> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Get one authorization request > Returns one authorization request, in ANY state: pending, accepted, rejected, cancelled by the receiving PSP or expired. It is the companion of the pending-request listing above, which a request LEAVES the moment it is decided (Guia v1.2 §3.2) — this operation is what an integrator calls afterwards to learn the outcome. A request belonging to a different account than X-Account-Id names is answered 404, exactly as one that does not exist: the account is a predicate on the lookup, so this end never learns the request exists elsewhere and cannot confirm it. ## OpenAPI ````yaml /es/openapi/v3-current/pix-lerian-pixauto.yaml get /payer/authorization-requests/{authorization_request_id} openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: >- Pix Automático payer-facing API — deciding an authorization request raised by the receiving end, managing the payer-configurable parameters of a granted mandate, and revoking it (Guia de Implementação do Pix Automático v1.2 §3 and §6). ## Trust boundary This API is **machine-to-machine**. The caller is the client PSP's backend, authenticated with an application token; the token names that application and never one of its customers. The account therefore has to arrive in the request, and it does so in one of two shapes: ten routes take it in the **`X-Account-Id`** header, the same header SPI, DICT and COB use for the same job, and `POST /v1/payer/authorization-requests/from-qr` takes `payerAccountId` in the body — that route creates a pending request for a mandate that does not exist yet, so the account is part of what is being created rather than a scope on an existing resource, and a header beside the body field would be a second source for one value. Either way the value is the caller's **declaration** of which of its own customers it is acting for. **It is not proof that the end user controls that account, and this API cannot make it one.** Authenticating the payer and authorising its own customers against one another is the calling PSP's responsibility. What this end enforces is consistency: an absent header is 400 (PIX-0001) and a malformed account is 400 (PIX-0017 on the header, PIX-0003 in the body), and a resource that exists under a different account than the one named is **404**, not 403: the account is a predicate on the lookup, so this end never learns the resource exists elsewhere and cannot confirm it. Within one lookup, absence and a resource outside the selection get the same answer. license: name: Lerian Studio General License title: Pix Lerian — Pix Automático version: 1.0.0 servers: - url: https://api.example.com/pixauto/v1 description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Authorization requests raised by the receiving end and answered by the payer. A request is answered once. name: Payer Authorization Requests - description: Granted mandates. An authorization is managed for as long as it lives. name: Payer Authorizations - description: >- The payer's forward view of upcoming debits, and the cancellation of one of them. Cancelling a debit leaves the authorization ACTIVE — it stops one charge, not the mandate. The two operations are meant to be used together: the listing is the only place a client receives the scheduled_payment_id the cancellation addresses. name: Payer Scheduled Payments paths: /payer/authorization-requests/{authorization_request_id}: get: tags: - Payer Authorization Requests summary: Get one authorization request description: >- Returns one authorization request, in ANY state: pending, accepted, rejected, cancelled by the receiving PSP or expired. It is the companion of the pending-request listing above, which a request LEAVES the moment it is decided (Guia v1.2 §3.2) — this operation is what an integrator calls afterwards to learn the outcome. A request belonging to a different account than X-Account-Id names is answered 404, exactly as one that does not exist: the account is a predicate on the lookup, so this end never learns the request exists elsewhere and cannot confirm it. operationId: getPayerAuthorizationRequest parameters: - description: >- Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary. example: 0198f3a2-1c4e-7c8b-9d1e-2f3a4b5c6d7e in: header name: X-Account-Id required: true schema: format: uuid not: const: 00000000-0000-0000-0000-000000000000 pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string - description: >- Payer-side request identifier, in ANY state — pending or already decided. It is the counterparty idSolicRec on journey 1 and a local identifier on QR journeys. Fixed 29-character shape (Manual de Padrões §2.2.1); one that does not parse into a well-formed identifier is refused with 422 (PIX-0810). A request or mandate under a different X-Account-Id is answered 404, not 403, so the caller cannot confirm that a resource exists elsewhere. in: path name: authorization_request_id required: true schema: description: >- Payer-side request identifier, in ANY state — pending or already decided. It is the counterparty idSolicRec on journey 1 and a local identifier on QR journeys. Fixed 29-character shape (Manual de Padrões §2.2.1); one that does not parse into a