> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Get one authorization > Returns one mandate, in ANY lifecycle state Authorizations itself lists: AWAITING_CONCLUSION, APPROVED, REJECTED, EXPIRED or CANCELLED. The representation is the SAME AuthorizationItem the listing already publishes. A mandate belonging to a different account than X-Account-Id names is answered 404, exactly as one that does not exist: the account is a predicate on the lookup, so this end never learns the mandate exists elsewhere and cannot confirm it. This operation does not include history: an integrator reads the append-only audit through the /history route. ## OpenAPI ````yaml /en/openapi/v3-current/pix-lerian-pixauto.yaml get /payer/authorizations/{authorization_id} openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: >- Pix Automático payer-facing API — deciding an authorization request raised by the receiving end, managing the payer-configurable parameters of a granted mandate, and revoking it (Guia de Implementação do Pix Automático v1.2 §3 and §6). ## Trust boundary This API is **machine-to-machine**. The caller is the client PSP's backend, authenticated with an application token; the token names that application and never one of its customers. The account therefore has to arrive in the request, and it does so in one of two shapes: ten routes take it in the **`X-Account-Id`** header, the same header SPI, DICT and COB use for the same job, and `POST /v1/payer/authorization-requests/from-qr` takes `payerAccountId` in the body — that route creates a pending request for a mandate that does not exist yet, so the account is part of what is being created rather than a scope on an existing resource, and a header beside the body field would be a second source for one value. Either way the value is the caller's **declaration** of which of its own customers it is acting for. **It is not proof that the end user controls that account, and this API cannot make it one.** Authenticating the payer and authorising its own customers against one another is the calling PSP's responsibility. What this end enforces is consistency: an absent header is 400 (PIX-0001) and a malformed account is 400 (PIX-0017 on the header, PIX-0003 in the body), and a resource that exists under a different account than the one named is **404**, not 403: the account is a predicate on the lookup, so this end never learns the resource exists elsewhere and cannot confirm it. Within one lookup, absence and a resource outside the selection get the same answer. license: name: Lerian Studio General License title: Pix Lerian — Pix Automático version: 1.0.0 servers: - url: https://api.example.com/pixauto/v1 description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Authorization requests raised by the receiving end and answered by the payer. A request is answered once. name: Payer Authorization Requests - description: Granted mandates. An authorization is managed for as long as it lives. name: Payer Authorizations - description: >- The payer's forward view of upcoming debits, and the cancellation of one of them. Cancelling a debit leaves the authorization ACTIVE — it stops one charge, not the mandate. The two operations are meant to be used together: the listing is the only place a client receives the scheduled_payment_id the cancellation addresses. name: Payer Scheduled Payments paths: /payer/authorizations/{authorization_id}: get: tags: - Payer Authorizations summary: Get one authorization description: >- Returns one mandate, in ANY lifecycle state Authorizations itself lists: AWAITING_CONCLUSION, APPROVED, REJECTED, EXPIRED or CANCELLED. The representation is the SAME AuthorizationItem the listing already publishes. A mandate belonging to a different account than X-Account-Id names is answered 404, exactly as one that does not exist: the account is a predicate on the lookup, so this end never learns the mandate exists elsewhere and cannot confirm it. This operation does not include history: an integrator reads the append-only audit through the /history route. operationId: getPayerAuthorization parameters: - description: >- Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary. example: 0198f3a2-1c4e-7c8b-9d1e-2f3a4b5c6d7e in: header name: X-Account-Id required: true schema: format: uuid not: const: 00000000-0000-0000-0000-000000000000 pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string - description: >- Internal identifier of the mandate, in ANY lifecycle state. A mandate under a different X-Account-Id is answered 404, not 403, so the caller cannot confirm that a resource exists elsewhere. in: path name: authorization_id required: true schema: description: >- Internal identifier of the mandate, in ANY lifecycle state. A mandate under a different X-Account-Id is answered 404, not 403, so the caller cannot confirm that a resource exists elsewhere. examples: - 01a044a8-f3bd-7488-a0dc-e8d4be4802be type: string responses: '200': content: application/json: example: