> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Update the payer-configurable parameters of an authorization > RFC 7386 JSON Merge Patch over the three payer-configurable parameters of Guia v1.2 §6. Setting a property to null resets it to its NORMATIVE default; omitting it leaves it unchanged. The two toggles default to enabled, so a reset is not an opt-out. A change never reaches debits already scheduled. The maximum amount in force at scheduling time is snapshotted on the debit and prevails (Guia v1.2 §6.1); the new value applies to future scheduling only. The maximum amount never leaves this PSP: it is not shared with the receiving user or their PSP (Guia v1.2 §6.1). ## OpenAPI ````yaml /en/openapi/v3-current/pix-lerian-pixauto.yaml patch /payer/authorizations/{authorization_id} openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: >- Pix Automático payer-facing API — deciding an authorization request raised by the receiving end, managing the payer-configurable parameters of a granted mandate, and revoking it (Guia de Implementação do Pix Automático v1.2 §3 and §6). ## Trust boundary This API is **machine-to-machine**. The caller is the client PSP's backend, authenticated with an application token; the token names that application and never one of its customers. The account therefore has to arrive in the request, and it does so in one of two shapes: ten routes take it in the **`X-Account-Id`** header, the same header SPI, DICT and COB use for the same job, and `POST /v1/payer/authorization-requests/from-qr` takes `payerAccountId` in the body — that route creates a pending request for a mandate that does not exist yet, so the account is part of what is being created rather than a scope on an existing resource, and a header beside the body field would be a second source for one value. Either way the value is the caller's **declaration** of which of its own customers it is acting for. **It is not proof that the end user controls that account, and this API cannot make it one.** Authenticating the payer and authorising its own customers against one another is the calling PSP's responsibility. What this end enforces is consistency: an absent header is 400 (PIX-0001) and a malformed account is 400 (PIX-0017 on the header, PIX-0003 in the body), and a resource that exists under a different account than the one named is **404**, not 403: the account is a predicate on the lookup, so this end never learns the resource exists elsewhere and cannot confirm it. Within one lookup, absence and a resource outside the selection get the same answer. license: name: Lerian Studio General License title: Pix Lerian — Pix Automático version: 1.0.0 servers: - url: https://api.example.com/pixauto/v1 description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Authorization requests raised by the receiving end and answered by the payer. A request is answered once. name: Payer Authorization Requests - description: Granted mandates. An authorization is managed for as long as it lives. name: Payer Authorizations - description: >- The payer's forward view of upcoming debits, and the cancellation of one of them. Cancelling a debit leaves the authorization ACTIVE — it stops one charge, not the mandate. The two operations are meant to be used together: the listing is the only place a client receives the scheduled_payment_id the cancellation addresses. name: Payer Scheduled Payments paths: /payer/authorizations/{authorization_id}: patch: tags: - Payer Authorizations summary: Update the payer-configurable parameters of an authorization description: >- RFC 7386 JSON Merge Patch over the three payer-configurable parameters of Guia v1.2 §6. Setting a property to null resets it to its NORMATIVE default; omitting it leaves it unchanged. The two toggles default to enabled, so a reset is not an opt-out. A change never reaches debits already scheduled. The maximum amount in force at scheduling time is snapshotted on the debit and prevails (Guia v1.2 §6.1); the new value applies to future scheduling only. The maximum amount never leaves this PSP: it is not shared with the receiving user or their PSP (Guia v1.2 §6.1). operationId: updatePayerAuthorizationParameters parameters: - description: >- Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary. example: 0198f3a2-1c4e-7c8b-9d1e-2f3a4b5c6d7e in: header name: X-Account-Id required: true schema: format: uuid not: const: 00000000-0000-0000-0000-000000000000 pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string - description: >- REQUIRED. Client-supplied replay key, at most 64 bytes. A request without it is refused with PIX-0030 @ 400 before the handler runs. Replaying the same key with a divergent method, URL or body is PIX-0031 @ 412. X-Account-Id is part of the compared request too, so replaying one account's key under another account is divergent rather than a replay. example: payer-decision-20260827-001 in: header name: X-Idempotency required: true schema: maxLength: 64 minLength: 1 type: string - description: >- Internal identifier of the mandate whose parameters are being changed. A request or mandate that exists under a DIFFERENT account than X-Account-Id names is answered 404, not 403: the lookup carries the account as a predicate, so this end never learns that a resource exists elsewhere and cannot confirm it. in: path name: authorization_id required: true schema: description: >- Internal identifier of the mandate whose parameters are being changed. A request or mandate that exists under a DIFFERENT account than X-Account-Id names is answered 404, not 403: the lookup carries the account as a predicate, so this end never learns that a resource exists elsewhere and cannot confirm it. examples: - 01a044a8-f3bd-7488-a0dc-e8d4be4802be type: string requestBody: content: application/merge-patch+json: examples: change-parameters: summary: Change payer-controlled parameters value: creditLineEnabled: false maximumAmount: amount: '250.00' currency: BRL schedulingNotificationsEnabled: false restore-defaults: summary: Restore every parameter to its normative default value: creditLineEnabled: null maximumAmount: null schedulingNotificationsEnabled: null schema: $ref: '#/components/schemas/AuthorizationParametersPatch' description: >- The merge-patch document. Every property is optional, and null is meaningful on all three. required: true responses: '200': content: application/json: