> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # List authorization requests pending the payer's decision > Returns the requests still awaiting the payer's decision, newest first — the "consulta e gerenciamento de autorizações pendentes" of Guia v1.2 §6.4. A request LEAVES this list when it is accepted, rejected, cancelled by the receiving PSP (pain.011) or expires: §3.2 requires the payer PSP to remove it in the last two cases. There is deliberately no status parameter to widen the surface with. Each item carries identifiers, journey, status and deadlines and, under `recurrence`, the recurrence terms the payer decides on: the receiver (name and CPF/CNPJ), periodicity, start and end dates, the fixed `amount` or the receiver's `minimumAmount` floor (neither on a variable-amount recurrence without a floor), the retry policy, the contract description and the `snapshotVersion`. The terms are the CURRENT snapshot this institution holds for the recurrence. Paging is by cursor. On the last page next_cursor is null, never an empty string. ## OpenAPI ````yaml /pt/openapi/v3-current/pix-lerian-pixauto.yaml get /payer/authorization-requests openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: >- Pix Automático payer-facing API — deciding an authorization request raised by the receiving end, managing the payer-configurable parameters of a granted mandate, and revoking it (Guia de Implementação do Pix Automático v1.2 §3 and §6). ## Trust boundary This API is **machine-to-machine**. The caller is the client PSP's backend, authenticated with an application token; the token names that application and never one of its customers. The account therefore has to arrive in the request, and it does so in one of two shapes: most routes take it in the **`X-Account-Id`** header, the same header SPI, DICT and COB use for the same job, and the route that CREATES the resource the account belongs to takes `payerAccountId` in the body — `POST /v1/payer/authorization-requests/from-qr`, which opens a pending request for a mandate that does not exist yet. On that route, the account is part of what is being created rather than a scope on an existing resource, and a header beside the body field would be a second source for one value. Either way the value is the caller's **declaration** of which of its own customers it is acting for. **It is not proof that the end user controls that account, and this API cannot make it one.** Authenticating the payer and authorising its own customers against one another is the calling PSP's responsibility. What this end enforces is consistency: an absent header is 400 (PIX-0001) and a malformed account is 400 (PIX-0017 on the header, PIX-0003 in the body), and a resource that exists under a different account than the one named is **404**, not 403: the account is a predicate on the lookup, so this end never learns the resource exists elsewhere and cannot confirm it. Within one lookup, absence and a resource outside the selection get the same answer. license: name: Lerian Studio General License title: Pix Lerian — Pix Automático version: 1.2.0 servers: - url: https://api.example.com/pixauto/v1 description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Authorization requests raised by the receiving end and answered by the payer. A request is answered once. name: Payer Authorization Requests - description: Granted mandates. An authorization is managed for as long as it lives. name: Payer Authorizations - description: >- The payer's forward view of upcoming debits, the cancellation of one of them, and the release of a debit whose settlement attempt never got an outcome. Cancelling a debit leaves the authorization ACTIVE — it stops one charge, not the mandate. The operations are meant to be used together: the listing is the only place a client receives the scheduled_payment_id the others address. name: Payer Scheduled Payments paths: /payer/authorization-requests: get: tags: - Payer Authorization Requests summary: List authorization requests pending the payer's decision description: >- Returns the requests still awaiting the payer's decision, newest first — the "consulta e gerenciamento de autorizações pendentes" of Guia v1.2 §6.4. A request LEAVES this list when it is accepted, rejected, cancelled by the receiving PSP (pain.011) or expires: §3.2 requires the payer PSP to remove it in the last two cases. There is deliberately no status parameter to widen the surface with. Each item carries identifiers, journey, status and deadlines and, under `recurrence`, the recurrence terms the payer decides on: the receiver (name and CPF/CNPJ), periodicity, start and end dates, the fixed `amount` or the receiver's `minimumAmount` floor (neither on a variable-amount recurrence without a floor), the retry policy, the contract description and the `snapshotVersion`. The terms are the CURRENT snapshot this institution holds for the recurrence. Paging is by cursor. On the last page next_cursor is null, never an empty string. operationId: listPayerAuthorizationRequests parameters: - description: >- Non-zero UUID of the payer account selected by the calling PSP. The PSP must authorize its end user for that account before calling this API. A resource outside the selected account returns 404; a read with no records returns an empty page. See the API overview for the complete trust boundary. example: 0198f3a2-1c4e-7c8b-9d1e-2f3a4b5c6d7e in: header name: X-Account-Id required: true schema: format: uuid not: const: 00000000-0000-0000-0000-000000000000 pattern: >- ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ type: string - description: >- Maximum number of records per page (1-100, default 10). A value outside that range, or one that is not an integer, is REFUSED — never clamped, never silently coerced. example: 25 explode: false in: query name: limit schema: default: 10 format: int64 maximum: 100 minimum: 1 type: integer - description: >- Opaque cursor taken from a previous page's next_cursor. On the last page that value is null, never an empty string. A malformed or undecodable value is refused with 400. The cursor must be replayed against the same endpoint, with the same sort_order and the same filters used to obtain it; changing any of those starts a different query, and the previous cursor should not be reused. explode: false in: query name: cursor schema: description: >- Opaque cursor taken from a previous page's next_cursor. On the last page that value is null, never an empty string. A malformed or undecodable value is refused with 400. The cursor must be replayed against the same endpoint, with the same sort_order and the same filters used to obtain it; changing any of those starts a different query, and the previous cursor should not be reused. examples: - >- eyJ0IjoiMjAyNi0wOC0yN1QxODo0MjowMFoiLCJpIjoiMDE5OGYzYTEtN2M0Mi03ZGUxLWEwMjQtYjFmMGI3ZTljMzAxIn0= type: string - description: >- Sort direction. An unrecognised value is refused rather than silently defaulted, because switching it mid-traversal without notice would silently reverse the page sequence the caller is walking. explode: false in: query name: sort_order schema: default: desc description: >- Sort direction. An unrecognised value is refused rather than silently defaulted, because switching it mid-traversal without notice would silently reverse the page sequence the caller is walking. enum: - asc - desc examples: - desc type: string responses: '200': content: application/json: example: items: - authorizationRequestId: SC12345678202608276bca619e690 expiresAt: '2026-09-26T19:18:38Z' journey: JOURNEY_2 receivedAt: '2026-08-27T19:18:38Z' recurrence: amount: amount: '89.90' currency: BRL contractDescription: Mensalidade do plano de academia endDate: '2027-08-10' periodicity: MONTHLY receiver: name: Academia Corpo em Movimento Ltda taxId: type: CNPJ value: '11222333000181' retryPolicy: ACCEPT_3R_7D snapshotVersion: 1 startDate: '2026-09-10' recurrenceId: RR12345678202608276bca619e690 status: RECEIVED next_cursor: null prev_cursor: null schema: $ref: '#/components/schemas/AuthorizationRequestPage' description: A page of pending authorization requests. '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Malformed or invalid path, header or query input (PIX-0001, PIX-0003, PIX-0015, PIX-0017, PIX-0020, plus operation-specific PIX codes). '401': content: application/json: example: code: PIX-0010 message: The request could not be processed due to a client-side error. title: Client Error schema: $ref: '#/components/schemas/Error' description: >- The credentials were refused before the handler ran: absent, invalid or expired. Branch on the 401 status, not the body code, which depends on the refusing layer: the authorization middleware answers the generic client-error code PIX-0010; in multi-tenant deployments the tenant layer may answer a missing, malformed or tenantless token with its own {code,title,message} body, under codes such as MISSING_TOKEN, INVALID_TENANT or UNAUTHORIZED. '403': content: application/json: example: code: PIX-0010 message: The request could not be processed due to a client-side error. title: Client Error schema: $ref: '#/components/schemas/Error' description: >- The caller was refused before the handler ran. Branch on the 403 status, not the body code, which depends on the refusing layer: the authorization middleware answers the generic client-error code PIX-0010 when the caller is not entitled to this resource and action; in multi-tenant deployments the tenant layer may answer with its own {code,title,message} body, such as code 0131 (Service Suspended or Access Denied) when the tenant's access to this service is suspended, purged or denied. '500': content: application/json: example: code: PIX-0000 message: >- The server encountered an unexpected error. Please try again later. title: Internal Server Error schema: $ref: '#/components/schemas/Error' description: >- Unexpected internal failure (PIX-0000). Details never travel in the envelope. default: content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Any other error returned by the handler uses the same PIX error envelope. The HTTP status and code identify the concrete failure. In multi-tenant deployments the tenant layer can also refuse before the handler runs -- for example 404 TENANT_NOT_FOUND or 503 SERVICE_UNAVAILABLE -- with its own {code,title,message} body; branch on the HTTP status. components: schemas: AuthorizationRequestPage: additionalProperties: false properties: items: description: Empty array when there are no results — never null. items: $ref: '#/components/schemas/AuthorizationRequestItem' type: array next_cursor: description: >- Opaque cursor for the next page. NULL on the last page, never an empty string. examples: - >- eyJ0IjoiMjAyNi0wOC0yN1QxODo0MjowMFoiLCJpIjoiMDE5OGYzYTEtN2M0Mi03ZGUxLWEwMjQtYjFmMGI3ZTljMzAxIn0= type: - string - 'null' prev_cursor: description: >- Opaque cursor for the previous page. These listings do not issue a backwards cursor, so the value is null. type: - string - 'null' required: - items - next_cursor - prev_cursor type: object Error: additionalProperties: false properties: code: examples: - PIX-0142 type: string fields: additionalProperties: type: string type: object headers: additionalProperties: type: string type: object message: examples: - claim_id is required type: string paths: additionalProperties: type: string type: object query_params: additionalProperties: type: string type: object raw: $ref: '#/components/schemas/RawError' title: