---
title: "Create a mandate"
method: POST
path: "/payments/mandates"
tags: ["Mandates"]
---

# Create a mandate

`POST /payments/mandates`

Create a mandate.

Supports both user and business accounts. Provide `user_id` for user flows or `business_id` for business flows — exactly one must be specified.

## Headers

- `idempotency-key` string, uuid, required

## Request body

- object
  - `user_id` string, uuid — User unique identifier.
  - `business_id` string, uuid — Unique identifier for the business.
  - `iban` string, required — International Bank Account Number [IBAN](https://en.wikipedia.org/wiki/International_Bank_Account_Number).
  - `bic` string, required — Business Identifier Code (also known as SWIFT-BIC, BIC, SWIFT ID or SWIFT code) [ISO 9362](https://en.wikipedia.org/wiki/ISO_9362).
  - `confirmed_at` string, date-time, required — Timestamp of when user validated the mandate

## Response `200`

Mandate

- object
  - `id` string, uuid, required — Direct Debit Mandate unique identifier.
  - `created_at` string, date-time, required — Date and time when the resource was created. [RFC 3339-5](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6), [ISO8601 UTC](https://www.iso.org/iso-8601-date-and-time-format.html)
  - `user_id` string, uuid — User unique identifier.
  - `business_id` string, uuid — Unique identifier for the business.
  - `iban` string, required — Obfuscated International Bank Account Number [IBAN](https://en.wikipedia.org/wiki/International_Bank_Account_Number).
  - `bic` string, required — Business Identifier Code (also known as SWIFT-BIC, BIC, SWIFT ID or SWIFT code) [ISO 9362](https://en.wikipedia.org/wiki/ISO_9362).
  - `creditor_name` string, required — Name of the creditor on the mandate.
  - `creditor_id` string, required — Banking identifier of the creditor.
  - `creditor_address` object, required — Address. Must not be a P.O. box or c/o address.
    - `address_line1` string, required — First address line of the address.
    - `address_line2` string — Second address line of the address.
    - `postcode` string, required — Postal code (postcode, PIN or ZIP code)
    - `country` 'AD' | 'AE' | 'AF' | 'AG' | 'AI' | 'AL' | 'AM' | 'AO' | 'AQ' | 'AR' | 'AS' | 'AT' | 'AU' | 'AW' | 'AX' | 'AZ' | 'BA' | 'BB' | 'BD' | 'BE' | 'BF' | 'BG' | 'BH' | 'BI' | 'BJ' | 'BL' | 'BM' | 'BN' | 'BO' | 'BQ' | 'BR' | 'BS' | 'BT' | 'BV' | 'BW' | 'BY' | 'BZ' | 'CA' | 'CC' | 'CD' | 'CF' | 'CG' | 'CH' | 'CI' | 'CK' | 'CL' | 'CM' | 'CN' | 'CO' | 'CR' | 'CU' | 'CV' | 'CW' | 'CX' | 'CY' | 'CZ' | 'DE' | 'DJ' | 'DK' | 'DM' | 'DO' | 'DZ' | 'EC' | 'EE' | 'EG' | 'EH' | 'ER' | 'ES' | 'ET' | 'FI' | 'FJ' | 'FK' | 'FM' | 'FO' | 'FR' | 'GA' | 'GB' | 'GD' | 'GE' | 'GF' | 'GG' | 'GH' | 'GI' | 'GL' | 'GM' | 'GN' | 'GP' | 'GQ' | 'GR' | 'GS' | 'GT' | 'GU' | 'GW' | 'GY' | 'HK' | 'HM' | 'HN' | 'HR' | 'HT' | 'HU' | 'ID' | 'IE' | 'IL' | 'IM' | 'IN' | 'IO' | 'IQ' | 'IR' | 'IS' | 'IT' | 'JE' | 'JM' | 'JO' | 'JP' | 'KE' | 'KG' | 'KH' | 'KI' | 'KM' | 'KN' | 'KP' | 'KR' | 'KW' | 'KY' | 'KZ' | 'LA' | 'LB' | 'LC' | 'LI' | 'LK' | 'LR' | 'LS' | 'LT' | 'LU' | 'LV' | 'LY' | 'MA' | 'MC' | 'MD' | 'ME' | 'MF' | 'MG' | 'MH' | 'MK' | 'ML' | 'MM' | 'MN' | 'MO' | 'MP' | 'MQ' | 'MR' | 'MS' | 'MT' | 'MU' | 'MV' | 'MW' | 'MX' | 'MY' | 'MZ' | 'NA' | 'NC' | 'NE' | 'NF' | 'NG' | 'NI' | 'NL' | 'NO' | 'NP' | 'NR' | 'NU' | 'NZ' | 'OM' | 'PA' | 'PE' | 'PF' | 'PG' | 'PH' | 'PK' | 'PL' | 'PM' | 'PN' | 'PR' | 'PS' | 'PT' | 'PW' | 'PY' | 'QA' | 'RE' | 'RO' | 'RS' | 'RU' | 'RW' | 'SA' | 'SB' | 'SC' | 'SD' | 'SE' | 'SG' | 'SH' | 'SI' | 'SJ' | 'SK' | 'SL' | 'SM' | 'SN' | 'SO' | 'SR' | 'SS' | 'ST' | 'SV' | 'SX' | 'SY' | 'SZ' | 'TC' | 'TD' | 'TF' | 'TG' | 'TH' | 'TJ' | 'TK' | 'TL' | 'TM' | 'TN' | 'TO' | 'TR' | 'TT' | 'TV' | 'TW' | 'TZ' | 'UA' | 'UG' | 'UM' | 'US' | 'UY' | 'UZ' | 'VA' | 'VC' | 'VE' | 'VG' | 'VI' | 'VN' | 'VU' | 'WF' | 'WS' | 'XK' | 'YE' | 'YT' | 'ZA' | 'ZM' | 'ZW', required — Accepted country code. [ISO 3166-1 alpha-2 codes](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2).
    - `state` string — State, province, county. [ISO 3166 alpha-2 Codes](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2).
    - `city` string, required
  - `type` 'RECURRENT', required — Type of mandate. * RECURRENT -
  - `confirmed_at` string, date-time, required — Timestamp of when user validated the mandate

## Other responses

- `400` — Bad Request. The incoming request had a malformed parameter/object.
- `401` — Unauthorized. The caller has not been authenticated.
- `403` — Forbidden. The caller has been authenticated but is not allowed to take the requested action.
- `404` — Not Found. The requested resource could not be found.
- `406` — Not Acceptable. The resource does not have a current representation that would be acceptable to the user agent. "Accept" header defined unsupported value.
- `429` — Too Many Requests. The caller has exceeded their quota for the time period and has been throttled.
- `500` — Internal Server Error. The service encountered an unexpected error.
- `503` — Service Unavailable. The service handling for this request cannot be reached at this time.
- `504` — Gateway Timeout. The service gateway has reached its internal timeout.

---

[API](https://skmtc.net/upvest/apis/upvest-investment-api.md) · [All operations](https://skmtc.net/upvest/apis/upvest-investment-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/upvest/upvest-investment-api/versions/eb94c0091916/schema)