Cancel a Mandate

VRP mandates cannot be cancelled directly via the API. To cancel a mandate, you must redirect the customer to Acquired's hosted revocation page, where they can review the mandate details and confirm cancellation. This applies to both Sweeping and Commercial VRP mandates.

The hosted revocation page is part of the Acquired Hosted Checkout product. This has an important consequence for the redirect behaviour, described under Revocation URL below.

Revocation URL

Construct the revocation URL using the mandate ID:

{{url}}/v1/open-banking/vrp/{mandate_id}/revoke

The following query parameters are supported:

Parameter	Required	Description
`redirect_url`	Optional	The URL the customer will be returned to after cancellation. Must match an approved domain configured for your account. If not provided, the default redirect URL from your Hosted Checkout settings is used (see the note below).
`webhook_url`	Optional	The URL to receive the `mandate_cancelled` webhook. If not provided, the webhook URL from your hosted checkout settings is used.

⚠️
Recommended: always pass redirect_url. Because the revocation page uses the Hosted Checkout product, if you do not pass a redirect_url the customer is returned to the single default redirect URL configured in the Hub. That default is shared across all Hosted Checkout journeys (Card, Apple Pay and Google Pay as well as Pay by Bank), so relying on it will send the customer to a generic destination rather than a cancellation-specific one. Pass redirect_url explicitly to return the customer to the correct cancellation area of your website.

Example:

https://pay.acquired.com/v1/open-banking/vrp/01HZ6XMP5GQWJY3F7DCRATBK9N/revoke?redirect_url=https%3A%2F%2Fyour.domain.com%2Fmandate-cancelled&webhook_url=https%3A%2F%2Fyour.domain.com%2Fwebhook

How it works

Redirect the customer. Your application redirects the customer to the revocation URL. The page displays the mandate details, including their bank, account (last two digits), mandate limits, and payee information.
Customer confirms cancellation. The customer selects "Cancel Mandate" and is shown a confirmation prompt warning that the action is irreversible. They can proceed or choose to keep the mandate.
Mandate cancelled. Once confirmed, the mandate is cancelled and the customer is shown a success page. A mandate_cancelled webhook is sent to your webhook URL.
Customer returned. The customer selects "Return to merchant" and is redirected to your redirect_url. If no redirect_url is configured, the return button is not displayed.

Redirect response

When the customer is redirected back to your site, the following parameters are included:

Parameter	Description
`status`	`cancelled`
`mandate_id`	The ULID of the cancelled mandate.
`transaction_id`	Empty value.
`order_id`	Empty value.
`timestamp`	UNIX timestamp of the cancellation.
`hash`	HMAC hash for response validation. The `transaction_id` is included in the hash concatenation string as an empty value.

Note: Attempting to cancel a VRP mandate directly via the API will return a 403 Forbidden error. All mandate cancellations must go through the hosted revocation flow.