> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # List the payer's authorizations > Returns the payer's mandates. Without include_terminated it answers the ones that have NOT ENDED — the APPROVED mandates and those still AWAITING_CONCLUSION — which is the "consulta e gerenciamento de autorizações ativas" surface of Guia v1.2 §6.4; with include_terminated=true it answers that same section's "histórico de autorizações", the REJECTED, EXPIRED and CANCELLED mandates included. WARNING: THE DEFAULT PAGE IS NOT THE SET OF ACTIVE MANDATES. A mandate stays AWAITING_CONCLUSION until the receiving PSP answers this end's concession with its conclusive pain.012, and until that message arrives it is NOT active at BACEN: nothing may be debited under it (Manual de Tempos do Pix v7.0 §3.2). It is listed by default because the payer was told to wait for precisely that flow and would look for it here. Filter on status=APPROVED to read only the mandates that are in force. The maximum amount is returned here because this is the PAYER's own authenticated channel. Guia v1.2 §6.1 bars sharing it with the RECEIVING user and their PSP, which this surface is not. This page does not repeat the counterparty or complete recurrence terms. It is the lifecycle and payer-parameter projection; the channel must join any richer display data from its provider/messaging integration. Paging is by cursor. On the last page next_cursor is null, never an empty string. ## OpenAPI ````yaml /es/openapi/v3-current/pix-lerian-pixauto.yaml get /payer/authorizations openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: >- Pix Automático payer-facing API — deciding an authorization request raised by the receiving end, managing the payer-configurable parameters of a granted mandate, and revoking it (Guia de Implementação do Pix Automático v1.2 §3 and §6). ## Trust boundary This API is **machine-to-machine**. The caller is the client PSP's backend, authenticated with an application token; the token names that application and never one of its customers. The account therefore has to arrive in the request, and it does so in one of two shapes: ten routes take it in the **`X-Account-Id`** header, the same header SPI, DICT and COB use for the same job, and `POST /v1/payer/authorization-requests/from-qr` takes `payerAccountId` in the body — that route creates a pending request for a mandate that does not exist yet, so the account is part of what is being created rather than a scope on an existing resource, and a header beside the body field would be a second source for one value. Either way the value is the caller's **declaration** of which of its own customers it is acting for. **It is not proof that the end user controls that account, and this API cannot make it one.** Authenticating the payer and authorising its own customers against one another is the calling PSP's responsibility. What this end enforces is consistency: an absent header is 400 (PIX-0001) and a malformed account is 400 (PIX-0017 on the header, PIX-0003 in the body), and a resource that exists under a different account than the one named is **404**, not 403: the account is a predicate on the lookup, so this end never learns the resource exists elsewhere and cannot confirm it. Within one lookup, absence and a resource outside the selection get the same answer. license: name: Lerian Studio General License title: Pix Lerian — Pix Automático version: 1.0.0 servers: - url: https://api.example.com/pixauto/v1 description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Authorization requests raised by the receiving end and answered by the payer. A request is answered once. name: Payer Authorization Requests - description: Granted mandates. An authorization is managed for as long as it lives. name: Payer Authorizations - description: >- The payer's forward view of upcoming debits, and the cancellation of one of them. Cancelling a debit leaves the authorization ACTIVE — it stops one charge, not the mandate. The two operations are meant to be used together: the listing is the only place a client receives the scheduled_payment_id the cancellation addresses. name: Payer Scheduled Payments paths: /payer/authorizations: get: tags: - Payer Authorizations summary: List the payer's authorizations description: >- Returns the payer's mandates. Without include_terminated it answers the ones that have NOT ENDED — the APPROVED mandates and those still AWAITING_CONCLUSION — which is the "consulta e gerenciamento de autorizações ativas" surface of Guia v1.2 §6.4; with include_terminated=true it answers that same section's "histórico de autorizações", the REJECTED, EXPIRED and CANCELLED mandates included. WARNING: THE DEFAULT PAGE IS NOT THE SET OF ACTIVE MANDATES. A mandate stays AWAITING_CONCLUSION until the receiving PSP answers this end's concession with its conclusive pain.012, and until that message arrives it is NOT active