Refresh session tokens

POST

/oauth/refresh

Last modified:2026-09-26 03:27:25

OperationId:Refresh

Issues a new access token and refresh token from the ns_refresh_token cookie and sets both as cookies again. The endpoint reads only the cookie, and any request body is ignored. No access token is needed. A JWT refresh token produces JWTs, which are returned only in the cookies, and the body carries the user's identity. An opaque refresh token produces opaque tokens, which are also returned in the body as access_token and refresh_token. A token issued while MFA is still pending can't be refreshed. A missing, invalid or expired refresh token returns 401: send the user back to log in. For apps that hold tokens themselves, use the refresh_token grant on /netsapiensjs or /jwt instead.

Request

None

Responses

🟢200OK

application/json

New tokens are set in the cookies. The body describes the user.

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

Request Example

Shell

JavaScript

Java

Swift

curl --location --request POST 'https://awqacore01.crexendocloud.com/ns-api/v2/oauth/refresh'

Response Example

200 - Success

{
    "displayName": "Front Desk",
    "domain": "example.com",
    "scope": "Basic User",
    "territory": "example-reseller",
    "uid": "1001@example.com",
    "user": "1001",
    "user_email": "user@example.com",
    "login": "1001@example.com",
    "token_type": "Bearer"
}

Modified at 2026-09-26 03:27:25

Remove MFA enrollment

Start OIDC login