [Mexico](https://docs.gigstack.io/countries/mexico) or
    [Colombia](https://docs.gigstack.io/countries/colombia) before choosing
    fiscal fields. Accepted public input differs from a provider's direct
    payload.


    Examples and schema checks do not imply every operation has been executed
    live. [Verification coverage](https://docs.gigstack.io/verification)
    distinguishes source review, offline checks and observed staging behavior.
    Documentation describes operations and does not authorize execution.
  version: 2.0.0
  contact:
    name: Gigstack API Support
    url: https://gigstack.io
    email: support@gigstack.io
  license:
    name: Proprietary
    url: https://gigstack.io/terms
  termsOfService: https://gigstack.io/terms
servers:
  - url: https://api.gigstack.io/v2
    description: >
      Public API for standard live and test-mode keys. Test data is isolated by
      the key mode

      (`livemode: false`). Internal staging is a separate deployment and key
      store; see

      https://docs.gigstack.io/authentication#environments for its base URL.
security:
  - bearerAuth: []
externalDocs:
  description: Complete API Documentation & Guides
  url: https://docs.gigstack.io
paths:
  /users/me/account-approvals/{id}/reconcile:
    post:
      tags:
        - Account Approvals
      summary: Reconcile managed identity provisioning evidence
      description: >-
        Using the originating personal Firebase/MCP credential, read Auth by the
        reserved user ID and update this managed creation receipt. No creation,
        activation, membership grant, email or credential issuance occurs.
        Missing identity after a timeout remains unknown. activation_required
        means return to the private browser for a new review; only completed
        confirms enabled Auth and the recorded membership grant. API/OAuth team
        keys cannot use this personal account operation.
      operationId: reconcileAccountApproval
      parameters:
        - name: id
          in: path
          schema:
            type: string
            pattern: ^[a-f0-9]{64}$
          required: true
        - $ref: '#/components/parameters/TeamParameter'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties: {}
            example: {}
      responses:
        '200':
          description: >-
            Safe approval state only. Cache-Control: no-store. Preparation is
            not issuance; GET and cancellation never return secrets or
            challenges.
          headers:
            Cache-Control:
              schema:
                type: string
                enum:
                  - no-store
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                properties:
                  success:
                    type: boolean
                    enum:
                      - true
                  data:
                    $ref: '#/components/schemas/AccountApproval'
                  timestamp:
                    type: number
                required:
                  - success
                  - data
                  - timestamp
              example:
                success: true
                data:
                  id: >-
                    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
                  operation_id: 00000000-0000-4000-8000-000000000001
                  action: managed_users.create_admin
                  team:
                    id: team_example
                    legal_name: null
                    tax_id: null
                  billing_account_id: billing_example
                  payload:
                    email: managed@example.test
                  requested_modes: []
                  effect_scope: managed_identity
                  status: activation_required
                  created_at: 1700000000000
                  expires_at: 1700000600000
                  completed_at: null
                  review_url: >-
                    https://app.gigstack.pro/account/approvals/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
                  can_cancel: false
                  disclosure_version: managed-identity-v1
                  existing_key_ids: []
                  terms: null
                  receipt: null
                  error: null
                  membership_change: null
                  invitation_change: null
                  managed_identity_change:
                    user_id: managed_example
                    email: managed@example.test
                    profile: {}
                    team_id: team_example
                    billing_account_id: billing_example
                    role: admin
                    auto_join: true
                    credential_delivery: none
                    initial_auth_state: disabled
                    bootstrap_effects:
                      - profile_initialization
                      - membership_usage_initialization
                      - support_identity_claims
                  managed_identity_execution:
                    phase: activation_required
                    auth_state: disabled
                    membership_granted: false
                    started_at: 1700000000000
                    updated_at: 1700000000100
                    error_code: null
                  managed_session_change: null
                  managed_session_execution: null
                timestamp: 1700000000000
        '400':
          description: Invalid input, unknown fields, or action-specific payload mismatch.
        '401':
          description: Verified personal identity required.
        '403':
          description: >-
            Current authority, origin credential and mode, or enabled account
            checks failed.
        '404':
          description: Approval or account not found in authorized scope.
        '409':
          description: >-
            operation_conflict, changed account state, expired/cancelled
            approval, or active key conflict.
        '500':
          description: >-
            Preparation or state read failed. Preserve the operation ID and
            exact input; do not generate a replacement as an automatic retry.
      security:
        - bearerAuth: []
components:
  parameters:
    TeamParameter:
      name: team
      in: query
      required: false
      schema:
        type: string
      description: >
        **gigstack Connect:** Target team ID for multi-team access.


