Accept or reject an authorization request
Records the payer’s decision. Confirmation and the granting of the authorization and the permission are a single command — there is no second confirmation step.
On acceptance the caller may set the payer parameters in the same call; omitted parameters take the normative defaults of Guia v1.2 §6 (notifications enabled, credit line enabled, no maximum amount).
On rejection, rejectionReason is mandatory and limited to the two motives the Guia admits. A rejection is NOT answered by the receiving PSP — the flow closes without a response (Guia v1.2 §3.2), so no acknowledgement should be awaited.
Authorizations
JWT bearer token issued by the identity provider.
Headers
Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary.
^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$REQUIRED. Client-supplied replay key, at most 64 bytes. A request without it is refused with PIX-0030 @ 400 before the handler runs. Replaying the same key with a divergent method, URL or body is PIX-0031 @ 412. X-Account-Id is part of the compared request too, so replaying one account's key under another account is divergent rather than a replay.
1 - 64Path Parameters
Payer-side authorization request identifier. On journey 1 this is the counterparty-issued BACEN idSolicRec; on journeys 2–4 it is a local deterministic identifier. Always use the exact value returned by this API when calling this operation, and never forward a QR-journey value as a BACEN idSolicRec. A request or mandate under a different X-Account-Id is answered 404, not 403, so the caller cannot confirm that a resource exists elsewhere.
"SC12345678202608276bca619e690"
Body
The payer's decision, with the parameters to apply when it is an acceptance.
The payer's answer to the request.
ACCEPT, REJECT "ACCEPT"
The three payer-configurable parameters (Guia v1.2 §6). Accepted only on ACCEPT; an omitted parameter takes its normative default.
Required on REJECT and forbidden on ACCEPT. NotRecognizedByDebtor: the payer does not recognize the receiver. RejectedByDebtor: the payer has no interest in paying that receiver's charges by Pix Automático.
NotRecognizedByDebtor, RejectedByDebtor "RejectedByDebtor"
Response
Recovered duplicate. The same X-Idempotency header was replayed with an identical request, so the FIRST call's response body is returned verbatim and nothing was reprocessed. A replay answers 200 whatever the original status was, so a client tells a replay from a fresh execution by the status code alone. NOTE: this 200 depends on the replay cache. The gate DEGRADES when the cache is unavailable -- it still demands the header, and each route still refuses a second effect through its own durable guard -- but a repeat is then answered by that guard rather than replayed, which for most routes is 409. A client must therefore treat 409 as a possible answer to a retry it believes is a replay, and must not read it as proof that a competing change happened.
Payer-side request identifier that was decided. It is a BACEN idSolicRec only on journey 1; QR journeys use a local identifier that must not be forwarded to the counterparty.
"SC12345678202608276bca619e690"
The status the request reached.
ACCEPTED, REJECTED "ACCEPTED"
The mandate that was granted. Absent on a rejection, which grants none.
"01a044a8-f3bd-7488-a0dc-e8d4be4802be"