> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # List authorization requests pending the payer's decision > Returns the requests still awaiting the payer's decision, newest first — the "consulta e gerenciamento de autorizações pendentes" of Guia v1.2 §6.4. A request LEAVES this list when it is accepted, rejected, cancelled by the receiving PSP (pain.011) or expires: §3.2 requires the payer PSP to remove it in the last two cases. There is deliberately no status parameter to widen the surface with. This page is a lifecycle projection: it carries identifiers, journey, status and deadlines, but not the counterparty or recurrence terms. The channel must obtain the terms it displays to the payer from its provider/messaging integration. Paging is by cursor. On the last page next_cursor is null, never an empty string. ## OpenAPI ````yaml /es/openapi/v3-current/pix-lerian-pixauto.yaml get /payer/authorization-requests openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: >- Pix Automático payer-facing API — deciding an authorization request raised by the receiving end, managing the payer-configurable parameters of a granted mandate, and revoking it (Guia de Implementação do Pix Automático v1.2 §3 and §6). ## Trust boundary This API is **machine-to-machine**. The caller is the client PSP's backend, authenticated with an application token; the token names that application and never one of its customers. The account therefore has to arrive in the request, and it does so in one of two shapes: ten routes take it in the **`X-Account-Id`** header, the same header SPI, DICT and COB use for the same job, and `POST /v1/payer/authorization-requests/from-qr` takes `payerAccountId` in the body — that route creates a pending request for a mandate that does not exist yet, so the account is part of what is being created rather than a scope on an existing resource, and a header beside the body field would be a second source for one value. Either way the value is the caller's **declaration** of which of its own customers it is acting for. **It is not proof that the end user controls that account, and this API cannot make it one.** Authenticating the payer and authorising its own customers against one another is the calling PSP's responsibility. What this end enforces is consistency: an absent header is 400 (PIX-0001) and a malformed account is 400 (PIX-0017 on the header, PIX-0003 in the body), and a resource that exists under a different account than the one named is **404**, not 403: the account is a predicate on the lookup, so this end never learns the resource exists elsewhere and cannot confirm it. Within one lookup, absence and a resource outside the selection get the same answer. license: name: Lerian Studio General License title: Pix Lerian — Pix Automático version: 1.0.0 servers: - url: https://api.example.com/pixauto/v1 description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Authorization requests raised by the receiving end and answered by the payer. A request is answered once. name: Payer Authorization Requests - description: Granted mandates. An authorization is managed for as long as it lives. name: Payer Authorizations - description: >- The payer's forward view of upcoming debits, and the cancellation of one of them. Cancelling a debit leaves the authorization ACTIVE — it stops one charge, not the mandate. The two operations are meant to be used together: the listing is the only place a client receives the scheduled_payment_id the cancellation addresses. name: Payer Scheduled Payments paths: /payer/authorization-requests: get: tags: - Payer Authorization Requests summary: List authorization requests pending the payer's decision description: >- Returns the requests still awaiting the payer's decision, newest first — the "consulta e gerenciamento de autorizações pendentes" of Guia v1.2 §6.4. A request LEAVES this list when it is accepted, rejected, cancelled by the receiving PSP (pain.011) or expires: §3.2 requires the payer PSP to remove it in the last two cases. There is deliberately no status parameter to widen the surface with. This page is a lifecycle projection: it carries identifiers, journey, status and deadlines, but not the counterparty or recurrence terms. The channel must obtain the terms it displays to the payer from its provider/messaging integration. Paging is by cursor. On the last page next_cursor is null, never an empty string. operationId: listPayerAuthorizationRequests parameters: - description: >- Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary. example: 0198f3a2-1c4e-7c8b-9d1e-2f3a4b5c6d7e in: header name: X-Account-Id required: true schema: format: uuid not: const: 00000000-0000-0000-0000-000000000000 pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string - description: >- Maximum number of records per page (1-100, default 10). A value outside that range, or one that is not an integer, is REFUSED — never clamped, never silently coerced. example: 25 explode: false in: query name: limit schema: default: 10 format: int64 maximum: 100 minimum: 1 type: integer - description: >- Opaque cursor taken from a previous page's next_cursor. On the last page that value is null, never an empty string. A malformed or undecodable value is refused with 400. The cursor must be replayed against the same endpoint, with the same sort_order and the same filters used to obtain it; changing any of those starts a different query, and the previous cursor should not be reused. explode: false in: query name: cursor schema: description: >- Opaque cursor taken from a previous page's next_cursor. On