Accept or reject an authorization request

Records the payer’s decision. Confirmation and the granting of the authorization and the permission are a single command — there is no second confirmation step.

On acceptance the caller may set the payer parameters in the same call; omitted parameters take the normative defaults of Guia v1.2 §6 (notifications enabled, credit line enabled, no maximum amount).

On rejection, rejectionReason is mandatory and limited to the two motives the Guia admits. A rejection is NOT answered by the receiving PSP — the flow closes without a response (Guia v1.2 §3.2), so no acknowledgement should be awaited. On the QR Code journeys (2, 3 and 4) a rejection is recorded but not communicated to the counterparty at all: the BACEN defines no rejection message for them (Manual de Padrões para Iniciação do Pix v2.9.0 §3.1).

POST /payer/authorization-requests/{authorization_request_id}/decide

cURL

accept

curl --request POST \
  --url https://api.example.com/pixauto/v1/payer/authorization-requests/{authorization_request_id}/decide \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Account-Id: <x-account-id>' \
  --header 'X-Idempotency: <x-idempotency>' \
  --data '
{
  "decision": "ACCEPT",
  "parameters": {
    "creditLineEnabled": false,
    "maximumAmount": {
      "amount": "250.00",
      "currency": "BRL"
    },
    "schedulingNotificationsEnabled": true
  }
}
'

202

accepted

{
  "authorizationId": "01a044a8-f3bd-7488-a0dc-e8d4be4802be",
  "authorizationRequestId": "SC12345678202608276bca619e690",
  "status": "ACCEPTED"
}

Autorizações

Authorization · string · header · obrigatório

JWT bearer token issued by the identity provider.

Cabeçalhos

X-Account-Id · string<uuid> · obrigatório

Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary.

Pattern: ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$

X-Idempotency · string · obrigatório

REQUIRED. Client-supplied replay key, at most 64 bytes. A request without it is refused with PIX-0030 @ 400 before the handler runs. An identical resend within 1 hour returns the original response, status included, with X-Idempotency-Replayed: true. Reusing the key with a divergent method, URL or body is PIX-0031 @ 412. X-Account-Id is part of the compared request too, so replaying one account's key under another account is divergent rather than a replay.

Required string length: 1 - 64

Parâmetros de caminho

authorization_request_id · string · obrigatório

Payer-side authorization request identifier. On journey 1 this is the counterparty-issued BACEN idSolicRec; on journeys 2–4 it is a local deterministic identifier. Always use the exact value returned by this API when calling this operation, and never forward a QR-journey value as a BACEN idSolicRec. A request or mandate under a different X-Account-Id is answered 404, not 403, so the caller cannot confirm that a resource exists elsewhere.

Exemplo:

"SC12345678202608276bca619e690"

Corpo

application/json

The payer's decision, with the parameters to apply when it is an acceptance.

decision · enum<string> · obrigatório

The payer's answer to the request.

Opções disponíveis: ACCEPT, REJECT

Exemplo:

"ACCEPT"

parameters · object

The three payer-configurable parameters (Guia v1.2 §6). Accepted only on ACCEPT; an omitted parameter takes its normative default.

Show child attributes

rejectionReason · enum<string>

Required on REJECT and forbidden on ACCEPT. NotRecognizedByDebtor: the payer does not recognize the receiver. RejectedByDebtor: the payer has no interest in paying that receiver's charges by Pix Automático.

Opções disponíveis: NotRecognizedByDebtor, RejectedByDebtor

Exemplo:

"RejectedByDebtor"

Resposta

202

application/json

Decision accepted and recorded. ACCEPT creates an authorization and returns authorizationId; REJECT closes the request without one. Communication to the counterparty (pain.012), when one is owed, is asynchronous and is not completed by this response.

authorizationRequestId · string · obrigatório

Payer-side request identifier that was decided. It is a BACEN idSolicRec only on journey 1; QR journeys use a local identifier that must not be forwarded to the counterparty.

Exemplo:

"SC12345678202608276bca619e690"

status · enum<string> · obrigatório

The status the request reached.

Opções disponíveis: ACCEPTED, REJECTED

Exemplo:

"ACCEPTED"

authorizationId · string

The mandate that was granted. Absent on a rejection, which grants none.

Exemplo:

"01a044a8-f3bd-7488-a0dc-e8d4be4802be"