example: authorizedAt: '2026-08-27T19:18:38Z' createdAt: '2026-08-27T19:18:38Z' id: 01a044a8-f3bd-7488-a0dc-e8d4be4802be journey: JOURNEY_1 parameters: creditLineEnabled: false maximumAmount: amount: '250.00' currency: BRL schedulingNotificationsEnabled: false recurrenceId: RR12345678202608276bca619e690 status: APPROVED updatedAt: '2026-08-27T19:20:00Z' schema: $ref: '#/components/schemas/AuthorizationParametersResponse' description: >- Parameters updated. The body carries the three parameters as they now stand. '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Malformed request, missing required input, invalid field value or invalid idempotency key (PIX-0001, PIX-0002, PIX-0003, PIX-0015, PIX-0017, PIX-0030, plus operation-specific PIX codes). X-Idempotency absent or longer than 64 bytes (PIX-0030). '401': content: application/json: example: code: PIX-0004 message: Invalid or expired authentication credentials. title: Unauthorized schema: $ref: '#/components/schemas/Error' description: The caller is not authenticated (PIX-0004). '403': content: application/json: example: code: PIX-0005 message: You do not have permission to perform this operation. title: Forbidden schema: $ref: '#/components/schemas/Error' description: >- The caller is authenticated but not entitled to this resource (PIX-0005). '404': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- No authorization with that identifier is reachable by the caller (PIX-0804). '409': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- The authorization is not in a state that accepts parameter changes (PIX-0805). '412': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- X-Idempotency replayed with a divergent request — a different method, URL (including the path parameter) or body (PIX-0031). X-Account-Id is part of the compared request too, so replaying one account's key under another account is divergent rather than a replay. '415': content: application/json: example: code: PIX-0016 message: >- The request body must be sent with Content-Type: application/json. title: Unsupported Media Type schema: $ref: '#/components/schemas/Error' description: >- The non-empty body used neither the canonical application/merge-patch+json media type nor the application/json compatibility form (PIX-0016). The legacy error message names application/json; new clients should send application/merge-patch+json. '422': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- The maximum amount is admissible in isolation but not against this mandate: it sits below the recurrence floor or below its fixed amount (PIX-0806, PIX-0811). '500': content: application/json: example: code: PIX-0000 message: >- The server encountered an unexpected error. Please try again later. title: Internal Server Error schema: $ref: '#/components/schemas/Error' description: >- Unexpected internal failure (PIX-0000). Details never travel in the envelope. default: content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Any other error returned by the handler uses the same PIX error envelope. The HTTP status and code identify the concrete failure. components: schemas: AuthorizationParametersPatch: additionalProperties: false properties: creditLineEnabled: description: >- Whether a pre-approved credit line may be drawn on when the balance is short at settlement (Guia v1.2 §6.3). Null restores the normative default, which is true. examples: - false type: - boolean - 'null' maximumAmount: description: >- Ceiling per payment under this authorization. Null removes the ceiling, which is its normative default (Guia v1.2 §6). Checked at scheduling, never at settlement, and never shared with the receiving user or their PSP (§6.1). examples: - amount: '250.00' currency: BRL oneOf: - $ref: '#/components/schemas/Money' - type: 'null' schedulingNotificationsEnabled: description: >- Governs ONLY the notice of a successful scheduling (Guia v1.2 §6.2). Null restores the normative default, which is true — a reset is NOT an opt-out. examples: - false type: - boolean - 'null' type: object AuthorizationParametersResponse: additionalProperties: false properties: authorizedAt: examples: - '2026-08-27T19:18:38Z' format: date-time type: string createdAt: examples: - '2026-08-27T19:18:38Z' format: date-time type: string id: examples: - 01a044a8-f3bd-7488-a0dc-e8d4be4802be type: string journey: examples: - JOURNEY_1 type: string parameters: $ref: '#/components/schemas/AuthorizationParametersBody' recurrenceId: examples: - RR12345678202608276bca619e690 type: string status: examples: - APPROVED type: string updatedAt: examples: - '2026-08-27T19:20:00Z' format: date-time type: string required: - id - recurrenceId - status - journey - parameters - authorizedAt - createdAt - updatedAt type: object Error: additionalProperties: false properties: code: examples: - PIX-0142 type: string fields: additionalProperties: type: string type: object headers: additionalProperties: type: string type: object message: examples: - claim_id is required type: string paths: additionalProperties: type: string type: object query_params: additionalProperties: type: string type: object raw: $ref: '#/components/schemas/RawError' title: examples: - Invalid Claim Request type: string required: - code - title - message type: object Money: additionalProperties: false properties: amount: description: >- Decimal string, positive, with at most two fractional digits and at most thirteen integer digits. A string, not a float — binary floating point cannot represent every centavo exactly, and this is a money path. Trailing zeros are not padded: 150.00 and 150 are the same amount. examples: - '149.90' pattern: ^(0\.([1-9][0-9]?|0[1-9])|[1-9][0-9]{0,12}(\.[0-9]{1,2})?)$ type: string currency: description: Pix settles in BRL only. enum: - BRL examples: - BRL type: string required: - amount - currency type: object AuthorizationParametersBody: additionalProperties: false properties: creditLineEnabled: examples: - false type: boolean maximumAmount: $ref: '#/components/schemas/Money' schedulingNotificationsEnabled: examples: - false type: boolean required: - schedulingNotificationsEnabled - creditLineEnabled type: object RawError: additionalProperties: false properties: message: examples: - upstream provider returned 503 type: string status: format: int64 type: integer required: - status - message type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.