Three-Legged Context
POST
refreshtoken
Acquire a new access token by using the refresh token provided by the POST gettoken endpoint.
See the Field Guide for more information about refresh tokens.
Resource Information
| Method and URI | POST https://developer.api.autodesk.com/authentication/v1/refreshtoken |
| Data Format | Form encoding (request); JSON (response) |
| Rate Limit | 100 calls per minute |
Request
Headers
| Content-Type* string | Must be application/x-www-form-urlencoded |
* Required
Request
Body Structure
The request body is a URL-encoded string of ampersand-concatenated, name-value pairs of the following parameters:
| client_id* string | Client ID of the app |
| client_secret* string | Client secret of the app |
| grant_type* string | Must be refresh_token |
| refresh_token* string | The refresh token used to acquire a new access token |
| scope string | Space-separated list of required scopes
If this parameter is omitted, the returned access token will
have the same scopes as the original access token.
If this parameter is specified, it must represent a subset of
the scopes present in the original access token.
Note: A URL-encoded space is
%20. |
* Required
Response
HTTP Status Code Summary
| 200 OK | Successful request; access token returned. |
| 400 Bad Request | One or more parameters are invalid. Examine the response payload body for details. |
| 401 Unauthorized | The client_id and client_secret combination is not valid. |
| 403 Forbidden | The client_id is not authorized to access this endpoint. |
| 415 Unsupported Media Type | The Content-Type header is missing or specifies a value other than
application/x-www-form-urlencoded. |
| 429 Too Many Requests | Rate limit exceeded; wait some time before retrying. |
| 500 Internal Server Error | Generic internal server error. |
Response
Body Structure (200)
The response body for a successful call is a flat JSON object with the following attributes:
| token_type string | Will always be Bearer |
| expires_in int | Access token expiration time (in seconds) |
| refresh_token string | The refresh token |
| access_token string | The access token |
Example
Successful Exchange of Refresh Token for New Access Token (200)
Request
curl -v 'https://developer.api.autodesk.com/authentication/v1/refreshtoken'
-X 'POST'
-H 'Content-Type: application/x-www-form-urlencoded'
-d '
client_id=obQDn8P0GanGFQha4ngKKVWcxwyvFAGE&
client_secret=eUruM8HRyc7BAQ1e&
grant_type=refresh_token&
refresh_token=i0kBWTHzI0JVKWTOoFn6cvPk32SZcs5CUtwic3nduc
'
Show More
Note that line breaks have been added to the cURL command above for ease of reading, but should be removed before executing the command in a terminal.
Response
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, no-store
Content-Type: application/json;charset=UTF-8
Date: Sat, 04 Jun 2016 18:59:25 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
max-age: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Apigee Router
Set-Cookie: PF=ix2tNCKRRb9WwM6dO78Eic;Path=/;Secure;HttpOnly
Set-Cookie: bbbbbbbbbbbbbbb=KINDJALIIFLMNIHHAHLBPHPKNNFLHCIPDCKLJALMEDMDNIALGOKPFOLFNOOAMPMFBDMCGBOHPPEMLJGGECNMBMGBNKFOGINKCPLEAEJBFNDJEPHGCJPAJLKPNMLDEJEN; HttpOnly; secure
X-Frame-Options: SAMEORIGIN
Content-Length: 89
Connection: keep-alive
{
"token_type": "Bearer",
"expires_in": 1799,
"refresh_token": "i0kBWTHzI0JVKWTOoFn6cvPk32SZcs5CUtwic3nduc",
"access_token": "eyJhbGciOiJIUzI1NiIsImtpZCI6Imp3dF9zeW1tZXRyaWNfa2V5X2RldiJ9.eyJ1c2VyaWQiOiI1TUhETFlQM1hTRksiLCJleHAiOjE0ODc1NzM0MjEsInNjb3BlIjpbXSwiY2xpZW50X2lkIjoiY1kxanJta0F4T0labW5zbDlYWDdKblVEbVRFRExjRngiLCJncmFudF9pZCI6InZPSk9BcElkZVQyekdkWlViMWZvb0psSmVMSHl0NldyIiwiYXVkIjoiaHR0cHM6Ly9hdXRvZGVzay5jb20vYXVkL2p3dGV4cDMwIiwianRpIjoiY0Q5UmNUM3ZZRG5tODdud2praTN2U2JOQlZPMTl1emxjc28wZWlRMjdZUXExcXpaaUlvZzVyQ3NDV0xqVXRjUSJ9.j0HbmjfujNqBUaOzaAFvDHVUpoiCZmeXVTZrBjT1la0"
}
Show More