well-formed identifier is refused with 422 (PIX-0810). A request or mandate under a different X-Account-Id is answered 404, not 403, so the caller cannot confirm that a resource exists elsewhere. examples: - SC12345678202608276bca619e690 maxLength: 29 minLength: 29 pattern: ^SC[0-9A-Z]{8}[0-9]{8}[a-zA-Z0-9]{11}$ type: string responses: '200': content: application/json: examples: accepted: summary: Accepted -- decided and carrying decidedAt value: authorizationRequestId: SC12345678202608276bca619e690 decidedAt: '2026-08-27T19:20:00Z' expiresAt: '2026-09-26T19:18:38Z' receivedAt: '2026-08-27T19:18:38Z' recurrenceId: RR12345678202608276bca619e690 status: ACCEPTED pending: summary: Pending -- not yet decided, so neither field is published value: authorizationRequestId: SC12345678202608276bca619e690 expiresAt: '2026-09-26T19:18:38Z' receivedAt: '2026-08-27T19:18:38Z' recurrenceId: RR12345678202608276bca619e690 status: RECEIVED rejected: summary: Rejected -- decided, carrying decidedAt and rejectionReason value: authorizationRequestId: SC12345678202608276bca619e690 decidedAt: '2026-08-27T19:20:00Z' expiresAt: '2026-09-26T19:18:38Z' receivedAt: '2026-08-27T19:18:38Z' recurrenceId: RR12345678202608276bca619e690 rejectionReason: RejectedByDebtor status: REJECTED schema: $ref: '#/components/schemas/AuthorizationRequestItem' description: The authorization request, in any state. '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Malformed or invalid path, header or query input (PIX-0001, PIX-0003, PIX-0015, PIX-0017, PIX-0020, plus operation-specific PIX codes). '401': content: application/json: example: code: PIX-0004 message: Invalid or expired authentication credentials. title: Unauthorized schema: $ref: '#/components/schemas/Error' description: The caller is not authenticated (PIX-0004). '403': content: application/json: example: code: PIX-0005 message: You do not have permission to perform this operation. title: Forbidden schema: $ref: '#/components/schemas/Error' description: >- The caller is authenticated but not entitled to this resource (PIX-0005). '404': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- No authorization request with that id is reachable by the caller (PIX-0800). '422': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- authorization_request_id parsed as a path segment but does not match the 29-character idSolicRec format of Manual de Padrões §2.2.1 (PIX-0810). '500': content: application/json: example: code: PIX-0000 message: >- The server encountered an unexpected error. Please try again later. title: Internal Server Error schema: $ref: '#/components/schemas/Error' description: >- Unexpected internal failure (PIX-0000). Details never travel in the envelope. default: content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Any other error returned by the handler uses the same PIX error envelope. The HTTP status and code identify the concrete failure. components: schemas: AuthorizationRequestItem: additionalProperties: false properties: authorizationRequestId: description: >- Payer-side request identifier. It is the counterparty idSolicRec on journey 1 and a local identifier on QR journeys; always pass this exact value to the decision route. examples: - SC12345678202608276bca619e690 type: string decidedAt: description: When the payer decided. Absent while the request is still pending. examples: - '2026-08-27T19:20:00Z' format: date-time type: string expiresAt: description: Decision deadline. At most 30 days from creation (Guia v1.2 §3.2). examples: - '2026-09-26T19:18:38Z' format: date-time type: string journey: description: >- Authorization journey that produced the request. Absent on journey 1, whose inbound message names none. examples: - JOURNEY_2 type: string receivedAt: description: When this end received the request. examples: - '2026-08-27T19:18:38Z' format: date-time type: string recurrenceId: description: BACEN idRec of the recurrence the request covers. examples: - RR12345678202608276bca619e690 type: string rejectionReason: description: >- Motive the payer gave when refusing the recurrence. Present only when status is REJECTED. enum: - NotRecognizedByDebtor - RejectedByDebtor examples: - NotRecognizedByDebtor type: string status: description: >- Status the request currently holds -- pending on the listing surface, any lifecycle status on the individual GET. examples: - RECEIVED type: string required: - authorizationRequestId - recurrenceId - status - expiresAt - receivedAt type: object Error: additionalProperties: false properties: code: examples: - PIX-0142 type: string fields: additionalProperties: type: string type: object headers: additionalProperties: type: string type: object message: examples: - claim_id is required type: string paths: additionalProperties: type: string type: object query_params: additionalProperties: type: string type: object raw: $ref: '#/components/schemas/RawError' title: examples: - Invalid Claim Request type: string required: - code - title - message type: object RawError: additionalProperties: false properties: message: examples: - upstream provider returned 503 type: string status: format: int64 type: integer required: - status - message type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.