curl -X POST "https://demo.api.vultlocal.com/api/v1/admin/refresh" \
-H "Content-Type: application/json" \
-d '{
"refresh_token": "rt_abc123xyz..."
}'
{
"success": true,
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh_token": "new_refresh_token_string",
"expires_at": 1704110400,
"refresh_expires_at": 1704714400,
"user": {
"id": "123",
"email": "admin@olive.sl",
"first_name": "Admin",
"last_name": "User",
"role": "system_admin",
"status": "active"
}
}
{
"success": false,
"error": "Invalid or expired refresh token",
"code": "INVALID_TOKEN"
}
Admin
Refresh Token
Refresh access token using refresh token
POST
/
admin
/
refresh
curl -X POST "https://demo.api.vultlocal.com/api/v1/admin/refresh" \
-H "Content-Type: application/json" \
-d '{
"refresh_token": "rt_abc123xyz..."
}'
{
"success": true,
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh_token": "new_refresh_token_string",
"expires_at": 1704110400,
"refresh_expires_at": 1704714400,
"user": {
"id": "123",
"email": "admin@olive.sl",
"first_name": "Admin",
"last_name": "User",
"role": "system_admin",
"status": "active"
}
}
{
"success": false,
"error": "Invalid or expired refresh token",
"code": "INVALID_TOKEN"
}
Issue a new access token using a valid refresh token. Implements token rotation for security.
Request
string
required
Valid refresh token from login
Response
boolean
Whether the refresh succeeded
string
New JWT access token
string
New refresh token (old one is revoked)
integer
Access token expiration timestamp
integer
Refresh token expiration timestamp
object
User details object
Examples
curl -X POST "https://demo.api.vultlocal.com/api/v1/admin/refresh" \
-H "Content-Type: application/json" \
-d '{
"refresh_token": "rt_abc123xyz..."
}'
{
"success": true,
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh_token": "new_refresh_token_string",
"expires_at": 1704110400,
"refresh_expires_at": 1704714400,
"user": {
"id": "123",
"email": "admin@olive.sl",
"first_name": "Admin",
"last_name": "User",
"role": "system_admin",
"status": "active"
}
}
{
"success": false,
"error": "Invalid or expired refresh token",
"code": "INVALID_TOKEN"
}
Token Rotation
For security, a new refresh token is issued on every refresh:
- Old refresh token is revoked immediately
- New refresh token is stored
- Both new tokens are returned
Errors
| Status | Code | Description |
|---|---|---|
| 400 | INVALID_REQUEST | Invalid request format |
| 401 | INVALID_TOKEN | Invalid or expired refresh token |
| 500 | INTERNAL_ERROR | Server error |
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
Refresh token
⌘I