curl --request PATCH \
--url https://api.gigstack.io/v2/teams/{id}/members/{memberId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"permissions": {}
}
'const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({permissions: {}})
};
fetch('https://api.gigstack.io/v2/teams/{id}/members/{memberId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/teams/{id}/members/{memberId}"
payload = { "permissions": {} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text){
"data": {
"id": "<string>",
"role": "admin",
"is_owner": true,
"permissions": {
"invoices": "editor",
"receipts": "editor",
"payments": "editor",
"services": "editor",
"expenses": "editor"
},
"email": "<string>"
},
"success": true,
"message": "<string>",
"timestamp": 123
}Update member role or permissions
Requires the current team owner using a user-scoped Firebase or MCP credential. Team API keys and OAuth credentials cannot impersonate their creator. Owner removal/demotion is refused. State changes and membership mirrors are transactional. Permissions-only patches also allow a current roster administrator to edit another viewer member. User-scoped self-edits are refused; a billing-account admin without a roster admin seat cannot use this exception. Team API/OAuth credentials may administer module grants without impersonating their creator. Ineffective restrictions on an editor role are refused. Canonical and raw aliases are updated together; independent disabled/status denials are never cleared by a role update. The original credential is reverified immediately before writes. Requests with role: admin return 403 account_approval_required. The current owner must prepare team.members.promote_admin through POST /users/me/account-approvals and confirm in the private browser. Editor/viewer and existing permitted non-admin operations remain direct.
curl --request PATCH \
--url https://api.gigstack.io/v2/teams/{id}/members/{memberId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"permissions": {}
}
'const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({permissions: {}})
};
fetch('https://api.gigstack.io/v2/teams/{id}/members/{memberId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/teams/{id}/members/{memberId}"
payload = { "permissions": {} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text){
"data": {
"id": "<string>",
"role": "admin",
"is_owner": true,
"permissions": {
"invoices": "editor",
"receipts": "editor",
"payments": "editor",
"services": "editor",
"expenses": "editor"
},
"email": "<string>"
},
"success": true,
"message": "<string>",
"timestamp": 123
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Query Parameters
gigstack Connect: Target team ID for multi-team access.
Requires gigstack Connect enabled on your team and shared billing account.
Also requires the multipleIssuerAccounts feature on your plan. Requests targeting a
team other than the one your API key belongs to return 403 without it.
Only API keys can use it: an OAuth access token sent with another team's id is rejected with
403 Team mismatch with OAuth token.
Optional — omit it entirely unless you are acting on another team. It deliberately
carries no example value so generated snippets do not emit ?team=undefined; when the
parameter is absent, the team is derived from your API key.
Example: ?team=team_xyz789