---
title: "Create Payment Instrument Mandate"
method: POST
path: "/accounts/{account_id}/payment_instrument_mandates"
tags: ["Payment Instrument Mandates"]
---

# Create Payment Instrument Mandate

`POST /accounts/{account_id}/payment_instrument_mandates`

## Request

- Base URL: `https://sandbox.api.lemon.markets/v1`
- URL: `https://sandbox.api.lemon.markets/v1/accounts/{account_id}/payment_instrument_mandates`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api/docs/accounts/:account_id/payment_instrument_mandates/post.ts> (a function with typed inputs; its response is checked against the schema)

<strong>Preview:</strong> This endpoint is a preview API and may change without a deprecation period.

Creates a SEPA Direct Debit mandate for the customer's bank account (the debtor account).  The mandate is returned with status <code>created</code> and cannot be used for collections until it is confirmed via <code>POST /accounts/{account_id}/payment_instrument_mandates/{payment_instrument_mandate_id}/confirm</code>.

lemon.markets assigns the <code>mandate_reference</code> and the <code>creditor</code> data.  Before confirmation, present the mandate to the customer together with the creditor and debtor data.

While the mandate is <code>created</code>, the response contains <code>sca</code>.  When <code>sca.required</code> is <code>true</code>, the customer must sign <code>sca.challenge</code> with a registered authenticator and the signature must be sent when confirming the mandate.

A customer account can have at most one <code>confirmed</code> mandate per debtor bank account.

An event with type <code>payment_instrument_mandate.created</code> will be created.

## Path parameters

- `account_id` string, required

## Headers

- `LMG-Data-Privacy-Access-Principal` string, required
- `LMG-Data-Privacy-Access-Justification` string, required
- `Idempotency-Key` string

## Request body

- CreatePaymentInstrumentMandateRequest
  - `type` 'sepa_direct_debit', required: The payment method of the mandate. Only <code>sepa_direct_debit</code> is supported.
  - `debtor` PaymentInstrumentMandateDebtorRequest, required: The customer's bank account that the mandate authorizes collections from.
    - `iban` string, required: The IBAN of the debtor account. It must be a SEPA IBAN.
    - `bic` string, required: The BIC of the debtor account.
    - `account_holder_name` string, required: The name of the account holder, in the SEPA Latin character set.

## Response `201`

Successful Response

- PaymentInstrumentMandateResponse: The customer's authorization to collect SEPA Direct Debits from one bank account. A mandate cannot be used for collections until it is confirmed.
  - `id` string, required: An identifier for the payment instrument mandate.
  - `type` 'sepa_direct_debit', required: A category representing the payment method of a payment instrument mandate: <ul> <li><code>sepa_direct_debit</code>: A SEPA Direct Debit (Core) mandate for recurrent collections. </ul>
  - `mandate_reference` string, required: The unique mandate reference, assigned by lemon.markets.
  - `debtor` PaymentInstrumentMandateDebtorResponse, required: The customer's bank account that the mandate authorizes collections from.
    - `iban` string, required
    - `bic` string: Omitted when not available.
    - `account_holder_name` string, required
  - `creditor` PaymentInstrumentMandateCreditorResponse, required: lemon.markets as the collecting party, as it must be presented to the customer.
    - `identifier` string, required: The SEPA Creditor Identifier.
    - `name` string, required
    - `address` PaymentInstrumentMandateCreditorAddressResponse, required
      - `line_1` string, required
      - `line_2` string: Omitted when not available.
      - `postal_code` string, required
      - `city` string, required
      - `country` string, required: An ISO 3166-1 alpha-2 country code.
  - `sca` PaymentInstrumentMandateScaResponse: The Strong Customer Authentication configuration of the mandate. Only present while the mandate has status <code>created</code>.
    - `required` boolean, required: Whether confirming the mandate requires a signed challenge.
    - `challenge` string: The challenge the customer signs with a registered authenticator. Only present when <code>required</code> is <code>true</code>.
  - `history` StatusChangePaymentInstrumentMandateStatus[], required: The status changes of the mandate, newest first. The current status is the first entry.
    - `status` 'canceled' | 'confirmed' | 'created' | 'rejected', required: A category representing the status of a payment instrument mandate: <ul> <li><code>canceled</code>: The mandate was canceled by the customer and can no longer be used. <li><code>confirmed</code>: The mandate was confirmed and can be used for collections. <li><code>created</code>: The mandate was created and awaits confirmation. <li><code>rejected</code>: lemon.markets decided that the mandate cannot be confirmed or can no longer be used. </ul>
    - `timestamp` string, date-time, required: The timestamp of the event. It represents the point in time at which the payment instrument mandate was updated.

## Other responses

- `400`: Bad Request. Returned when the idempotency key was already used with a different request payload or endpoint, or exceeds the maximum length.
- `401`: Unauthorized
- `404`: Not Found
- `422`: Unprocessable Entity. Returned when the debtor account cannot be used for this mandate, when a confirmed mandate already authorizes the same debtor account, or when mandate creation is disabled for this customer account.
- `5XX`: Server Error

## Changes

- **2026-11-03** `1f1df208c0e4`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api/changes/accounts/:account_id/payment_instrument_mandates/post.md)

---

[API](https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api.md) - [All operations](https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api/revisions/1f1df208c0e4?raw)