at BACEN: nothing may be debited under it (Manual de Tempos do Pix v7.0 §3.2). It is listed by default because the payer was told to wait for precisely that flow and would look for it here. Filter on status=APPROVED to read only the mandates that are in force. The maximum amount is returned here because this is the PAYER's own authenticated channel. Guia v1.2 §6.1 bars sharing it with the RECEIVING user and their PSP, which this surface is not. This page does not repeat the counterparty or complete recurrence terms. It is the lifecycle and payer-parameter projection; the channel must join any richer display data from its provider/messaging integration. Paging is by cursor. On the last page next_cursor is null, never an empty string. operationId: listPayerAuthorizations parameters: - description: >- Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary. example: 0198f3a2-1c4e-7c8b-9d1e-2f3a4b5c6d7e in: header name: X-Account-Id required: true schema: format: uuid not: const: 00000000-0000-0000-0000-000000000000 pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string - description: >- Maximum number of records per page (1-100, default 10). A value outside that range, or one that is not an integer, is REFUSED — never clamped, never silently coerced. example: 25 explode: false in: query name: limit schema: default: 10 format: int64 maximum: 100 minimum: 1 type: integer - description: >- Opaque cursor taken from a previous page's next_cursor. On the last page that value is null, never an empty string. A malformed or undecodable value is refused with 400. The cursor must be replayed against the same endpoint, with the same sort_order and the same filters used to obtain it; changing any of those starts a different query, and the previous cursor should not be reused. explode: false in: query name: cursor schema: description: >- Opaque cursor taken from a previous page's next_cursor. On the last page that value is null, never an empty string. A malformed or undecodable value is refused with 400. The cursor must be replayed against the same endpoint, with the same sort_order and the same filters used to obtain it; changing any of those starts a different query, and the previous cursor should not be reused. examples: - >- eyJ0IjoiMjAyNi0wOC0yN1QxODo0MjowMFoiLCJpIjoiMDE5OGYzYTEtN2M0Mi03ZGUxLWEwMjQtYjFmMGI3ZTljMzAxIn0= type: string - description: >- Sort direction. An unrecognised value is refused rather than silently defaulted, because switching it mid-traversal without notice would silently reverse the page sequence the caller is walking. explode: false in: query name: sort_order schema: default: desc description: >- Sort direction. An unrecognised value is refused rather than silently defaulted, because switching it mid-traversal without notice would silently reverse the page sequence the caller is walking. enum: - asc - desc examples: - desc type: string - description: >- Filter by the MANDATE's lifecycle status, the vocabulary each item's status field carries: AWAITING_CONCLUSION, APPROVED, REJECTED, EXPIRED, CANCELLED. Repeatable. A status this end does not know matches no row, which is an empty page rather than an error. explode: false in: query name: status schema: description: >- Filter by the MANDATE's lifecycle status, the vocabulary each item's status field carries: AWAITING_CONCLUSION, APPROVED, REJECTED, EXPIRED, CANCELLED. Repeatable. A status this end does not know matches no row, which is an empty page rather than an error. examples: - - APPROVED items: type: string type: - array - 'null' - description: >- Include the mandates that have ENDED — REJECTED, EXPIRED and CANCELLED — which is the full "histórico de autorizações" surface of Guia v1.2 §6.4. Absent, the page carries only the mandates that have not ended, AWAITING_CONCLUSION among them. explode: false in: query name: include_terminated schema: default: false description: >- Include the mandates that have ENDED — REJECTED, EXPIRED and CANCELLED — which is the full "histórico de autorizações" surface of Guia v1.2 §6.4. Absent, the page carries only the mandates that have not ended, AWAITING_CONCLUSION among them. examples: - true type: boolean responses: '200': content: application/json: example: items: - authorizedAt: '2026-08-27T19:18:38Z' createdAt: '2026-08-27T19:18:38Z' id: 01a044a8-f3bd-7488-a0dc-e8d4be4802be journey: JOURNEY_1 parameters: creditLineEnabled: false maximumAmount: amount: '250.00' currency: BRL schedulingNotificationsEnabled: false recurrenceId: RR12345678202608276bca619e690 status: APPROVED updatedAt: '2026-08-27T19:20:00Z' next_cursor: null prev_cursor: null schema: $ref: '#/components/schemas/AuthorizationPage' description: A page of authorizations. '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Malformed or invalid path, header or query input (PIX-0001, PIX-0003, PIX-0015, PIX-0017, PIX-0020, plus operation-specific PIX