Exchanges a token pair for a new one. Send the current access token together with the refresh token issued alongside it. Refresh tokens are single use: each call returns a new refresh token and invalidates the one supplied, so always replace both stored values with those returned. The refresh token's 15 minute lifetime restarts on every use, so a client that refreshes at least that often stays authenticated indefinitely; leave a gap longer than 15 minutes and the user must authenticate again through POST /mfa/login. The previously issued access token stays valid until its own 5 minute expiry, so refreshing does not break requests already in flight. Unlike the other authentication endpoints this one does not check the API key, but sending it anyway is recommended for consistency.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
The refresh token was rejected, because it has already been used, has expired, or does not correspond to the supplied access token. The response body is empty: this endpoint does not currently forward the reason given by the identity provider.
Returned for a malformed or empty request body, a missing accessToken or refreshToken field, or a value that cannot be decrypted. The body is {"message":"Internal server error"} even though the cause is a malformed request, because this endpoint does not validate its input before using it.