authorizedAt: '2026-08-27T19:18:38Z' createdAt: '2026-08-27T19:18:38Z' id: 01a044a8-f3bd-7488-a0dc-e8d4be4802be journey: JOURNEY_1 parameters: creditLineEnabled: false maximumAmount: amount: '250.00' currency: BRL schedulingNotificationsEnabled: false recurrenceId: RR12345678202608276bca619e690 status: APPROVED updatedAt: '2026-08-27T19:20:00Z' schema: $ref: '#/components/schemas/AuthorizationItem' description: The authorization. '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Malformed or invalid path, header or query input (PIX-0001, PIX-0003, PIX-0015, PIX-0017, PIX-0020, plus operation-specific PIX codes). '401': content: application/json: example: code: PIX-0004 message: Invalid or expired authentication credentials. title: Unauthorized schema: $ref: '#/components/schemas/Error' description: The caller is not authenticated (PIX-0004). '403': content: application/json: example: code: PIX-0005 message: You do not have permission to perform this operation. title: Forbidden schema: $ref: '#/components/schemas/Error' description: >- The caller is authenticated but not entitled to this resource (PIX-0005). '404': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- No authorization with that identifier is reachable by the caller (PIX-0804). '500': content: application/json: example: code: PIX-0000 message: >- The server encountered an unexpected error. Please try again later. title: Internal Server Error schema: $ref: '#/components/schemas/Error' description: >- Unexpected internal failure (PIX-0000). Details never travel in the envelope. default: content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Any other error returned by the handler uses the same PIX error envelope. The HTTP status and code identify the concrete failure. components: schemas: AuthorizationItem: additionalProperties: false properties: authorizedAt: description: When the mandate was granted. examples: - '2026-08-27T19:18:38Z' format: date-time type: string createdAt: examples: - '2026-08-27T19:18:38Z' format: date-time type: string id: description: Internal identifier of the mandate. examples: - 01a044a8-f3bd-7488-a0dc-e8d4be4802be type: string journey: description: Journey that granted the mandate. enum: - JOURNEY_1 - JOURNEY_2 - JOURNEY_3 - JOURNEY_4 examples: - JOURNEY_1 type: string parameters: $ref: '#/components/schemas/AuthorizationParametersBody' recurrenceId: description: BACEN idRec of the recurrence it covers. examples: - RR12345678202608276bca619e690 type: string status: description: >- Lifecycle status of the mandate. AWAITING_CONCLUSION means the payer granted it and the receiving PSP has not yet concluded the process — it is NOT active at BACEN (Manual de Tempos do Pix v7.0 §3.2). enum: - AWAITING_CONCLUSION - APPROVED - REJECTED - EXPIRED - CANCELLED examples: - APPROVED type: string terminatedAt: description: >- When the mandate ENDED — the instant it became REJECTED, EXPIRED or CANCELLED. Absent while it has not ended, which covers an APPROVED mandate and an AWAITING_CONCLUSION one alike: absence means the mandate has not ended, never that it is active. examples: - '2026-08-27T20:00:00Z' format: date-time type: string updatedAt: examples: - '2026-08-27T20:00:00Z' format: date-time type: string required: - id - recurrenceId - status - journey - parameters - authorizedAt - createdAt - updatedAt type: object Error: additionalProperties: false properties: code: examples: - PIX-0142 type: string fields: additionalProperties: type: string type: object headers: additionalProperties: type: string type: object message: examples: - claim_id is required type: string paths: additionalProperties: type: string type: object query_params: additionalProperties: type: string type: object raw: $ref: '#/components/schemas/RawError' title: examples: - Invalid Claim Request type: string required: - code - title - message type: object AuthorizationParametersBody: additionalProperties: false properties: creditLineEnabled: examples: - false type: boolean maximumAmount: $ref: '#/components/schemas/Money' schedulingNotificationsEnabled: examples: - false type: boolean required: - schedulingNotificationsEnabled - creditLineEnabled type: object RawError: additionalProperties: false properties: message: examples: - upstream provider returned 503 type: string status: format: int64 type: integer required: - status - message type: object Money: additionalProperties: false properties: amount: description: >- Decimal string, positive, with at most two fractional digits and at most thirteen integer digits. A string, not a float — binary floating point cannot represent every centavo exactly, and this is a money path. Trailing zeros are not padded: 150.00 and 150 are the same amount. examples: - '149.90' pattern: ^(0\.([1-9][0-9]?|0[1-9])|[1-9][0-9]{0,12}(\.[0-9]{1,2})?)$ type: string currency: description: Pix settles in BRL only. enum: - BRL examples: - BRL type: string required: - amount - currency type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.