---
title: "Mobile Refresh V1"
method: POST
path: "/v1/mobile/auth/refresh"
---

# Mobile Refresh V1

`POST /v1/mobile/auth/refresh`

## Request

- Base URL: `https://api.n0brains.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.n0brains.com/v1/mobile/auth/refresh`
- Auth: none declared

Rotate the refresh token. A token that was ALREADY rotated is treated
as stolen: the whole session dies and both holders re-authenticate.

## Response `200`

Successful Response

- MobileSessionResponse: POST /v1/mobile/auth/{register,login,oauth,refresh} success body. Never contains api_key, api_keys, key_prefix, developer credits or developer rate-limit metadata — the mobile account and the developer API product are separate (Decision Log 2026-07-24).
  - `userId` string, required
  - `accessToken` string, required
  - `accessTokenExpiresAt` string, required
  - `refreshToken` string, required
  - `refreshTokenExpiresAt` string, required
  - `access` MobileAccessResponse, required: GET /v1/mobile/access — per-feature gate. Branch on capabilities and quotas, never on a tier string. Unknown capability keys are safe to ignore. Anonymous callers receive the identical shape with userId=null and AUTH_REQUIRED reasons (never an empty string or placeholder id). Carries no upgrade URL and no store price by design.
    - `schemaVersion` 1, required
    - `userId` string, nullable: Stable opaque account id; null when anonymous. Never empty-string, never a synthetic placeholder.
    - `mobilePlan` 'free' | 'pro', required
    - `api` ApiPlan, required
      - `plan` 'none' | 'free' | 'pro', required
      - `access` 'none' | 'read' | 'full', required
    - `capabilities` object, required
    - `quotas` object, required
    - `subscription` SubscriptionInfo, required
      - `status` 'none' | 'trialing' | 'active' | 'grace_period' | 'past_due' | 'expired' | 'cancelled', required
      - `source` 'none' | 'apple' | 'google_play' | 'stripe' | 'manual', required
      - `currentPeriodEnd` string, nullable
    - `serverTime` string, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `409`: Conflict
- `503`: Service Unavailable

---

[API](https://skmtc.dev/n0brains/apis/n0brains-signals-api.md) · [All operations](https://skmtc.dev/n0brains/apis/n0brains-signals-api/llms.txt) · [OpenAPI document](https://skmtc.dev/n0brains/apis/n0brains-signals-api/revisions/ac21b5aebd10?raw)