Skip to content
Tovari Docs

Exchange a refresh token for fresh tokens

POST
/auth/refresh
curl --request POST \
  --url https://api.tovarifinancial.com/auth/refresh \
  --header 'Content-Type: application/json' \
  --data '{ "refreshToken": "example", "email": "hello@example.com" }'

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
refreshToken
required
string
email
string format: email
Examplegenerated
{
  "refreshToken": "example",
  "email": "hello@example.com"
}

Responses

Section titled “Responses”

200

Section titled “200”

New tokens issued

Media typeapplication/json
object
data
required
object
accessToken
required
string
idToken
required
string
refreshToken
required

The rotated refresh token, or the one presented when Cognito returns none.

string
expiresIn
required

Access/ID token lifetime in seconds.

integer
outstandingPolicies
required
Array<object>
object
id
required
string format: uuid
policyType
required
string
version
required
integer
title
required
string
firstAcceptance
required

TRUE when the outstanding policies are a first acceptance rather than an update.

boolean
verification
required
object
status
required

Derived from users.email_verified, the sole source of truth for the gate.

string
Allowed values: verified unverified
codeDeliveryDetails
object
destination
required
string
deliveryMedium
required
string
cooldownSeconds

Seconds the resend button stays disabled after an interactive send.

integer
sendsRemaining
integer
language
required
object
spanishEnabled
required

The per-environment Spanish rollout flag. False ⇒ effectiveLocale is always ‘en’.

boolean
preference
required

The explicit choice; null = use device language.

string
nullable
Allowed values: en es
detected
required

This request’s X-Client-Locale, else the last-seen device language, else null.

string
nullable
Allowed values: en es
effectiveLocale
required

The language to display: ‘en’ when the flag is off, else preference ?? detected ?? ‘en’.

string
Allowed values: en es
message
string
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "data": {
    "verification": {
      "status": "verified"
    },
    "language": {
      "preference": "en",
      "detected": "en",
      "effectiveLocale": "en"
    }
  }
}

400

Section titled “400”

Validation failed — see errorCode / fieldErrors

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

401

Section titled “401”

Missing, invalid, or expired bearer token

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

500

Section titled “500”

Internal error (no internal detail leaked)

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

503

Section titled “503”

Service temporarily unavailable — errorCode is SERVICE_UNAVAILABLE. A TRANSIENT, RETRYABLE condition rather than a defect in the request: a query that exceeded its time budget, a lost or refused database connection, a saturated connection pool, or an outage at an upstream provider the request depends on (the authentication provider, or the bank data provider on a bank-connection operation). The identical request may succeed on retry — back off briefly and, on a write, resend the same X-Idempotency-Key where the operation accepts one.

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}