> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Update an indirect participant > Applies mutable-field changes and/or ONE lifecycle action to an indirect. Absent (null) body fields are left untouched, so a PATCH carrying only action moves the lifecycle and changes nothing else; a PATCH carrying neither a field nor an action is a no-op that returns the current row without writing anything, not an error. The lifecycle actions are suspend, reactivate and close, and each one writes the LEDGER as well as the registry. suspend disables both sending and receiving on the indirect's `@pi` account, so the ledger refuses that participant's money even if another replica's resolution cache is still stale; reactivate re-enables both. close is IRREVERSIBLE — CLOSED is terminal, nothing leaves it, and afterwards every field mutation on the row is refused too. close never deletes: the `@pi` account is permanently blocked but kept, so a later re-registration of the same ISPB reuses it. When a lifecycle action and field changes arrive together, the action is what the audit trail records. Refusals: 409 PIX-0094 when the action is illegal from the current status (suspend on PENDING_PROVISIONING or CLOSED, reactivate on anything but SUSPENDED, close on PENDING_PROVISIONING, or any change to a CLOSED row) — re-issuing an action the row already reached is illegal too, not an idempotent success; 409 PIX-0096 when close is attempted while the `@pi` account still holds an available or on-hold balance, refused so the funds cannot be stranded (settle it to zero first); 409 PIX-0007 when another writer changed the row concurrently — reload and retry; 404 PIX-0095 for an unknown id; 422 PIX-0098 for an unknown action, a name over 120 characters, a delivery.endpointUrl that is not a valid https URL, or a qrCertificate.publicBaseUrl that is absent while ownCertificate is true, carries a scheme, is not a bare host with an optional path, or does not name a publicly resolvable host; 422 PIX-0111 when the body carries qrCertificate and this tenant's indirect-participants feature is not enabled — the WHOLE patch is refused, including any name or delivery change riding alongside; 503 PIX-4002 when the ledger could not be reached to check the balance or move the account flags. ## OpenAPI ````yaml /en/openapi/v3-current/pix.yaml patch /v1/indirects/{indirectId} openapi: 3.1.0 info: description: Brazilian PIX Direct (DICT + SPI) plugin API. title: plugin-br-pix-jd version: 1.0.0 servers: [] security: - BearerAuth: [] paths: /v1/indirects/{indirectId}: patch: tags: - Indirects summary: Update an indirect participant description: >- Applies mutable-field changes and/or ONE lifecycle action to an indirect. Absent (null) body fields are left untouched, so a PATCH carrying only action moves the lifecycle and changes nothing else; a PATCH carrying neither a field nor an action is a no-op that returns the current row without writing anything, not an error. The lifecycle actions are suspend, reactivate and close, and each one writes the LEDGER as well as the registry. suspend disables both sending and receiving on the indirect's `@pi` account, so the ledger refuses that participant's money even if another replica's resolution cache is still stale; reactivate re-enables both. close is IRREVERSIBLE — CLOSED is terminal, nothing leaves it, and afterwards every field mutation on the row is refused too. close never deletes: the `@pi` account is permanently blocked but kept, so a later re-registration of the same ISPB reuses it. When a lifecycle action and field changes arrive together, the action is what the audit trail records. Refusals: 409 PIX-0094 when the action is illegal from the current status (suspend on PENDING_PROVISIONING or CLOSED, reactivate on anything but SUSPENDED, close on PENDING_PROVISIONING, or any change to a CLOSED row) — re-issuing an action the row already reached is illegal too, not an idempotent success; 409 PIX-0096 when close is attempted while the `@pi` account still holds an available or on-hold balance, refused so the funds cannot be stranded (settle it to zero first); 409 PIX-0007 when another writer changed the row concurrently — reload and retry; 404 PIX-0095 for an unknown id; 422 PIX-0098 for an unknown action, a name over 120 characters, a delivery.endpointUrl that is not a valid https URL, or a qrCertificate.publicBaseUrl that is absent while ownCertificate is true, carries a scheme, is not a bare host with an optional path, or does not name a publicly resolvable host; 422 PIX-0111 when the body carries qrCertificate and this tenant's indirect-participants feature