MANSOQ Knowledge
← This release collection

IT & Integrations · VERSION 912828b3

Read refresh inputs, rotation and refusals

Find the required refresh input, recognize the rotating response and distinguish documented input and token refusals.

IT administrator · Integration engineer · Developer

The expanded refresh operation describes signed refresh exchange, configured rotation, temporary/logout-invalidated refusals and the separate tenant-session handler. Request Schema requires one write-only refresh string.123
Recorded release 912828b3 · 2026-10-19 · 1728 × 921

Read the required refresh string

Capture details

Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The expanded refresh operation describes signed refresh exchange, configured rotation, temporary/logout-invalidated refusals and the separate tenant-session handler. Request Schema requires one write-only refresh string.

Image SHA-256 cd90569ba9c9e35fac228a3afbb5d2f6ae1632de7e8dfcd9b456cd4363f52de7

  1. Exact refresh path: Confirm POST /api/v1/auth/token/refresh/.
  2. Read the deployment boundary: The operation description distinguishes base refresh from tenant-session refresh.
  3. Required write-only input: The star marks refresh as required; string is a type, not a real token.
The selected base profile shows required access and refresh strings in HTTP 200 Schema, with the required write-only refresh input above. These are typed definitions, not live JWT values.1234
Recorded release 912828b3 · 2026-10-19 · 1728 × 921

Read the rotating response types

Capture details

Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The selected base profile shows required access and refresh strings in HTTP 200 Schema, with the required write-only refresh input above. These are typed definitions, not live JWT values.

Image SHA-256 e0eb79a8d60517ef1b4fa409c247d1a4cd9c75414318768ef25a8d03dc294437

  1. Required refresh input: Supply the documented input through an authorized client, not this read-only viewer.
  2. Success status: Read the schema under the correct HTTP response code.
  3. New access string: The rotating response requires access.
  4. Rotated refresh string: This captured profile also requires refresh. A nonrotating deployment has a different generated response.
All three documented refresh refusal codes are visible: 400 with field-error/detail alternatives, 401 with detail/code strings and 403 with a detail string. The examples show types rather than actual server messages.123456
Recorded release 912828b3 · 2026-10-19 · 1728 × 921

Distinguish refresh failure contracts

Capture details

Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. All three documented refresh refusal codes are visible: 400 with field-error/detail alternatives, 401 with detail/code strings and 403 with a detail string. The examples show types rather than actual server messages.

Image SHA-256 746cd6cc6968f372b993a33cba0e5be7cdd77c647d35fe187f6753541b8bd83d

  1. Input failure 400: Read the One of alternatives for required-field or parser errors.
  2. Field error arrays: The field-error alternative needs at least one error property.
  3. Parser detail alternative: The second alternative requires a detail string.
  4. Signed-token failure 401: This response requires detail and code.
  5. Refusal 403: Temporary or custom logout-invalidated refresh can be refused.
  6. 403 detail string: Do not invent an access/refresh payload for a refused response.

6 of 6 content blocks have reviewed image alignment. Missing overview or prerequisite images remain open.

Before you begin

  • Use the reference for release 912828b3. Its source receipt and schema fingerprint identify this local documentation export; the API label and schema dialect are separate.
    The genuine privacy-minimized local documentation receipt shows full release 912828b3 commit/tree, OpenAPI 3.1, its schema fingerprint, 900 paths, 1,227 operations, 687 schema components and verified read-only zero-query rendering. It contains no local filesystem path.1234567
    Recorded release 912828b3 · 2026-10-19 · 1728 × 921

    Compare the exact documentation source

    Capture details

    Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The genuine privacy-minimized local documentation receipt shows full release 912828b3 commit/tree, OpenAPI 3.1, its schema fingerprint, 900 paths, 1,227 operations, 687 schema components and verified read-only zero-query rendering. It contains no local filesystem path.