codes). '401': content: application/json: example: code: PIX-0004 message: Invalid or expired authentication credentials. title: Unauthorized schema: $ref: '#/components/schemas/Error' description: The caller is not authenticated (PIX-0004). '403': content: application/json: example: code: PIX-0005 message: You do not have permission to perform this operation. title: Forbidden schema: $ref: '#/components/schemas/Error' description: >- The caller is authenticated but not entitled to this resource (PIX-0005). '500': content: application/json: example: code: PIX-0000 message: >- The server encountered an unexpected error. Please try again later. title: Internal Server Error schema: $ref: '#/components/schemas/Error' description: >- Unexpected internal failure (PIX-0000). Details never travel in the envelope. default: content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Any other error returned by the handler uses the same PIX error envelope. The HTTP status and code identify the concrete failure. components: schemas: AuthorizationPage: additionalProperties: false properties: items: description: Empty array when there are no results — never null. items: $ref: '#/components/schemas/AuthorizationItem' type: array next_cursor: description: >- Opaque cursor for the next page. NULL on the last page, never an empty string. examples: - >- eyJ0IjoiMjAyNi0wOC0yN1QxODo0MjowMFoiLCJpIjoiMDE5OGYzYTEtN2M0Mi03ZGUxLWEwMjQtYjFmMGI3ZTljMzAxIn0= type: - string - 'null' prev_cursor: description: >- Opaque cursor for the previous page. These listings do not issue a backwards cursor, so the value is null. type: - string - 'null' required: - items - next_cursor - prev_cursor type: object Error: additionalProperties: false properties: code: examples: - PIX-0142 type: string fields: additionalProperties: type: string type: object headers: additionalProperties: type: string type: object message: examples: - claim_id is required type: string paths: additionalProperties: type: string type: object query_params: additionalProperties: type: string type: object raw: $ref: '#/components/schemas/RawError' title: examples: - Invalid Claim Request type: string required: - code - title - message type: object AuthorizationItem: additionalProperties: false properties: authorizedAt: description: When the mandate was granted. examples: - '2026-08-27T19:18:38Z' format: date-time type: string createdAt: examples: - '2026-08-27T19:18:38Z' format: date-time type: string id: description: Internal identifier of the mandate. examples: - 01a044a8-f3bd-7488-a0dc-e8d4be4802be type: string journey: description: Journey that granted the mandate. enum: - JOURNEY_1 - JOURNEY_2 - JOURNEY_3 - JOURNEY_4 examples: - JOURNEY_1 type: string parameters: $ref: '#/components/schemas/AuthorizationParametersBody' recurrenceId: description: BACEN idRec of the recurrence it covers. examples: - RR12345678202608276bca619e690 type: string status: description: >- Lifecycle status of the mandate. AWAITING_CONCLUSION means the payer granted it and the receiving PSP has not yet concluded the process — it is NOT active at BACEN (Manual de Tempos do Pix v7.0 §3.2). enum: - AWAITING_CONCLUSION - APPROVED - REJECTED - EXPIRED - CANCELLED examples: - APPROVED type: string terminatedAt: description: >- When the mandate ENDED — the instant it became REJECTED, EXPIRED or CANCELLED. Absent while it has not ended, which covers an APPROVED mandate and an AWAITING_CONCLUSION one alike: absence means the mandate has not ended, never that it is active. examples: - '2026-08-27T20:00:00Z' format: date-time type: string updatedAt: examples: - '2026-08-27T20:00:00Z' format: date-time type: string required: - id - recurrenceId - status - journey - parameters - authorizedAt - createdAt - updatedAt type: object RawError: additionalProperties: false properties: message: examples: - upstream provider returned 503 type: string status: format: int64 type: integer required: - status - message type: object AuthorizationParametersBody: additionalProperties: false properties: creditLineEnabled: examples: - false type: boolean maximumAmount: $ref: '#/components/schemas/Money' schedulingNotificationsEnabled: examples: - false type: boolean required: - schedulingNotificationsEnabled - creditLineEnabled type: object Money: additionalProperties: false properties: amount: description: >- Decimal string, positive, with at most two fractional digits and at most thirteen integer digits. A string, not a float — binary floating point cannot represent every centavo exactly, and this is a money path. Trailing zeros are not padded: 150.00 and 150 are the same amount. examples: - '149.90' pattern: ^(0\.([1-9][0-9]?|0[1-9])|[1-9][0-9]{0,12}(\.[0-9]{1,2})?)$ type: string currency: description: Pix settles in BRL only. enum: - BRL examples: - BRL type: string required: - amount - currency type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.