is not enabled — the WHOLE patch is refused, including any name or delivery change riding alongside; 503 PIX-4002 when the ledger could not be reached to check the balance or move the account flags. operationId: updateIndirect parameters: - description: The indirect participant id. in: path name: indirectId required: true schema: description: The indirect participant id. examples: - 018f2b7c-0000-7000-8000-000000000000 type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateIndirectBody' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/Indirect' description: OK default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error components: schemas: UpdateIndirectBody: additionalProperties: false properties: action: description: Lifecycle transition; one of suspend, reactivate, close. examples: - suspend type: string delivery: $ref: '#/components/schemas/UpdateIndirectDelivery' description: New delivery endpoint and/or secret. name: description: New display name (1..120 chars). examples: - Indirect PSP Ltda type: string qrCertificate: $ref: '#/components/schemas/UpdateIndirectQRCertificate' description: >- New own-QR-code certificate configuration. Absent leaves it unchanged. Accepted only when the indirect participants feature is enabled for the tenant (422 PIX-0111 otherwise). type: object Indirect: additionalProperties: false properties: createdAt: description: Creation timestamp (UTC). format: date-time type: string delivery: $ref: '#/components/schemas/IndirectDelivery' description: Delivery endpoint (secret redacted). indirectId: description: The indirect participant id (routing identifier). examples: - 018f2b7c-0000-7000-8000-000000000000 type: string ispb: description: The indirect PSP's ISPB. examples: - '12345678' type: string messagingMode: description: Delivery mode. examples: - raw type: string name: description: Display name. examples: - Indirect PSP Ltda type: string piAccountAlias: description: The derived @pi_{ispb} Midaz account alias. examples: - '@pi_12345678' type: string provisioning: $ref: '#/components/schemas/IndirectProvisioning' description: Provisioning-saga state. qrCertificate: $ref: '#/components/schemas/IndirectQRCertificate' description: Own-QR-code certificate configuration. status: description: Lifecycle status. examples: - ACTIVE type: string updatedAt: description: Last-update timestamp (UTC). format: date-time type: string required: - indirectId - name - ispb - status - piAccountAlias - messagingMode - delivery - qrCertificate - provisioning - createdAt - updatedAt type: object Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). examples: - ERR-0001 type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object UpdateIndirectDelivery: additionalProperties: false properties: endpointUrl: description: New HTTPS delivery endpoint. examples: - https://indirect.example.com/pix type: string secret: description: New HMAC-SHA256 signing secret; encrypted at rest; never returned. examples: - s3cr3t type: string type: object UpdateIndirectQRCertificate: additionalProperties: false properties: ownCertificate: description: >- Whether the indirect hosts the dynamic-QR JWS/JWKS under its OWN certificate. False falls back to the direct participant's certificate and FQDN, and discards publicBaseUrl. examples: - true type: boolean publicBaseUrl: description: >- The indirect's SCHEME-LESS public base URL (host plus optional path) the QR payload location is built on. Required when ownCertificate is true; ignored otherwise. examples: - qr.indirect.example.com/pix type: string type: object IndirectDelivery: additionalProperties: false properties: endpointUrl: description: The HTTPS delivery endpoint. examples: - https://indirect.example.com/pix type: string secret: description: Always redacted. examples: - '***' type: string required: - endpointUrl - secret type: object IndirectProvisioning: additionalProperties: false properties: failedStep: description: The saga step that last failed, or null when clean. examples: - createPIAccount type: - string - 'null' required: - failedStep type: object IndirectQRCertificate: additionalProperties: false properties: ownCertificate: description: >- Whether the indirect hosts the dynamic-QR JWS/JWKS under its own certificate. False means it falls back to the direct participant. examples: - true type: boolean publicBaseUrl: description: >- The indirect's scheme-less public base URL for QR payload locations. Empty when ownCertificate is false. examples: - qr.indirect.example.com/pix type: string required: - ownCertificate - publicBaseUrl type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ````