---
title: "Refresh session"
method: POST
path: "/session/refresh"
---

# Refresh session

`POST /session/refresh`

If your access tokens expire, this API endpoint takes a Refresh Token and returns a new set of Access Tokens for your session. Note that we don't rotate the Refresh Token itself, and it's not returned by this API endpoint.

## Request body

- RefreshSessionParams
  - `$schema` string, uri — A URL to the JSON Schema for this object.
  - `refresh_token` string — The refresh token associated with the session to refresh.

## Response `200`

OK

- RefreshSessionResponse
  - `$schema` string, uri — A URL to the JSON Schema for this object.
  - `refreshed_at` string, date-time, required — A timestamp that indicates the last time the session data was refreshed.
  - `session` Session, required
    - `featurebase_identity` FeaturebaseIdentity, required
      - `company_hash` string, required
      - `user_hash` string, required
    - `teams` Team[], required
      - `execution_region` string, required
      - `name` string, required
      - `organization` string, required — The name of the organization this team belongs to.
      - `slug` string — This property is deprecated. Use name instead.
      - `token` Token
        - `access_token` string, required — The access token to use when authenticating API requests with Tower.
        - `jwt` string, required — This property is deprecated. Use access_token instead.
        - `refresh_token` string — The refresh token to use when refreshing an expired access token. For security reasons, refresh tokens should only be transmitted over secure channels and never logged or stored in plaintext. It will only be returned upon initial authentication or when explicitly refreshing the access token.
      - `type` string, required — The type of team, either 'personal' or 'team'.
    - `token` Token, required
      - `access_token` string, required — The access token to use when authenticating API requests with Tower.
      - `jwt` string, required — This property is deprecated. Use access_token instead.
      - `refresh_token` string — The refresh token to use when refreshing an expired access token. For security reasons, refresh tokens should only be transmitted over secure channels and never logged or stored in plaintext. It will only be returned upon initial authentication or when explicitly refreshing the access token.
    - `user` User, required
      - `company` string, required
      - `country` string, required
      - `created_at` string, date-time, required
      - `email` string, required
      - `first_name` string, required
      - `is_alerts_enabled` boolean, required
      - `is_confirmed` boolean, required
      - `is_invitation_claimed` boolean — This property is deprecated. It will be removed in a future version.
      - `is_subscribed_to_changelog` boolean, required
      - `last_name` string, required
      - `profile_photo_url` string, required
      - `promo_code` string, required

## Other responses

- `default` — Error

---

[API](https://skmtc.net/tower/apis/tower-api.md) · [All operations](https://skmtc.net/tower/apis/tower-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tower/tower-api/revisions/0e42b0fb26d9/schema)