Rotate the current refresh token.

POST

/v1/auth/refresh

const url = 'https://api.dev.iot-sens.schlossers.at/v1/auth/refresh';
const options = {
  method: 'POST',
  headers: {cookie: '__Host-sens_refresh=<__Host-sens_refresh>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.dev.iot-sens.schlossers.at/v1/auth/refresh \
  --cookie __Host-sens_refresh=<__Host-sens_refresh>

Requires the refresh cookie and an Origin header that exactly matches the configured allowlist. A successful rotation extends the session’s seven-day inactivity deadline.

Authorizations

RefreshCookie

Responses

200

A short-lived access token and rotated refresh cookie.

application/json

object

accessToken

required

string

tokenType

required

string

Allowed value: Bearer

expiresInSeconds

required

integer

default: 1800 >= 60 <= 3600

refreshIdleExpiresAt

required

string format: date-time

passwordChangeRequired

required

boolean

Example

{
  "tokenType": "Bearer",
  "expiresInSeconds": 1800
}

Headers

Cache-Control

string

Allowed value: no-store

Set-Cookie

string

Host-only HttpOnly refresh cookie; never contains an access token.

401

A safe platform error response.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED AUTHENTICATION_FAILED AUTHORIZATION_FAILED RESOURCE_NOT_FOUND CONFLICT DEPENDENCY_FAILURE FLOW_FAILURE RATE_LIMITED INTERNAL_ERROR

category

required

string

Allowed values: validation authentication authorization not_found conflict dependency_failure flow_failure rate_limit internal

message

required

Safe client-facing diagnostic message.

string

correlationId

required

Correlation ID for operational investigation.

string

>= 1 characters

details

Safe bounded diagnostic details.

object

key

additional properties

One of:

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED",
    "category": "validation"
  }
}

Headers

Cache-Control

string

Allowed value: no-store

403

A safe platform error response.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED AUTHENTICATION_FAILED AUTHORIZATION_FAILED RESOURCE_NOT_FOUND CONFLICT DEPENDENCY_FAILURE FLOW_FAILURE RATE_LIMITED INTERNAL_ERROR

category

required

string

Allowed values: validation authentication authorization not_found conflict dependency_failure flow_failure rate_limit internal

message

required

Safe client-facing diagnostic message.

string

correlationId

required

Correlation ID for operational investigation.

string

>= 1 characters

details

Safe bounded diagnostic details.

object

key

additional properties

One of:

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED",
    "category": "validation"
  }
}

Headers

Cache-Control

string

Allowed value: no-store

409

The same refresh token is already rotating in a short race window.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED AUTHENTICATION_FAILED AUTHORIZATION_FAILED RESOURCE_NOT_FOUND CONFLICT DEPENDENCY_FAILURE FLOW_FAILURE RATE_LIMITED INTERNAL_ERROR

category

required

string

Allowed values: validation authentication authorization not_found conflict dependency_failure flow_failure rate_limit internal

message

required

Safe client-facing diagnostic message.

string

correlationId

required

Correlation ID for operational investigation.

string

>= 1 characters

details

Safe bounded diagnostic details.

object

key

additional properties

One of:

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED",
    "category": "validation"
  }
}

Headers

Cache-Control

string

Allowed value: no-store

Retry-After

integer

Allowed value: 1

500

A safe platform error response.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED AUTHENTICATION_FAILED AUTHORIZATION_FAILED RESOURCE_NOT_FOUND CONFLICT DEPENDENCY_FAILURE FLOW_FAILURE RATE_LIMITED INTERNAL_ERROR

category

required

string

Allowed values: validation authentication authorization not_found conflict dependency_failure flow_failure rate_limit internal

message

required

Safe client-facing diagnostic message.

string

correlationId

required

Correlation ID for operational investigation.

string

>= 1 characters

details

Safe bounded diagnostic details.

object

key

additional properties

One of:

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED",
    "category": "validation"
  }
}

Headers

Cache-Control

string

Allowed value: no-store

503

A safe platform error response.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED AUTHENTICATION_FAILED AUTHORIZATION_FAILED RESOURCE_NOT_FOUND CONFLICT DEPENDENCY_FAILURE FLOW_FAILURE RATE_LIMITED INTERNAL_ERROR

category

required

string

Allowed values: validation authentication authorization not_found conflict dependency_failure flow_failure rate_limit internal

message

required

Safe client-facing diagnostic message.

string

correlationId

required

Correlation ID for operational investigation.

string

>= 1 characters

details

Safe bounded diagnostic details.

object

key

additional properties

One of:

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED",
    "category": "validation"
  }
}

Headers

Cache-Control

string

Allowed value: no-store