Refresh token API call flow
API historyThis API allows to renew access token for 90 days access to account using refresh token.
Step 1: Renew old access token for new one with valid refresh token
Initiate POST requests for Refresh token with valid refresh token:
Refresh token
Version1
|
URL LIVE
URL SANDBOX
|
POST https://api.csob.sk/identity-server/connect/token/refresh
POST https://api.csob.sk/identity-server-test/connect/token/refresh
|
Validity of access tokens based on SCA (90 days access to accounts) is due to security reasons limited to 20 min. These access tokens can be renewed using refresh tokens which are valid for 90 days. By calling this service, new access token and new refresh token with te same time validity as old one are issued. On API Explorer web site there is a possibility to test API online (Try it) and download API definition (WADL, Open API).
Request:
Header
Attributes structure
|
Optionality
|
Type
|
Description
|
Content-Type
|
Mandatory
|
String
|
application/x-www-form-urlencoded;charset=UTF-8
|
Request parameters
Version1
|
grant_type={grant_type}&client_id={client_id}&client_secret={client_secret}&refresh_token={refresh_token} |
Attributes structure |
Optionality |
Type |
Description |
grant_type |
Mandatory |
String |
Value is „refresh_token“ |
client_id |
Mandatory |
String |
TPP ID obtained from enrollment |
client_secret |
Mandatory |
String |
Secret obtained from enrollment |
refresh_token |
Mandatory |
String |
Valid refresh token obtained from authorization code |
Response:
Attributes structure |
Optionality |
Type |
Description |
access_token |
Mandatory |
String |
Renewed access token |
expires_in |
Mandatory |
String |
Validity of access token in seconds |
token_type |
Mandatory |
String |
Value is „Bearer“ |
refresh_token |
Optional |
String |
New refresh token with the same time validity as the old one |
Example:
Request
POST https://api.csob.sk/identity-server/connect/token/refresh HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 172
Host: api.csob.sk
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
grant_type=refresh_token&client_id=TIDgjzKuS7k&client_secret=xxryTJUjquusiG9TeqxxeT7UxUvK42bd&refresh_token=eab1ffc4b4f562f58c0212be690bc74e80bab2905a6e15118df44fef6fe91269
Response
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: application/json
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server-Process-ID: efPt37g5yQxHwP7jSiCepCt68LYmU8Sx
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Thu, 28 Mar 2019 16:01:30 GMT
{
"access_token": "56f582f2630359764582fae036e23a637b17a9a345f92083f3f2e6927a3024de",
"expires_in": 1200,
"token_type": "Bearer",
"refresh_token": "ed4371699838770cbabb46fe1a8f29629bc1c3041d11d6a99df98298861084f1"
}