        Requires gigstack Connect enabled on your team and shared billing
        account.


        Also requires the `multipleIssuerAccounts` feature on your plan.
        Requests targeting a

        team other than the one your API key belongs to return `403` without it.


        Only API keys can use it: an OAuth access token sent with another team's
        id is rejected with

        `403 Team mismatch with OAuth token`.


        **Optional — omit it entirely** unless you are acting on another team.
        It deliberately

        carries no example value so generated snippets do not emit
        `?team=undefined`; when the

        parameter is absent, the team is derived from your API key.


        **Example:** `?team=team_xyz789`
  schemas:
    AccountApproval:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          pattern: ^[a-f0-9]{64}$
        operation_id:
          type: string
          pattern: >-
            ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
        action:
          type: string
          enum:
            - api_keys.generate
            - api_keys.rotate
            - mcp_tokens.create
            - team.ownership.transfer
            - team.members.promote_admin
            - team.members.add_admin
            - team.invitations.create_admin
            - billing_account.invitations.create_admin
            - managed_users.create_admin
            - managed_users.issue_session
            - managed_users.revoke_sessions
            - api_keys.create_scoped
            - api_keys.rotate_scoped
        team:
          type: object
          additionalProperties: false
          properties:
            id:
              type: string
            legal_name:
              type: string
              nullable: true
            tax_id:
              type: string
              nullable: true
          required:
            - id
            - legal_name
            - tax_id
          nullable: true
        billing_account_id:
          type: string
        payload:
          type: object
          additionalProperties: false
          properties:
            name:
              type: string
              minLength: 1
              maxLength: 64
            livemode:
              type: boolean
            new_owner_id:
              type: string
              pattern: ^[A-Za-z0-9_-]{1,128}$
            member_id:
              type: string
              pattern: ^[A-Za-z0-9_-]{1,128}$
            email:
              type: string
            send_email:
              type: boolean
            existing_invitation_id:
              type: string
            first_name:
              type: string
              nullable: true
              maxLength: 100
            last_name:
              type: string
              nullable: true
              maxLength: 100
            phone:
              type: string
              nullable: true
              pattern: ^\+[1-9]\d{7,14}$
            company_role:
              type: string
              nullable: true
              maxLength: 100
            address:
              type: object
              additionalProperties: false
              properties:
                country:
                  type: string
                  nullable: true
                  maxLength: 250
                street:
                  type: string
                  nullable: true
                  maxLength: 250
                zip:
                  type: string
                  nullable: true
                  maxLength: 250
                city:
                  type: string
                  nullable: true
                  maxLength: 250
                state:
                  type: string
                  nullable: true
                  maxLength: 250
                exterior:
                  type: string
                  nullable: true
                  maxLength: 250
                municipality:
                  type: string
                  nullable: true
                  maxLength: 250
                neighborhood:
                  type: string
                  nullable: true
                  maxLength: 250
              nullable: true
            user_id:
              type: string
            billing_account_id:
              type: string
              pattern: ^[A-Za-z0-9_-]{1,128}$
            team_ids:
              type: array
              items:
                type: string
                pattern: ^[A-Za-z0-9_-]{1,128}$
              minItems: 1
              maxItems: 100
            action_ids:
              type: array
              items:
                type: string
                maxLength: 128
              minItems: 1
              maxItems: 200
            expires_at:
              type: integer
            manager_user_ids:
              type: array
              items:
                type: string
                pattern: ^[A-Za-z0-9_-]{1,128}$
              maxItems: 100
            key_id:
              type: string
              pattern: ^[A-Za-z0-9_-]{1,128}$
            overlap_seconds:
              type: integer
              minimum: 0
              maximum: 86400
        requested_modes:
          type: array
          items:
            type: boolean
        effect_scope:
          type: string
          enum:
            - team_credentials
            - user_access
            - team_membership
            - billing_account_membership
            - managed_identity
            - managed_session
            - scoped_api_key
        status:
          type: string
          enum:
            - pending
            - completed
            - cancelled
            - expired
            - invalidated
            - processing
            - unknown
            - failed
            - activation_required
        created_at:
          type: number
        expires_at:
          type: number
        completed_at:
          type: number
          nullable: true
        review_url:
          type: string
          format: uri
        can_cancel:
          type: boolean
        disclosure_version:
          type: string
          enum:
            - credential-approval-v1
            - membership-approval-v1
            - invitation-approval-v1
            - managed-identity-v1
            - managed-session-v1
        existing_key_ids:
          type: array
          items:
            type: string
        terms:
          type: object
          additionalProperties: false
          properties:
            url:
              type: string
              format: uri
            acceptance_required:
              type: boolean
              enum:
                - true
          required:
            - url
            - acceptance_required
