Issues a new access token for a refresh token and returns it with the same refresh token. The user profile is not included. Returns 404 for an unknown refresh token and 400 when it has expired or its user no longer exists.
POST
/auth/refresh
curl \
--request POST 'http://api.example.com/auth/refresh' \
--header "Authorization: Bearer $ACCESS_TOKEN" \
--header "Content-Type: application/json" \
--data '{
"refreshToken": "string"
}'
Request examples
{
"refreshToken": "string"
}
Response examples (200)
{
"data": {
"accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2NWExYjJjMyJ9.c2lnbmF0dXJl",
"refreshToken": "b7c1e2f0a9d84c3e8f6a5b4c3d2e1f00"
},
"statusCode": 200,
"timestamp": "2026-01-15T10:15:00.000Z"
}