--- title: "Create a Bank Authorisation" method: POST path: "/bank_authorisations" tags: ["Bank Authorisation"] --- # Create a Bank Authorisation `POST /bank_authorisations` ## Request - Base URL: `https://api.gocardless.com` - URL: `https://api.gocardless.com/bank_authorisations` - Auth: HTTP bearer Create a Bank Authorisation.

Restricted: this endpoint is restricted as the authorisation must be used within a checkout flow that meets regulatory requirements for each payment scheme. Integrators should use a Billing Request Flow to do this.

If you would like to enable bank authorisations, you will need to go through a separate compliance process. For more details please get in touch.

## Headers - `GoCardless-Version` string, required ## Request body - object - `bank_authorisations` object - `redirect_uri` string: URL that the payer can be redirected to after authorising the payment. On completion of bank authorisation, the query parameter of either `outcome=success` or `outcome=failure` will be appended to the `redirect_uri` to indicate the result of the bank authorisation. If the bank authorisation is expired, the query parameter `outcome=timeout` will be appended to the `redirect_uri`, in which case you should prompt the user to try the bank authorisation step again. Please note: bank authorisations can still fail despite an `outcome=success` on the `redirect_uri`. It is therefore recommended to wait for the relevant bank authorisation event, such as [`BANK_AUTHORISATION_AUTHORISED`](https://docs.gocardless.com/docs/api-reference/events/billing-request), [`BANK_AUTHORISATION_DENIED`](https://docs.gocardless.com/docs/api-reference/events/billing-request), or [`BANK_AUTHORISATION_FAILED`](https://docs.gocardless.com/docs/api-reference/events/billing-request) in order to show the correct outcome to the user. The BillingRequestFlow ID will also be appended to the `redirect_uri` as query parameter `id=BRF123`. Defaults to `https://pay.gocardless.com/billing/static/thankyou`. - `links` object, required - `billing_request` string: ID of the [billing request](https://docs.gocardless.com/docs/api-reference/billing-request) against which this authorisation was created. ## Response `201` Resource created successfully - BankAuthorisationSingleResourceResponse - `bank_authorisations` BankAuthorisation: Bank Authorisations can be used to authorise Billing Requests. Authorisations are created against a specific bank, usually the bank that provides the payer's account. Creation of Bank Authorisations is only permitted from GoCardless hosted UIs (see Billing Request Flows) to ensure we meet regulatory requirements for checkout flows. - `id` string, required: Unique identifier, beginning with "BAU". - `redirect_uri` string: URL that the payer can be redirected to after authorising the payment. On completion of bank authorisation, the query parameter of either `outcome=success` or `outcome=failure` will be appended to the `redirect_uri` to indicate the result of the bank authorisation. If the bank authorisation is expired, the query parameter `outcome=timeout` will be appended to the `redirect_uri`, in which case you should prompt the user to try the bank authorisation step again. Please note: bank authorisations can still fail despite an `outcome=success` on the `redirect_uri`. It is therefore recommended to wait for the relevant bank authorisation event, such as [`BANK_AUTHORISATION_AUTHORISED`](https://docs.gocardless.com/docs/api-reference/events/billing-request), [`BANK_AUTHORISATION_DENIED`](https://docs.gocardless.com/docs/api-reference/events/billing-request), or [`BANK_AUTHORISATION_FAILED`](https://docs.gocardless.com/docs/api-reference/events/billing-request) in order to show the correct outcome to the user. The BillingRequestFlow ID will also be appended to the `redirect_uri` as query parameter `id=BRF123`. Defaults to `https://pay.gocardless.com/billing/static/thankyou`. - `url` string, nullable: URL for an oauth flow that will allow the user to authorise the payment - `qr_code_url` string, nullable: URL to a QR code PNG image of the bank authorisation url. This QR code can be used as an alternative to providing the `url` to the payer to allow them to authorise with their mobile devices. - `authorisation_type` 'mandate' | 'payment': Type of authorisation, can be either 'mandate' or 'payment'. - `created_at` string, date-time: Timestamp when the flow was created - `expires_at` string, date-time: Timestamp when the url will expire. Each authorisation url currently lasts for 15 minutes, but this can vary by bank. - `last_visited_at` string, date-time, nullable: Fixed [timestamp](https://docs.gocardless.com/docs/api-reference/data-conventions#dates-and-times), recording when the authorisation URL has been visited. - `authorised_at` string, date-time, nullable: Fixed [timestamp](https://docs.gocardless.com/docs/api-reference/data-conventions#dates-and-times), recording when the user has been authorised. - `links` BankAuthorisationLinks - `billing_request` string: ID of the [billing request](https://docs.gocardless.com/docs/api-reference/billing-request) against which this authorisation was created. - `institution` string: ID of the [institution](https://docs.gocardless.com/docs/api-reference/institution) against which this authorisation was created. ## Other responses - `400`: Bad Request - `401`: Unauthorised - `404`: Not found - `422`: Validation Error - `500`: Internal Error --- [API](https://skmtc.dev/gocardless/apis/gocardless-api.md) - [All operations](https://skmtc.dev/gocardless/apis/gocardless-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gocardless/apis/gocardless-api/revisions/4dd3dae45364?raw)