Rotate a staff refresh token without extending MFA freshness

POST/staff/sessions/refreshNo authentication

Headers

Idempotency-KeystringOptional

Send on every write that creates or changes money or state; a replay with the same key returns the original result with 200.

Body parameters

refresh_tokenstringRequired

Returns

200 OK

The Staff Session object.

Errors

Every error is a problem document with a stable code. See Errors.

400401403404409412413422424429500503

Request

curl -X POST 'https://api.dev.bank.corgi.com/staff/sessions/refresh' \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_token": "string"
  }'

Response200

{
  "access_token": "string",
  "expires_in": 0,
  "refresh_token": "string",
  "session_id": "sess_2tVh8nqLxq4GbDe0K1F6S9zRcWm",
  "token_type": "string",
  "user": {
    "active": false,
    "displayName": "string",
    "externalId": "string",
    "id": "staff_2tVh8nqLxq4GbDe0K1F6S9zRcWm",
    "meta": {
      "created": "2026-09-17T14:30:00Z",
      "lastModified": "2026-09-17T14:30:00Z",
      "resourceType": "string",
      "version": "string"
    },
    "roles": [
      {
        "value": "string"
      }
    ],
    "schemas": [
      "string"
    ],
    "userName": "string"
  }
}