---
title: "Rotate refresh token and return new tokens"
method: POST
path: "/auth/refresh"
---

# Rotate refresh token and return new tokens

`POST /auth/refresh`

## Request body

- object
  - `refreshToken` string, required

## Response `200`

Rotated tokens

- SuccessEnvelope
  - `data` unknown, required
  - `meta` ResponseMeta, required
    - `requestId` string, required
    - `timestamp` string, date-time, required

## Other responses

- `400` — Problem details response
- `401` — Problem details response
- `403` — Returned by authenticated endpoints when the caller is authenticated but not permitted to use the API yet. Two stable extension codes can appear: - `email_unconfirmed`: the account still has a pending email confirmation (a `registration` token row). Enforced per request on the `api_v1` firewall via the same `UserChecker` as web login, so a token issued before the account lapsed stops working immediately. Resolve out-of-band via the email confirmation link. - `phone_unconfirmed`: the SMS system is enabled and the caller's phone number is not yet confirmed. The caller holds ROLE_NEWBIE and must confirm their phone first (see the phone-confirmation routes). Both are standard Problem Details responses; clients should branch on the `code` extension rather than the human-readable `detail`.

## Changes

- **2026-07-17** `5acb23b38232` — 1 info
  - added the non-success response with the status `403`
- **2026-06-01** `7e039877b813` — 4 info
  - added the optional property `code` to the response with the `400` status
  - added the optional property `code` to the response with the `401` status
  - added the optional property `params` to the response with the `400` status
  - added the optional property `params` to the response with the `401` status
- **2026-02-28** `832c7fc616ed` — 4 warning, 1 info
  - removed the optional property `code` from the response with the `400` status
  - removed the optional property `code` from the response with the `401` status
  - removed the optional property `params` from the response with the `400` status
  - removed the optional property `params` from the response with the `401` status
  - …1 more

[Change history](https://skmtc.dev/cyklokoalicia/apis/opensourcebikeshare-api/changes/auth/refresh/post.md)

---

[API](https://skmtc.dev/cyklokoalicia/apis/opensourcebikeshare-api.md) · [All operations](https://skmtc.dev/cyklokoalicia/apis/opensourcebikeshare-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cyklokoalicia/opensourcebikeshare-api/revisions/5acb23b38232/schema)