---
title: "Extend a connection"
method: POST
path: "/connections/extend"
tags: ["Connection Management"]
---

# Extend a connection

`POST /connections/extend`

Starts a process to extend a connection, by reconfirming consent and starting a new authentication if necessary.
You can find out more on how to use this endpoint [here](https://docs.truelayer.com/docs/connections).

## Headers

- `X-Client-Correlation-Id` string

## Request body

- ExtendConnectionRequest
  - `user_has_reconfirmed_consent` boolean, required — Set to `true` if the user has re-confirmed consent in your application. We must review your consent screen and enable your client_id before you can set this field to `true` in production. Set to `false` if you'd like the user to re-confirm consent in TrueLayer's auth dialog (setting to `false` is currently not supported).
  - `client_id` string, required — Your application's client id, found in TrueLayer Console
  - `client_secret` string, required — Your application's client secret, found in TrueLayer Console
  - `user` NewUser, required — Details of the end user who is connecting to their provider.
    - `id` string — Unique ID for the user
    - `name` string — If the client is not regulated, they must provide this value.
    - `email` string, email — If the client is not regulated, they must provide one of `email`/`phone`.
    - `phone` string, phone_number — If the client is not regulated, they must provide one of `email`/`phone`.
  - `refresh_token` string, required — refresh_token for the connection you want to extend
  - `redirect_uri` string, uri, required — A valid redirect_uri for your TrueLayer client_id (set in your Console)
  - `state` string — An opaque value used by the client to maintain state between the request and callback
  - `code_challenge` string — PKCE code challenge
  - `response_mode` 'form_post' — If set to "form_post", when we call your redirect_uri, we'll include the `code` in a form POST request. If left unset, we'll make a GET request with the code set as a query parameter

## Response `200`

Extend response

- union
  - NoActionNeeded
    - `action_needed` 'no_action_needed', required
    - `access_token` string, required — A short-lived JWT token used to access data on behalf of the End user
    - `expires_in` integer, required — `access_token` validity in seconds. Default is 1 hour or specified by provider whichever is lower.
    - `refresh_token` string, required — A long-lived code used to obtain a new `access_token` when expired.
    - `token_type` string, required — Type of token returned. Must be `Bearer`
  - AuthenticationNeeded
    - `action_needed` 'authentication_needed', required
    - `user_input_link` string, uri, required — A link to direct the end user to confirm additional information. This could be a direct link to a bank authentication, or to TrueLayer if consent has not been re-confirmed.
  - ReconfirmationOfConsentNeeded
    - `action_needed` 'reconfirmation_of_consent_needed', required
    - `user_input_link` string, uri, required — A link to direct the end user to confirm additional information. This could be a direct link to a bank authentication, or to TrueLayer if consent has not been re-confirmed.

## Other responses

- `400` — Validation error response
- `401` — Unauthorised
- `422` — Unprocessable Entity

---

[API](https://skmtc.net/truelayer/apis/authentication-server.md) · [All operations](https://skmtc.net/truelayer/apis/authentication-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/truelayer/authentication-server/revisions/5f6051515b2c/schema)