/auth/refresh

Mock

Mock. This operation is part of the approved contract but its module is not built yet. Run Core with N1_API_MODE=mock N1_DEV_AUTH=stub to get deterministic demo-shop data from it. The real server answers NOT_IMPLEMENTED until it ships; the schema and examples here will not change when it does.

Swap a refresh token for a new access token

Compare

Each refresh token works once: the answer carries a new access token and a new refresh token. Using an old one again is refused (in the real server it also revokes the whole session family).

POST/auth/refresh

Who can call this. None: public.

Headers

Required Optional

X-Request-IdstringOptional
Your id for this request (8–128 characters of A–Z a–z 0–9 . _ : -). Echoed back in the response header and in every error, so you can quote it when reporting a problem. Core makes one if you send none.
Example: app-7f3c2a9e-checkout

Returns

A small JSON object; see the response examples on the right.

Errors

Code	HTTP	When
`REFRESH_TOKEN_INVALID`	`401`	The refresh token is unknown, expired or already used. A reused token revokes the whole session family.

Every error has the same body. See Errors.

Rate limit tier

Tier: per IP. Over the limit you get RATE_LIMITED (HTTP 429) with a Retry-After header. See Response handling.

{ "accessToken": "stub.eyJhdWRpZW5jZSI6ImFwcCIsInRlbmFudElkIjoiMDE5MmYwYzEtMDAwMC03MDAwLTgwMDAtMDAwMDAwMDAwMDBhIiwidXNlcklkIjoiMDE5MmYwYzEtMDAwMC03MDAwLTgwMDAtMDAwMDAwMDAwMGExIiwicm9sZXMiOlsib3duZXIiXX0", "accessTokenExpiresIn": 900, "refreshToken": "mock-refresh-0192f0c1-0000-7000-8000-0000000000a1-2", "user": { "id": "0192f0c1-0000-7000-8000-0000000000a1", "name": "Asha Demo", "role": "OWNER" } }