Skip to main content
GET
Get a mandate

Authorizations

Authorization
string
header
required

A JWT signed using your CDP API Key Secret, encoded in base64. Refer to the Generate Bearer Token section of our Authentication docs for information on how to generate your Bearer Token.

Path Parameters

mandateId
string
required

The unique identifier of the mandate. The ID of the mandate, a UUID prefixed by mandate_.

Pattern: ^mandate_[a-f0-9\-]{36}$
Example:

"mandate_82c879c1-84e1-44ed-a8c2-1ac239cf09ad"

Response

Successfully retrieved mandate.

A durable, revocable standing authorization to debit a funding source without the customer present each time, within its policy caps. Payment sessions draw against it by referencing its mandateId.

source is set once an approval succeeds. status reflects the most recent action; the approvedAt, canceledAt, and revokedAt timestamps are the durable record of what has happened. Ending one mandate does not affect other mandates on the same source.

mandateId
string
required

The unique identifier of the mandate.

Pattern: ^mandate_[a-f0-9\-]{36}$
Example:

"mandate_82c879c1-84e1-44ed-a8c2-1ac239cf09ad"

asset
string
required

The unit of account the mandate's policy caps are denominated in (e.g., 500 means 500 of this asset). Fixed at creation. This is only the denomination for the limits; the funding source may hold a different asset (for example, limits in usdc against a usdt source). Each authorization's amount is converted into this asset at authorization time to evaluate the caps, so the caps are always enforced in a single denomination.

Required string length: 1 - 42
Example:

"usdc"

policy
Mandate Policy · object
required

Debit caps. Always present. If you omitted policy at create, this is a Coinbase-configured monthly max.

Example:
status
enum<string>
required

The current status of the mandate.

Available options:
created,
approval_pending,
approval_succeeded,
approval_failed,
revocation_pending,
revocation_succeeded,
revocation_failed,
canceled
Example:

"approval_succeeded"

createdAt
string<date-time>
required

The UTC ISO 8601 timestamp at which the mandate was created.

Example:

"2025-06-15T12:00:00.000Z"

updatedAt
string<date-time>
required

The UTC ISO 8601 timestamp at which the mandate was last updated.

Example:

"2025-06-15T12:00:00.000Z"

source
Mandate Source Wallet · object

The funding source the mandate draws against. Set when an approval succeeds. Not present before the mandate is approval_succeeded.

Example:
expiresAt
string<date-time>

The UTC ISO 8601 timestamp after which the mandate can no longer be authorized against. Authorization attempts after this time return 422; status does not change. Omit for no expiry.

Example:

"2027-06-15T12:00:00.000Z"

url
string<uri>

Hosted page where the customer approves this mandate. Present only before the mandate reaches approval_succeeded; complemented by revocationUrl afterward.

Required string length: 11 - 2048
Pattern: ^https?://.*$
Example:

"https://payments.coinbase.com/mandates/mandate_82c879c1-84e1-44ed-a8c2-1ac239cf09ad"

revocationUrl
string<uri>

Hosted page where the customer can remove their spending allowance for this mandate. Present once the mandate has a source (from approval_succeeded onward); absent before approval, when there is nothing to revoke.

Required string length: 11 - 2048
Pattern: ^https?://.*$
Example:

"https://payments.coinbase.com/mandates/mandate_82c879c1-84e1-44ed-a8c2-1ac239cf09ad/revoke"

approvalRedirect
object

Optional merchant URLs used by the hosted mandate approval flow. The approval page redirects to successUrl when approval succeeds, or failureUrl when it fails. When omitted, the approval page keeps the customer on the Coinbase-hosted experience.

Example:
revocationRedirect
object

Optional merchant URLs used by the hosted mandate revocation flow. The revocation page redirects to successUrl when revocation succeeds, or failureUrl when it fails. When omitted, the revocation page keeps the customer on the Coinbase-hosted experience.

Example:
customerDisplay
Mandate Customer Display · object

Merchant-provided display data shown to the customer on the hosted mandate pages. All fields are informational only. They are stored and returned as-is and do not affect mandate approval, authorization, or policy enforcement.

Example:
approvedAt
string<date-time>

The UTC ISO 8601 timestamp at which an approval succeeded and the mandate became usable. Present only once the mandate has been approved; set once, on the successful approval, and unchanged by later transitions. Its presence is the durable signal that the mandate was approved, independent of status.

Example:

"2026-08-21T13:55:00.000Z"

canceledAt
string<date-time>

The UTC ISO 8601 timestamp at which the merchant canceled the mandate off-chain. Present only once the mandate has been canceled. Canceling does not touch the on-chain spending allowance; check revokedAt for that.

Example:

"2026-08-21T14:02:00.000Z"

revokedAt
string<date-time>

The UTC ISO 8601 timestamp at which the spending allowance was removed on-chain by a wallet revocation. Present only once that has happened. Its presence is the single signal that the allowance is gone, independent of status (for example, it can be set on a canceled mandate whose allowance was later cleaned up).

Example:

"2026-08-21T14:12:00.000Z"

metadata
object

Optional metadata as key-value pairs. Use this to store additional structured information on a resource, such as customer IDs, order references, or any application-specific data. Up to 10 key/value pairs may be provided. Keys and values are both strings. Keys must be ≤ 40 characters; values must be ≤ 500 characters.

Example: