Rotate the refresh token and mint a new access token

POST/sessions/refresh

Headers

Idempotency-KeystringOptional

Send on every write that creates or changes money or state; a replay with the same key returns the original result with 200.

Body parameters

refresh_tokenstringRequired

Returns

200 OK

The Session object.

Errors

Every error is a problem document with a stable code. See Errors.

400401403404409412413422424429500503

Request

curl -X POST 'https://api.dev.bank.corgi.com/sessions/refresh' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_token": "string"
  }'

Response200

{
  "access_token": "string",
  "device_id": "dev_2tVh8nqLxq4GbDe0K1F6S9zRcWm",
  "expires_in": 0,
  "is_known_device": false,
  "refresh_token": "string",
  "session_id": "sess_2tVh8nqLxq4GbDe0K1F6S9zRcWm",
  "token_type": "string",
  "user": {
    "created_at": "2026-09-17T14:30:00Z",
    "customer_bound": false,
    "customer_id": "cust_2tVh8nqLxq4GbDe0K1F6S9zRcWm",
    "email": "string",
    "has_pin": false,
    "id": "user_2tVh8nqLxq4GbDe0K1F6S9zRcWm",
    "locked_until": "2026-09-17T14:30:00Z",
    "status": "string"
  }
}