Skip to main content
POST
Exchange Refresh Token for Access Token
Exchanges a Refresh Token for a short-lived Access Token. This is the first call every ACB API consumer makes — the returned Access Token authenticates subsequent calls to other endpoints. When the Access Token expires, call this endpoint again with the same Refresh Token.
This is one of the two old endpoints (pre-v1.3). Authentication uses the Refresh Token in the request body — there’s no Authorization header on this call. Subsequent endpoints use the returned Access Token in the Authorization header (new endpoints) or in the request body (the other old endpoint, get_secret_details).
For ACB deployments updated from a version prior to 1.2, switch to the https://{hostname}/EkranACB server in the Playground.

Where to get the Refresh Token

The Refresh Token comes from the Application Account Settings section of a Management Tool user — see Set up user account.

Rate limit

5 requests per minute per Refresh Token. Consumers should cache the Access Token for its full expires_in lifetime rather than re-requesting on every call.

Errors

See Status codes. Common errors:
  • 401 Unauthorized — invalid or expired Refresh Token. Verify the token, and check whether the user’s external-app toggle was disabled.
  • 403 Forbidden — the request originates from an IP not in the user’s IP Address restriction.
  • 429 Too Many Requests — rate limit exceeded.

Set up user account

Where to get the Refresh Token.

API reference

Status codes, rate limiting, conventions.

Get secret details (old)

Old retrieval endpoint using Access Token in body.

Get secret credentials (new)

New retrieval endpoint using Authorization header.

Body

application/json
refreshToken
string
required

Refresh Token from the user's Application Account Settings in the Management Tool.

Response

Access Token issued successfully

accessToken
string

Access Token to use on subsequent API calls (Authorization header for new endpoints; in body for old endpoints).

expires_in
integer<int32>

Seconds until the Access Token expires. Default 600. 0 means never expires.