examples: - Invalid Claim Request type: string required: - code - title - message type: object AuthorizationRequestItem: additionalProperties: false properties: authorizationRequestId: description: >- Payer-side request identifier. It is the counterparty idSolicRec on journey 1 and a local identifier on QR journeys; always pass this exact value to the decision route. examples: - SC12345678202608276bca619e690 type: string decidedAt: description: When the payer decided. Absent while the request is still pending. examples: - '2026-08-27T19:20:00Z' format: date-time type: string expiresAt: description: Decision deadline. At most 30 days from creation (Guia v1.2 §3.2). examples: - '2026-09-26T19:18:38Z' format: date-time type: string journey: description: >- Authorization journey that produced the request: JOURNEY_1 for a request the receiving PSP sent through the messaging callback (pain.009), JOURNEY_2 to JOURNEY_4 for one created from a scanned QR Code. examples: - JOURNEY_2 type: string receivedAt: description: When this end received the request. examples: - '2026-08-27T19:18:38Z' format: date-time type: string recurrenceId: description: BACEN idRec of the recurrence the request covers. examples: - RR12345678202608276bca619e690 type: string rejectionReason: description: >- Motive the payer gave when refusing the recurrence. Present only when status is REJECTED. enum: - NotRecognizedByDebtor - RejectedByDebtor examples: - NotRecognizedByDebtor type: string status: description: >- Status the request currently holds -- pending on the listing surface, any lifecycle status on the individual GET. A pending request reads RECEIVED: it is the status this end records when a request reaches it, and the only pending status it writes. examples: - RECEIVED type: string recurrence: $ref: '#/components/schemas/RecurrenceTermsBody' description: >- Terms of the recurrence the request covers: the receiver, periodicity, dates, amount shape and retry policy the payer is deciding on. The CURRENT snapshot this institution holds for the recurrence (see snapshotVersion). required: - authorizationRequestId - recurrenceId - status - expiresAt - receivedAt - recurrence type: object RawError: additionalProperties: false properties: message: examples: - upstream provider returned 503 type: string status: format: int64 type: integer required: - status - message type: object RecurrenceTermsBody: additionalProperties: false properties: amount: $ref: '#/components/schemas/Money' description: >- Fixed amount of every charge. Present only on a fixed-amount recurrence; never present together with minimumAmount. contractDescription: description: >- What is being charged, as the receiver described it. Absent when the receiver gave no description. examples: - Mensalidade do plano de academia type: string endDate: description: >- Final collection date (YYYY-MM-DD). Absent on an open-ended recurrence. examples: - '2027-08-10' format: date type: string minimumAmount: $ref: '#/components/schemas/Money' description: >- Floor the receiver set on a variable-amount recurrence; the payer's maximum amount cannot be set below it. Absent on a fixed-amount recurrence and on a variable-amount one without a floor. periodicity: description: Collection rhythm of the recurrence. enum: - WEEKLY - MONTHLY - QUARTERLY - SEMIANNUAL - ANNUALLY examples: - MONTHLY type: string receiver: $ref: '#/components/schemas/ReceiverBody' description: >- Who is charging: the receiving user as the receiving PSP identified them. retryPolicy: description: >- Post-due retry policy of the recurrence: NOT_ACCEPT admits no retry after the due date; ACCEPT_3R_7D admits up to three retry dates within seven calendar days of the original settlement date. enum: - NOT_ACCEPT - ACCEPT_3R_7D examples: - ACCEPT_3R_7D type: string snapshotVersion: description: >- Version of the recurrence terms this snapshot carries. The terms shown are the CURRENT snapshot this institution holds for the recurrence, not a copy frozen when the request was received or the mandate granted: when the receiving PSP sends newer terms, every request and mandate over the recurrence, a terminated one included, shows them, and this number increases. examples: - 2 format: int64 minimum: 1 type: integer startDate: description: >- First collection date (YYYY-MM-DD, a calendar date with no time zone). examples: - '2026-09-10' format: date type: string required: - receiver - periodicity - startDate - retryPolicy - snapshotVersion type: object Money: additionalProperties: false properties: amount: description: >- Decimal string, positive, with at most two fractional digits and at most thirteen integer digits. A string, not a float — binary floating point cannot represent every centavo exactly, and this is a money path. Trailing zeros are not padded: 150.00 and 150 are the same amount. examples: - '149.95' pattern: ^(0\.([1-9][0-9]?|0[1-9])|[1-9][0-9]{0,12}(\.[0-9]{1,2})?)$ type: string currency: description: Pix settles in BRL only. enum: - BRL examples: - BRL type: string required: - amount - currency type: object ReceiverBody: additionalProperties: false properties: name: description: Name of the receiving user, as the payer is shown it. examples: - Academia Corpo em Movimento Ltda type: string taxId: $ref: '#/components/schemas/TaxIDBody' description: CPF or CNPJ of the receiving user. required: - name - taxId type: object TaxIDBody: additionalProperties: false properties: type: description: Which document value carries. enum: - CPF - CNPJ examples: - CNPJ type: string value: description: 'The document, digits only: 11 for a CPF, 14 for a CNPJ.' examples: - '11222333000181' type: string required: - type - value type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.