Skip to navigation
API Internet BankingPeople

Invalidate a person's transaction PIN

Does not delete the row. Sets a hard lock (423 pin_locked on cashout) and keeps the person enrolled, so POST /v1/people/pin/reset-request still works. Does not ask for the current PIN. Hosted reset does not block this call.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Headers

X-Tenant-IdstringRequired
Tenant context used for authorization and routing.
X-Acting-DocumentstringRequired
CPF of the person, 11 digits.
Idempotency-KeystringOptional

Optional client-generated idempotency token (recommended for safe retries).

X-Request-TimestampstringRequired

Unix seconds. Required on the signed host; tolerance is 300s either way (403 request_timestamp_skew).

X-Content-SHA256stringRequired

Lowercase hex SHA-256 of the body. An empty body hashes the empty string, so the header is always present. Mismatch returns 400 body_hash_mismatch.

X-Request-SignaturestringRequired

Detached JWS (<protected>..<signature>, ES256 or PS256) over METHOD\nPATH?QUERY\nTIMESTAMP\nIDEMPOTENCY_KEY_OR_EMPTY\nX_CONTENT_SHA256.

Response

PIN invalidated.
documentstringOptional
statusstringOptional

Errors

404
Not Found Error