Get one authorization

curl --request GET \
  --url https://api.example.com/pixauto/v1/payer/authorizations/{authorization_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'X-Account-Id: <x-account-id>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/pixauto/v1/payer/authorizations/{authorization_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Account-Id", "<x-account-id>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'GET',
  headers: {'X-Account-Id': '<x-account-id>', Authorization: 'Bearer <token>'}
};

fetch('https://api.example.com/pixauto/v1/payer/authorizations/{authorization_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/pixauto/v1/payer/authorizations/{authorization_id}"

headers = {
    "X-Account-Id": "<x-account-id>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

{
  "authorizedAt": "2026-08-27T19:18:38Z",
  "createdAt": "2026-08-27T19:18:38Z",
  "id": "01a044a8-f3bd-7488-a0dc-e8d4be4802be",
  "journey": "JOURNEY_1",
  "parameters": {
    "creditLineEnabled": false,
    "maximumAmount": {
      "amount": "250.00",
      "currency": "BRL"
    },
    "schedulingNotificationsEnabled": false
  },
  "recurrenceId": "RR12345678202608276bca619e690",
  "status": "APPROVED",
  "updatedAt": "2026-08-27T19:20:00Z"
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

{
  "code": "PIX-0004",
  "message": "Invalid or expired authentication credentials.",
  "title": "Unauthorized"
}

{
  "code": "PIX-0005",
  "message": "You do not have permission to perform this operation.",
  "title": "Forbidden"
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

{
  "code": "PIX-0000",
  "message": "The server encountered an unexpected error. Please try again later.",
  "title": "Internal Server Error"
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

Get one authorization

Returns one mandate, in ANY lifecycle state Authorizations itself lists: AWAITING_CONCLUSION, APPROVED, REJECTED, EXPIRED or CANCELLED. The representation is the SAME AuthorizationItem the listing already publishes.

A mandate belonging to a different account than X-Account-Id names is answered 404, exactly as one that does not exist: the account is a predicate on the lookup, so this end never learns the mandate exists elsewhere and cannot confirm it.

This operation does not include history: an integrator reads the append-only audit through the /history route.

GET

payer

authorizations

{authorization_id}

Get one authorization

curl --request GET \
  --url https://api.example.com/pixauto/v1/payer/authorizations/{authorization_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'X-Account-Id: <x-account-id>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/pixauto/v1/payer/authorizations/{authorization_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Account-Id", "<x-account-id>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'GET',
  headers: {'X-Account-Id': '<x-account-id>', Authorization: 'Bearer <token>'}
};

fetch('https://api.example.com/pixauto/v1/payer/authorizations/{authorization_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/pixauto/v1/payer/authorizations/{authorization_id}"

headers = {
    "X-Account-Id": "<x-account-id>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

{
  "authorizedAt": "2026-08-27T19:18:38Z",
  "createdAt": "2026-08-27T19:18:38Z",
  "id": "01a044a8-f3bd-7488-a0dc-e8d4be4802be",
  "journey": "JOURNEY_1",
  "parameters": {
    "creditLineEnabled": false,
    "maximumAmount": {
      "amount": "250.00",
      "currency": "BRL"
    },
    "schedulingNotificationsEnabled": false
  },
  "recurrenceId": "RR12345678202608276bca619e690",
  "status": "APPROVED",
  "updatedAt": "2026-08-27T19:20:00Z"
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

{
  "code": "PIX-0004",
  "message": "Invalid or expired authentication credentials.",
  "title": "Unauthorized"
}

{
  "code": "PIX-0005",
  "message": "You do not have permission to perform this operation.",
  "title": "Forbidden"
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

{
  "code": "PIX-0000",
  "message": "The server encountered an unexpected error. Please try again later.",
  "title": "Internal Server Error"
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

Authorizations

Authorization

string

header

required

JWT bearer token issued by the identity provider.

Headers

X-Account-Id

string<uuid>

required

Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary.

Pattern: ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$

Path Parameters

authorization_id

string

required

Internal identifier of the mandate, in ANY lifecycle state. A mandate under a different X-Account-Id is answered 404, not 403, so the caller cannot confirm that a resource exists elsewhere.

Example:

"01a044a8-f3bd-7488-a0dc-e8d4be4802be"

Response

The authorization.

authorizedAt

string<date-time>

required

When the mandate was granted.

Example:

"2026-08-27T19:18:38Z"

createdAt

string<date-time>

required

Example:

"2026-08-27T19:18:38Z"

string

required

Internal identifier of the mandate.

Example:

"01a044a8-f3bd-7488-a0dc-e8d4be4802be"

journey

enum<string>

required

Journey that granted the mandate.

Available options:

JOURNEY_1,

JOURNEY_2,

JOURNEY_3,

JOURNEY_4

Example:

"JOURNEY_1"

parameters

object

required

Show child attributes

recurrenceId

string

required

BACEN idRec of the recurrence it covers.

Example:

"RR12345678202608276bca619e690"

status

enum<string>

required

Lifecycle status of the mandate. AWAITING_CONCLUSION means the payer granted it and the receiving PSP has not yet concluded the process — it is NOT active at BACEN (Manual de Tempos do Pix v7.0 §3.2).

Available options:

AWAITING_CONCLUSION,

APPROVED,

REJECTED,

EXPIRED,

CANCELLED

Example:

"APPROVED"

updatedAt

string<date-time>

required

Example:

"2026-08-27T20:00:00Z"

terminatedAt

string<date-time>

When the mandate ENDED — the instant it became REJECTED, EXPIRED or CANCELLED. Absent while it has not ended, which covers an APPROVED mandate and an AWAITING_CONCLUSION one alike: absence means the mandate has not ended, never that it is active.

Example:

"2026-08-27T20:00:00Z"

DICT and Pix keys

Collections and BR Codes

Payments and refunds

Pix Automático API

Error handling

Get one authorization

Authorizations

Headers

Path Parameters

Response