Oauth 2.0 Refresh Token

Purpose

Refresh an OAuth2 access token using the Refresh Token grant (grant_type=refresh_token).

This request calls POST {{uatAPI}}/oauth/token and exchanges an existing refresh token for a new access token (and typically a new refresh token).

Required variables

This request relies on the following variables:

{{uatAPI}} — Base URL for the UAT API host (e.g., https://...). Used in the request URL.

{{oauthAccessToken}} — Refresh token value that will be sent as the refresh_token form field.

Note: despite the variable name, in this request it is used as the refresh token input.

Body (x-www-form-urlencoded)

The request body is sent as application/x-www-form-urlencoded with the fields:

grant_type: refresh_token

refresh_token: {{oauthAccessToken}}

Expected success response (200)

On success, the response is JSON and is expected to include:

access_token (string) — New bearer access token.

token_type (string) — Typically Bearer.

expires_in (number) — Lifetime in seconds (e.g., 900).

refresh_token (string) — New refresh token (may rotate).

Example shape:

{
  "access_token": "...",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "..."
}

Common errors

400 Bad Request

Typically indicates an invalid/expired refresh token or malformed form body. Common causes:

{{oauthAccessToken}} is missing/empty or contains an access token instead of a refresh token.

The refresh token has expired or is no longer valid (revoked/rotated).

Server expects a different client configuration (client_id / client_secret) depending on the OAuth server setup.

Use the saved 400 example for a representative error response.

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

Oauth 2.0 Refresh Token

Purpose#

Required variables#

Body (x-www-form-urlencoded)#

Expected success response (200)#

Common errors#

400 Bad Request#

Request