          nullable: true
        receipt:
          type: object
          additionalProperties: false
          properties:
            keys:
              type: array
              items:
                type: object
                additionalProperties: false
                properties:
                  key_id:
                    type: string
                  type:
                    type: string
                    enum:
                      - api
                      - mcp
                  livemode:
                    type: boolean
                required:
                  - key_id
                  - type
                  - livemode
            revoked_count:
              type: integer
              minimum: 0
            membership:
              type: object
              additionalProperties: false
              properties:
                action:
                  type: string
                  enum:
                    - team.ownership.transfer
                    - team.members.promote_admin
                    - team.members.add_admin
                member_id:
                  type: string
                owner_id:
                  type: string
                previous_owner_id:
                  type: string
                role:
                  type: string
                  enum:
                    - admin
                is_owner:
                  type: boolean
                added:
                  type: boolean
              required:
                - action
                - member_id
                - owner_id
                - previous_owner_id
                - role
                - is_owner
                - added
              nullable: true
            invitation:
              type: object
              additionalProperties: false
              properties:
                id:
                  type: string
                type:
                  type: string
                  enum:
                    - team
                    - billingAccount
                team_id:
                  type: string
                  nullable: true
                billing_account_id:
                  type: string
                email:
                  type: string
                role:
                  type: string
                  enum:
                    - admin
                expires_at:
                  type: number
                approval_id:
                  type: string
              required:
                - id
                - type
                - team_id
                - billing_account_id
                - email
                - role
                - expires_at
                - approval_id
              nullable: true
            managed_identity:
              type: object
              additionalProperties: false
              properties:
                user_id:
                  type: string
                team_id:
                  type: string
                billing_account_id:
                  type: string
                role:
                  type: string
                  enum:
                    - admin
                auth_state:
                  type: string
                  enum:
                    - enabled
                membership_granted:
                  type: boolean
                  enum:
                    - true
              required:
                - user_id
                - team_id
                - billing_account_id
                - role
                - auth_state
                - membership_granted
              nullable: true
            managed_session:
              type: object
              additionalProperties: false
              properties:
                user_id:
                  type: string
                approval_id:
                  type: string
                action:
                  type: string
                  enum:
                    - managed_users.issue_session
                    - managed_users.revoke_sessions
                custom_token_expires_at:
                  type: number
                  nullable: true
                  description: >-
                    Custom-token exchange deadline in epoch milliseconds, not
                    the expiry of a redeemed Firebase session. Null for
                    revocation.
                session_expiration:
                  type: string
                  enum:
                    - not_bounded_by_custom_token
                revocation_scope:
                  type: string
                  enum:
                    - refresh_tokens_only
                    - null
                  nullable: true
              required:
                - user_id
                - approval_id
                - action
                - custom_token_expires_at
                - session_expiration
                - revocation_scope
              nullable: true
          required:
            - keys
            - revoked_count
            - membership
            - invitation
            - managed_identity
            - managed_session
          nullable: true
        error:
          type: object
          additionalProperties: false
          properties:
            code:
              type: string
            message:
              type: string
            retryable:
              type: boolean
              enum:
                - false
          required:
            - code
            - message
            - retryable
          nullable: true
        membership_change:
          type: object
          additionalProperties: false
          properties:
            target:
              type: object
              additionalProperties: false
              properties:
                id:
                  type: string
                email:
                  type: string
                  nullable: true
                display_name:
                  type: string
                  nullable: true
              required:
                - id
                - email
                - display_name
            previous_owner_id:
              type: string
            previous_role:
              type: string
              enum:
                - admin
                - editor
                - viewer
                - blocked
                - null
              nullable: true
            new_role:
              type: string
              enum:
                - admin
            transfers_ownership:
              type: boolean
            billing_ownership_changes:
              type: boolean
              enum:
                - false
            hidden_member:
              type: boolean
              enum:
                - false
          required:
            - target
