---
title: "Refresh Order Intake Session"
method: POST
path: "/v1/order-intake/sessions/refresh"
tags: ["Order Intake"]
---

# Refresh Order Intake Session

`POST /v1/order-intake/sessions/refresh`

## Request

- Base URL: `https://api.sandbox.usenash.com`
- URL: `https://api.sandbox.usenash.com/v1/order-intake/sessions/refresh`
- Auth: none declared

Replace the caller's session with a new one for the same form before it expires. The old secret stops working. A form whose mode, link or rollout changed answers like any other request: `SESSION_EXPIRED` or the uniform `FORBIDDEN`.

## Response `201`

Created

- EmbedSessionEnvelope: The mint response, and the entire browser contract (PLAT-22260). The host backend forwards this verbatim to its page; it is not expected to add, rename, or reshape anything. Four fields, each earning its place: * `client_secret` — the only value that authenticates the browser. * `expires_at` — so the page can refresh *before* a request fails rather than discovering expiry as a broken widget. * `session_id` — non-secret. The browser's cache key and the id that shows up in logs and support tickets, which is exactly why it is separate from the secret rather than derived from it. * `api_region` — which Nash API the widget bundle should talk to, as one of the published wire tokens the widget loader accepts: `"us"` or `"au"`. Never a deployment region string like `us-west-1` — the browser resolves this against its own build-time endpoint table, not against server config (see `embed_session_service.resolve_api_region`).
  - `client_secret` string, required: Browser-held session secret (`wcs_…`). Shown once, never retrievable.
  - `expires_at` string, date-time, required
  - `session_id` string, required
  - `api_region` string, required

## Other responses

- `422`: Unprocessable Content

---

[API](https://skmtc.dev/nash/apis/nash-api.md) - [All operations](https://skmtc.dev/nash/apis/nash-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nash/apis/nash-api/revisions/e3713837c5c9?raw)