matrix-spec/data/api/client-server/refresh.yaml

# Copyright 2022 The Matrix.org Foundation C.I.C.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
swagger: '2.0'
info:
  title: "Matrix Client-Server Registration and Login API"
  version: "1.0.0"
host: localhost:8008
schemes:
  - https
  - http
basePath: /_matrix/client/v3
consumes:
  - application/json
produces:
  - application/json
paths:
  "/refresh":
    post:
      x-addedInMatrixVersion: "1.3"
      summary: Refresh an access token
      description: |-
        Refresh an access token. Clients should use the returned access token
        when making subsequent API calls, and store the returned refresh token
        (if given) in order to refresh the new access token when necessary.

        After an access token has been refreshed, a server can choose to
        invalidate the old access token immediately, or can choose not to, for
        example if the access token would expire soon anyways. Clients should
        not make any assumptions about the old access token still being valid,
        and should use the newly provided access token instead.

        The old refresh token remains valid until the new access token or refresh token
        is used, at which point the old refresh token is revoked.

        Note that this endpoint does not require authentication via an
        access token. Authentication is provided via the refresh token.

        Application Service identity assertion is disabled for this endpoint.
      operationId: refresh
      parameters:
        - in: body
          name: body
          required: true
          schema:
            type: object
            example: {
                "refresh_token": "some_token"
              }
            properties:
              refresh_token:
                type: string
                description: The refresh token
      responses:
        200:
          description: A new access token and refresh token were generated.
          examples:
            application/json: {
                "access_token": "a_new_token",
                "expires_in_ms": 60000,
                "refresh_token": "another_new_token"
              }
          schema:
            type: object
            properties:
              access_token:
                type: string
                description: |-
                  The new access token to use.
              refresh_token:
                type: string
                description: |-
                  The new refresh token to use when the access token needs to
                  be refreshed again. If not given, the old refresh token can
                  be re-used.
              expires_in_ms:
                type: integer
                description: |-
                  The lifetime of the access token, in milliseconds. If not
                  given, the client can assume that the access token will not
                  expire.
            required:
              - access_token
        401:
          description: |-
            The provided token was unknown, or has already been used.
          examples:
            application/json: {
                "errcode": "M_UNKNOWN_TOKEN",
                "error": "Soft logged out",
                "soft_logout": true
              }
          schema:
            "$ref": "definitions/errors/error.yaml"
        429:
          description: This request was rate-limited.
          schema:
            "$ref": "definitions/errors/rate_limited.yaml"