            - previous_owner_id
            - previous_role
            - new_role
            - transfers_ownership
            - billing_ownership_changes
            - hidden_member
          nullable: true
        invitation_change:
          type: object
          additionalProperties: false
          properties:
            id:
              type: string
            type:
              type: string
              enum:
                - team
                - billingAccount
            email:
              type: string
            role:
              type: string
              enum:
                - admin
            team_id:
              type: string
              nullable: true
            billing_account_id:
              type: string
            billing_account_name:
              type: string
              nullable: true
            inviter:
              type: object
              additionalProperties: false
              properties:
                id:
                  type: string
                email:
                  type: string
                  nullable: true
                display_name:
                  type: string
                  nullable: true
              required:
                - id
                - email
                - display_name
            send_email:
              type: boolean
            expires_at:
              type: number
            existing_invitation:
              type: boolean
            prior_delivery_status:
              type: string
              nullable: true
          required:
            - id
            - type
            - email
            - role
            - team_id
            - billing_account_id
            - billing_account_name
            - inviter
            - send_email
            - expires_at
            - existing_invitation
            - prior_delivery_status
          nullable: true
        managed_identity_change:
          type: object
          additionalProperties: false
          properties:
            user_id:
              type: string
            email:
              type: string
            profile:
              type: object
              additionalProperties: false
              properties:
                first_name:
                  type: string
                  nullable: true
                  maxLength: 100
                last_name:
                  type: string
                  nullable: true
                  maxLength: 100
                phone:
                  type: string
                  nullable: true
                  pattern: ^\+[1-9]\d{7,14}$
                company_role:
                  type: string
                  nullable: true
                  maxLength: 100
                address:
                  type: object
                  additionalProperties: false
                  properties:
                    country:
                      type: string
                      nullable: true
                      maxLength: 250
                    street:
                      type: string
                      nullable: true
                      maxLength: 250
                    zip:
                      type: string
                      nullable: true
                      maxLength: 250
                    city:
                      type: string
                      nullable: true
                      maxLength: 250
                    state:
                      type: string
                      nullable: true
                      maxLength: 250
                    exterior:
                      type: string
                      nullable: true
                      maxLength: 250
                    municipality:
                      type: string
                      nullable: true
                      maxLength: 250
                    neighborhood:
                      type: string
                      nullable: true
                      maxLength: 250
                  nullable: true
            team_id:
              type: string
            billing_account_id:
              type: string
            role:
              type: string
              enum:
                - admin
            auto_join:
              type: boolean
              enum:
                - true
            credential_delivery:
              type: string
              enum:
                - none
            initial_auth_state:
              type: string
              enum:
                - disabled
            bootstrap_effects:
              type: array
              items:
                type: string
                enum:
                  - profile_initialization
                  - membership_usage_initialization
                  - support_identity_claims
              minItems: 3
              maxItems: 3
          required:
            - user_id
            - email
            - profile
            - team_id
            - billing_account_id
            - role
            - auto_join
            - credential_delivery
            - initial_auth_state
            - bootstrap_effects
          nullable: true
        managed_identity_execution:
          type: object
          additionalProperties: false
          properties:
            phase:
              type: string
              enum:
                - creating
                - activation_required
                - activating
                - complete
                - failed
            auth_state:
              type: string
              enum:
                - unknown
                - disabled
                - enabled
            membership_granted:
              type: boolean
            started_at:
              type: number
            updated_at:
              type: number
            error_code:
              type: string
              nullable: true
          required:
            - phase
            - auth_state
            - membership_granted
            - started_at
            - updated_at
            - error_code
          nullable: true
        managed_session_change:
          type: object
          additionalProperties: false
          properties:
            user_id:
              type: string
            email:
              type: string
            auth_creation_time:
              type: string
            billing_account_id:
              type: string
            teams:
              type: array
              items:
                type: object
                additionalProperties: false
                properties:
                  id:
                    type: string
                  role:
                    type: string
                    description: >-
                      Current access, including inherited billing_account_admin