the last page that value is null, never an empty string. A malformed or undecodable value is refused with 400. The cursor must be replayed against the same endpoint, with the same sort_order and the same filters used to obtain it; changing any of those starts a different query, and the previous cursor should not be reused. examples: - >- eyJ0IjoiMjAyNi0wOC0yN1QxODo0MjowMFoiLCJpIjoiMDE5OGYzYTEtN2M0Mi03ZGUxLWEwMjQtYjFmMGI3ZTljMzAxIn0= type: string - description: >- Sort direction. An unrecognised value is refused rather than silently defaulted, because switching it mid-traversal without notice would silently reverse the page sequence the caller is walking. explode: false in: query name: sort_order schema: default: desc description: >- Sort direction. An unrecognised value is refused rather than silently defaulted, because switching it mid-traversal without notice would silently reverse the page sequence the caller is walking. enum: - asc - desc examples: - desc type: string responses: '200': content: application/json: example: items: - authorizationRequestId: SC12345678202608276bca619e690 expiresAt: '2026-09-26T19:18:38Z' journey: JOURNEY_2 receivedAt: '2026-08-27T19:18:38Z' recurrenceId: RR12345678202608276bca619e690 status: RECEIVED next_cursor: null prev_cursor: null schema: $ref: '#/components/schemas/AuthorizationRequestPage' description: A page of pending authorization requests. '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Malformed or invalid path, header or query input (PIX-0001, PIX-0003, PIX-0015, PIX-0017, PIX-0020, plus operation-specific PIX codes). '401': content: application/json: example: code: PIX-0004 message: Invalid or expired authentication credentials. title: Unauthorized schema: $ref: '#/components/schemas/Error' description: The caller is not authenticated (PIX-0004). '403': content: application/json: example: code: PIX-0005 message: You do not have permission to perform this operation. title: Forbidden schema: $ref: '#/components/schemas/Error' description: >- The caller is authenticated but not entitled to this resource (PIX-0005). '500': content: application/json: example: code: PIX-0000 message: >- The server encountered an unexpected error. Please try again later. title: Internal Server Error schema: $ref: '#/components/schemas/Error' description: >- Unexpected internal failure (PIX-0000). Details never travel in the envelope. default: content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Any other error returned by the handler uses the same PIX error envelope. The HTTP status and code identify the concrete failure. components: schemas: AuthorizationRequestPage: additionalProperties: false properties: items: description: Empty array when there are no results — never null. items: $ref: '#/components/schemas/AuthorizationRequestItem' type: array next_cursor: description: >- Opaque cursor for the next page. NULL on the last page, never an empty string. examples: - >- eyJ0IjoiMjAyNi0wOC0yN1QxODo0MjowMFoiLCJpIjoiMDE5OGYzYTEtN2M0Mi03ZGUxLWEwMjQtYjFmMGI3ZTljMzAxIn0= type: - string - 'null' prev_cursor: description: >- Opaque cursor for the previous page. These listings do not issue a backwards cursor, so the value is null. type: - string - 'null' required: - items - next_cursor - prev_cursor type: object Error: additionalProperties: false properties: code: examples: - PIX-0142 type: string fields: additionalProperties: type: string type: object headers: additionalProperties: type: string type: object message: examples: - claim_id is required type: string paths: additionalProperties: type: string type: object query_params: additionalProperties: type: string type: object raw: $ref: '#/components/schemas/RawError' title: examples: - Invalid Claim Request type: string required: - code - title - message type: object AuthorizationRequestItem: additionalProperties: false properties: authorizationRequestId: description: >- Payer-side request identifier. It is the counterparty idSolicRec on journey 1 and a local identifier on QR journeys; always pass this exact value to the decision route. examples: - SC12345678202608276bca619e690 type: string decidedAt: description: When the payer decided. Absent while the request is still pending. examples: - '2026-08-27T19:20:00Z' format: date-time type: string expiresAt: description: Decision deadline. At most 30 days from creation (Guia v1.2 §3.2). examples: - '2026-09-26T19:18:38Z' format: date-time type: string journey: description: >- Authorization journey that produced the request. Absent on journey 1, whose inbound message names none. examples: - JOURNEY_2 type: string receivedAt: description: When this end received the request. examples: - '2026-08-27T19:18:38Z' format: date-time type: string recurrenceId: description: BACEN idRec of the recurrence the request covers. examples: - RR12345678202608276bca619e690 type: string rejectionReason: description: >- Motive the payer gave when refusing the recurrence. Present only when status is REJECTED. enum: - NotRecognizedByDebtor - RejectedByDebtor examples: - NotRecognizedByDebtor type: string status: description: >- Status the request currently holds -- pending on the listing surface, any lifecycle status on the individual GET. examples: - RECEIVED type: string required: - authorizationRequestId - recurrenceId - status - expiresAt - receivedAt type: object RawError: additionalProperties: false properties: message: examples: - upstream provider returned 503 type: string status: format: int64 type: integer required: - status - message type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.