List authorization requests pending the payer's decision

curl --request GET \
  --url https://api.example.com/pixauto/v1/payer/authorization-requests \
  --header 'Authorization: Bearer <token>' \
  --header 'X-Account-Id: <x-account-id>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/pixauto/v1/payer/authorization-requests"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Account-Id", "<x-account-id>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'GET',
  headers: {'X-Account-Id': '<x-account-id>', Authorization: 'Bearer <token>'}
};

fetch('https://api.example.com/pixauto/v1/payer/authorization-requests', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/pixauto/v1/payer/authorization-requests"

headers = {
    "X-Account-Id": "<x-account-id>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

{
  "items": [
    {
      "authorizationRequestId": "SC12345678202608276bca619e690",
      "expiresAt": "2026-09-26T19:18:38Z",
      "journey": "JOURNEY_2",
      "receivedAt": "2026-08-27T19:18:38Z",
      "recurrenceId": "RR12345678202608276bca619e690",
      "status": "RECEIVED"
    }
  ],
  "next_cursor": null,
  "prev_cursor": null
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

{
  "code": "PIX-0004",
  "message": "Invalid or expired authentication credentials.",
  "title": "Unauthorized"
}

{
  "code": "PIX-0005",
  "message": "You do not have permission to perform this operation.",
  "title": "Forbidden"
}

{
  "code": "PIX-0000",
  "message": "The server encountered an unexpected error. Please try again later.",
  "title": "Internal Server Error"
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

List authorization requests pending the payer's decision

Returns the requests still awaiting the payer’s decision, newest first — the “consulta e gerenciamento de autorizações pendentes” of Guia v1.2 §6.4.

A request LEAVES this list when it is accepted, rejected, cancelled by the receiving PSP (pain.011) or expires: §3.2 requires the payer PSP to remove it in the last two cases. There is deliberately no status parameter to widen the surface with.

This page is a lifecycle projection: it carries identifiers, journey, status and deadlines, but not the counterparty or recurrence terms. The channel must obtain the terms it displays to the payer from its provider/messaging integration.

Paging is by cursor. On the last page next_cursor is null, never an empty string.

GET

payer

authorization-requests

List authorization requests pending the payer's decision

curl --request GET \
  --url https://api.example.com/pixauto/v1/payer/authorization-requests \
  --header 'Authorization: Bearer <token>' \
  --header 'X-Account-Id: <x-account-id>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/pixauto/v1/payer/authorization-requests"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Account-Id", "<x-account-id>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'GET',
  headers: {'X-Account-Id': '<x-account-id>', Authorization: 'Bearer <token>'}
};

fetch('https://api.example.com/pixauto/v1/payer/authorization-requests', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/pixauto/v1/payer/authorization-requests"

headers = {
    "X-Account-Id": "<x-account-id>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

{
  "items": [
    {
      "authorizationRequestId": "SC12345678202608276bca619e690",
      "expiresAt": "2026-09-26T19:18:38Z",
      "journey": "JOURNEY_2",
      "receivedAt": "2026-08-27T19:18:38Z",
      "recurrenceId": "RR12345678202608276bca619e690",
      "status": "RECEIVED"
    }
  ],
  "next_cursor": null,
  "prev_cursor": null
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

{
  "code": "PIX-0004",
  "message": "Invalid or expired authentication credentials.",
  "title": "Unauthorized"
}

{
  "code": "PIX-0005",
  "message": "You do not have permission to perform this operation.",
  "title": "Forbidden"
}

{
  "code": "PIX-0000",
  "message": "The server encountered an unexpected error. Please try again later.",
  "title": "Internal Server Error"
}

{
  "code": "PIX-0142",
  "message": "claim_id is required",
  "title": "Invalid Claim Request",
  "fields": {},
  "headers": {},
  "paths": {},
  "query_params": {},
  "raw": {
    "message": "upstream provider returned 503",
    "status": 123
  }
}

Autorizações

Authorization

string

header

obrigatório

JWT bearer token issued by the identity provider.

Cabeçalhos

X-Account-Id

string<uuid>

obrigatório

Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary.

Pattern: ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$

Parâmetros de consulta

limit

integer<int64>

padrão:10

Maximum number of records per page (1-100, default 10). A value outside that range, or one that is not an integer, is REFUSED — never clamped, never silently coerced.

Intervalo obrigatório: 1 <= x <= 100

cursor

string

Opaque cursor taken from a previous page's next_cursor. On the last page that value is null, never an empty string. A malformed or undecodable value is refused with 400. The cursor must be replayed against the same endpoint, with the same sort_order and the same filters used to obtain it; changing any of those starts a different query, and the previous cursor should not be reused.

Exemplo:

"eyJ0IjoiMjAyNi0wOC0yN1QxODo0MjowMFoiLCJpIjoiMDE5OGYzYTEtN2M0Mi03ZGUxLWEwMjQtYjFmMGI3ZTljMzAxIn0="

sort_order

enum<string>

padrão:desc

Sort direction. An unrecognised value is refused rather than silently defaulted, because switching it mid-traversal without notice would silently reverse the page sequence the caller is walking.

Opções disponíveis:

asc,

desc

Exemplo:

"desc"

Resposta

A page of pending authorization requests.

items

object[]

obrigatório

Empty array when there are no results — never null.

Show child attributes

next_cursor

string | null

obrigatório

Opaque cursor for the next page. NULL on the last page, never an empty string.

Exemplo:

"eyJ0IjoiMjAyNi0wOC0yN1QxODo0MjowMFoiLCJpIjoiMDE5OGYzYTEtN2M0Mi03ZGUxLWEwMjQtYjFmMGI3ZTljMzAxIn0="

prev_cursor

string | null

obrigatório

Opaque cursor for the previous page. These listings do not issue a backwards cursor, so the value is null.

DICT e chaves Pix

Cobranças e BR Codes

Pagamentos e devoluções

API de Pix Automático

Tratamento de erros

List authorization requests pending the payer's decision

Autorizações

Cabeçalhos

Parâmetros de consulta

Resposta