                      and master_team_billing_access.
                required:
                  - id
                  - role
            billing_accounts:
              type: array
              items:
                type: object
                additionalProperties: false
                properties:
                  id:
                    type: string
                  role:
                    type: string
                required:
                  - id
                  - role
            delivery:
              type: string
              enum:
                - browser_once
                - none
            session_scope:
              type: string
              enum:
                - firebase_identity
            prior_attempts:
              type: array
              items:
                type: object
                additionalProperties: false
                properties:
                  approval_id:
                    type: string
                  action:
                    type: string
                    enum:
                      - managed_users.issue_session
                      - managed_users.revoke_sessions
                  phase:
                    type: string
                    enum:
                      - attempting
                      - issued
                      - revoked
                      - unknown
                  attempted_at:
                    type: number
                  custom_token_expires_at:
                    type: number
                    nullable: true
                    description: >-
                      Custom-token exchange deadline in epoch milliseconds, not
                      the expiry of a redeemed Firebase session. Null for
                      revocation.
                required:
                  - approval_id
                  - action
                  - phase
                  - attempted_at
                  - custom_token_expires_at
          required:
            - user_id
            - email
            - auth_creation_time
            - billing_account_id
            - teams
            - billing_accounts
            - delivery
            - session_scope
            - prior_attempts
          nullable: true
        managed_session_execution:
          type: object
          additionalProperties: false
          properties:
            phase:
              type: string
              enum:
                - attempting
                - issued
                - revoked
                - unknown
            attempted_at:
              type: number
            custom_token_expires_at:
              type: number
              nullable: true
              description: >-
                Custom-token exchange deadline in epoch milliseconds, not the
                expiry of a redeemed Firebase session. Null for revocation.
            delivery:
              type: string
              enum:
                - not_observable
                - none
          required:
            - phase
            - attempted_at
            - custom_token_expires_at
            - delivery
          nullable: true
        scoped_key_change:
          type: object
          additionalProperties: false
          required:
            - name
            - livemode
            - billing_account_id
            - team_ids
            - action_ids
            - expires_at
            - manager_user_ids
            - action
            - previous_key_id
            - overlap_seconds
            - previous_revoke_at
            - unrelated_keys_affected
            - secret_disclosure
          properties:
            name:
              type: string
              minLength: 1
              maxLength: 64
            livemode:
              type: boolean
            billing_account_id:
              type: string
              pattern: ^[A-Za-z0-9_-]{1,128}$
            team_ids:
              type: array
              items:
                type: string
                pattern: ^[A-Za-z0-9_-]{1,128}$
              minItems: 1
              maxItems: 100
            action_ids:
              type: array
              items:
                type: string
                maxLength: 128
              minItems: 1
              maxItems: 200
            expires_at:
              type: integer
            manager_user_ids:
              type: array
              items:
                type: string
                pattern: ^[A-Za-z0-9_-]{1,128}$
              maxItems: 100
            action:
              type: string
              enum:
                - create
                - rotate
            previous_key_id:
              type: string
              nullable: true
            overlap_seconds:
              type: integer
              minimum: 0
              maximum: 86400
            previous_revoke_at:
              type: integer
              minimum: 0
              nullable: true
            unrelated_keys_affected:
              type: boolean
              enum:
                - false
            secret_disclosure:
              type: string
              enum:
                - once
          nullable: true
      required:
        - id
        - operation_id
        - action
        - team
        - billing_account_id
        - payload
        - requested_modes
        - effect_scope
        - status
        - created_at
        - expires_at
        - completed_at
        - review_url
        - can_cancel
        - disclosure_version
        - existing_key_ids
        - terms
        - receipt
        - error
        - membership_change
        - invitation_change
        - managed_identity_change
        - managed_identity_execution
        - managed_session_change
        - managed_session_execution
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        **Authentication Method:** HTTP Bearer token.


        The runtime requires the literal `Bearer ` prefix — a bare token in the

        `Authorization` header is rejected with `401 unauthorized`.


        **Header Format:** `Authorization: Bearer YOUR_API_KEY`


        Your API key is a JWT. Live keys operate on live data (`livemode:
        true`);

        test keys operate on isolated test data (`livemode: false`).


        **Get your key at:**
        [app.gigstack.pro/settings?tab=api](https://app.gigstack.pro/settings?tab=api)


        **Errors:** credential failures are answered by the authentication layer
        with a raw

        `{ "message": … }` body, not the standardized envelope — `401` for a
        missing, malformed or

        expired token, `403` for a revoked key or a plan without API access. See
        the `Unauthorized`

        and `AuthForbidden` responses.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.