External Authorization

Refresh a short-lived clone-invocation access token.

Use the grant-lifetime refresh token before the access token expires. The refresh token is bound to the same authenticated application, installation, and external identity. Concurrent or repeated refreshes return the same current access token and never extend the owner-approved grant expiry. The response includes clone_ids and clone_nicknames so partners can keep display names warm across token rotation.

post/v1/refresh_external_authorization

Request

  • Base URL: https://partner.mindupload.app
  • URL: https://partner.mindupload.app/v1/refresh_external_authorization
  • Auth: API key in header X-Partner-Key

Request body

preferred_languagestring nullable

BCP-47-ish language code (e.g. 'en', 'zh-cn') for localized messages.

refresh_tokenstring required

Opaque grant-lifetime token used only with refresh_external_authorization; store it as a secret.

installation_idstring required

Your stable opaque identifier for this app installation.

external_subjectstring required

Your stable opaque identifier for the person authorizing this installation.

idempotency_keystring nullable

A stable opaque event key that makes exact retries return the same outcome.

Example request

{
  "refresh_token": "refresh-token-from-exchange-response",
  "installation_id": "your-installation-id",
  "external_subject": "your-external-user-id"
}

Response

Result envelope — check the success field.

successboolean required

Whether the call succeeded.

error_messagestring nullable required

Human-readable reason when success is false.

error_codestring
status'active' | 'revoked' | 'expired' nullable required

Current authorization or invocation lifecycle state.

access_tokenstring nullable required

Opaque grant token accepted only by grant inspection and external clone invocation; store it as a secret and never expose it to users.

refresh_tokenstring nullable required

Opaque grant-lifetime token used only with refresh_external_authorization; store it as a secret.

token_type'Bearer' nullable required

Authorization token type.

grant_idstring nullable required

Stable grant identifier used by the owner-facing revocation surface.

scopesstring[] nullable required

Capabilities approved by the owner.

clone_idsstring[] nullable required

AI consciousness resources selected by the owner.

clone_nicknamesobject nullable required

Map of granted clone id to plaintext display nickname (same shape as exchange).

access_token_expires_atinteger nullable required

UNIX timestamp after which the short-lived access token must be refreshed.

expires_atinteger nullable required

UNIX timestamp when this resource or capability expires.

Changes

No recorded changes to this operation across all 2 revisions of this API.