Refresh an access token

POST /auth/api-token/refresh

Get a new access token using a refresh token

Request body

Content type application/json

Fields

Field	Type	Required	Description
`refresh_token`	string	yes

Example request body

{
  "refresh_token": "string"
}

Responses

Status	Description
`200 OK`	Access token refreshed successfully
`400 Bad Request`	Invalid refresh token
`401 Unauthorized`	Authentication failed or invalid token
`403 Forbidden`	Unauthorized or insufficient permissions
`429 Too Many Requests`	Too many requests
`500 Internal Server Error`	Internal server error

Content type application/json

TokenResponse (200)

Field	Type	Required	Description
`access_token`	string	no	JWT access token for API authentication
`refresh_token`	string	no	Token that can be used to obtain a new access token
`expires_in`	integer	no	Time in seconds until the token expires
`expires`	string	no	RFC 2822 formatted date when the token expires

Example 200 response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjM4MmE0YTE0In0.eyJzdWIiOiJjNTVhYjY5NC03Nzc5LTQwZjctYmIyMy01YzYxNDNjMmVmMDMiLCJ0ZW5hbnRJZCI6IjA0OGMyYTFjLTA4ODEtNGRjYy1iZmNhLTZlMzE4MDIwNzU1MSIsInJvbGVzIjpbIkFkbWluIl0sInBlcm1pc3Npb25zIjpbImZlLnNlY3VyZS4qIiwiZmUuY29ubmVjdGl2aXR5LioiLCJmZS5hY2NvdW50LXNldHRpbmdzLnJlYWQuYXBwIl0sIm1ldGFkYXRhIjp7fSwiY3JlYXRlZEJ5VXNlcklkIjoiNzZjOTJjMWItNDVmMS00NGJhLWE4M2YtYzliNDM2ZGVlNGVjIiwidHlwZSI6InRlbmFudEFwaVRva2VuIiwiYXBwbGljYXRpb25JZCI6ImQyZjcyZjc1LTJkZmQtNDYyMy04OTgwLTJjYzI4ZDVhNzhlNSIsImF1ZCI6IjM4MmE0YTE0LWUzZDEtNDI1MS1hNTc3LWYxMGI4ZmI4YmViMCIsImlzcyI6Imh0dHBzOi8vdHJ1ZS1zYW5kYm94LmF1LmZyb250ZWdnLmNvbSIsImlhdCI6MTc0ODQ3ODg2NSwiZXhwIjoxNzQ4NTY1MjY1fQ.Bc3ovyOyDqtCF-LNOS86JV_WPUkKAlY59SSYG8979DzZRJ4sABv_5FyY2DUk4zkOuucLVRv2Fd7DVoq8VV8aZm45MqPbdmhGZ68TUyGY5ZNLRPbyzdwLqEWA5T2uMwVuQzmfv3RidomGid6Yke0-QEe9RjffsV_LRIgM_eVaSNOc7jYA5oQu3RqsiadsiyWUAE9EPQJ0imjqUCaA8IJQVWjmbuEF_wa5pJcAuknp0HGb1_pzS_cpragkwvZpfNugXP58sa0bO1DA4b4CY6rbiKnm-4OaY3PXYGzs_oD_otEkBKTw6BRLclBSXiSXuEleOdrqZxYmPMCZo1BVkJvS2Q",
  "refresh_token": "67c08c7b-1c78-4021-a026-896a03c63e64",
  "expires_in": 86400,
  "expires": "Fri, 30 May 2025 00:34:25 GMT"
}

Content type application/json

Error (400)

Field	Type	Required	Description
`error`	object	no
`error.message`	string	yes	Human-readable error message
`error.code`	string	yes	Machine-readable error code One of: `E1001`, `E1002`, `E1003`, `E1004`, `E1005`, `E1006`, `E1007`, `E1008`, `E1009`, `E1010`, `E1011`, `E1012`, `E2001`, `E2002`, `E2003`, `E2004`, `E2005`
`error.type`	string	yes	Error type identifier One of: `VALIDATION_ERROR`, `INVALID_REQUEST`, `AUTHENTICATION_FAILED`, `UNAUTHORIZED`, `NOT_FOUND`, `CONFLICT`, `RATE_LIMIT_EXCEEDED`, `PRECONDITION_FAILED`, `CREDENTIAL_EXPIRED`, `CREDENTIAL_REVOKED`, `CREDENTIAL_PENDING_ACCEPTANCE`, `CREDENTIAL_VERIFICATION_FAILED`, `INTERNAL_ERROR`, `INTERNAL_ERROR_EMAIL`, `DATABASE_ERROR`, `EXTERNAL_SERVICE_ERROR`, `SERVICE_UNAVAILABLE`
`error.timestamp`	string	yes
`error.correlation_id`	string	no
`error.details`	object	no	Additional error context

Example 400 response

{
  "error": {
    "message": "Invalid phone number format",
    "code": "E1001",
    "type": "VALIDATION_ERROR",
    "timestamp": "2024-02-20T03:14:15Z",
    "correlation_id": "req_1234567890",
    "details": {
      "validation_errors": {
        "phone": "Must be in format +61423123456"
      }
    }
  }
}

Content type application/json

Response fields (401)

Field	Type	Required	Description
`error`	object	yes

Example 401 response

{
  "error": {
    "type": "AUTHENTICATION_FAILED",
    "code": "E1003"
  }
}

Content type application/json

Response fields (403)

Field	Type	Required	Description
`error`	object	yes

Example 403 response

{
  "error": {
    "type": "UNAUTHORIZED",
    "code": "E1004"
  }
}

Content type application/json

Response fields (429)

Field	Type	Required	Description
`error`	object	yes

Example 429 response

{
  "error": {
    "type": "RATE_LIMIT_EXCEEDED",
    "code": "E1007"
  }
}

Content type application/json

Response fields (500)

Field	Type	Required	Description
`error`	object	yes

Example 500 response

{
  "error": {
    "type": "INTERNAL_ERROR",
    "code": "E2001"
  }
}

Example request

curl --request POST \
  --url https://api.sandbox.truevault.com.au/api/v1/auth/api-token/refresh \
  --header 'Content-Type: application/json'