    Image SHA-256 99de6c8b2ce55151bb26d366204657af1b66c26e48742b8502ba5f5b60bd54a2

    1. Full committed release: Compare the exact sourceCommit, not only a short label.
    2. Source tree: This is the retained committed Git tree.
    3. Exact schema fingerprint: Compare the complete SHA256 with the selected schema artifact.
    4. Read-only viewer: This describes documentation browsing, not request execution.
    5. Verified source count: All 1,817 core source blobs were checked against this release.
    6. Zero data queries: The documentation export did not query application data.
    7. Bounded scope: Endpoint execution, tenant compatibility and production deployment need separate evidence.
    The installed read-only Swagger reader shows the separate API 1.0.0 and OAS 3.1 labels and the auth operation group. Logout has a security marker; refresh and verify are separate paths. No credentials were entered.1234567
    Recorded release 912828b3 · 2026-10-19 · 1728 × 921

    Find the three auth operations safely

    Capture details

    Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The installed read-only Swagger reader shows the separate API 1.0.0 and OAS 3.1 labels and the auth operation group. Logout has a security marker; refresh and verify are separate paths. No credentials were entered.

    Image SHA-256 b3a5df58e18c5f9c47e13754d34a9c3a500c21ce9cba800d21c786967d28f23a

    1. Requests disabled: The reference banner states that requests are disabled.
    2. API label and dialect: API 1.0.0 and OAS 3.1 are separate from the Git release in the source receipt.
    3. Filter the auth group: Use the group filter to locate authentication contracts.
    4. Authenticated logout: Read this path separately from refresh and verify.
    5. Security requirement: The lock indicates that the logout operation declares authentication, not that this viewer has signed in.
    6. Refresh contract: Read the required input and rotation-specific response here.
    7. Verification contract: Read the limited token-validation contract here.
  • The reference is read-only. These frames show contract types and examples, not credentials or live request results. Actual calls and deployment-specific authorization require their own verified workflow.
    The installed read-only Swagger reader shows the separate API 1.0.0 and OAS 3.1 labels and the auth operation group. Logout has a security marker; refresh and verify are separate paths. No credentials were entered.1234567
    Recorded release 912828b3 · 2026-10-19 · 1728 × 921

    Find the three auth operations safely

    Capture details

    Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The installed read-only Swagger reader shows the separate API 1.0.0 and OAS 3.1 labels and the auth operation group. Logout has a security marker; refresh and verify are separate paths. No credentials were entered.

    Image SHA-256 b3a5df58e18c5f9c47e13754d34a9c3a500c21ce9cba800d21c786967d28f23a

    1. Requests disabled: The reference banner states that requests are disabled.
    2. API label and dialect: API 1.0.0 and OAS 3.1 are separate from the Git release in the source receipt.
    3. Filter the auth group: Use the group filter to locate authentication contracts.
    4. Authenticated logout: Read this path separately from refresh and verify.
    5. Security requirement: The lock indicates that the logout operation declares authentication, not that this viewer has signed in.
    6. Refresh contract: Read the required input and rotation-specific response here.
    7. Verification contract: Read the limited token-validation contract here.
    The expanded refresh operation describes signed refresh exchange, configured rotation, temporary/logout-invalidated refusals and the separate tenant-session handler. Request Schema requires one write-only refresh string.123
    Recorded release 912828b3 · 2026-10-19 · 1728 × 921

    Read the required refresh string

    Capture details

    Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The expanded refresh operation describes signed refresh exchange, configured rotation, temporary/logout-invalidated refusals and the separate tenant-session handler. Request Schema requires one write-only refresh string.

    Image SHA-256 cd90569ba9c9e35fac228a3afbb5d2f6ae1632de7e8dfcd9b456cd4363f52de7

    1. Exact refresh path: Confirm POST /api/v1/auth/token/refresh/.
    2. Read the deployment boundary: The operation description distinguishes base refresh from tenant-session refresh.
    3. Required write-only input: The star marks refresh as required; string is a type, not a real token.

1. Read the required refresh input

Open POST /api/v1/auth/token/refresh/ under auth. Request Schema requires one write-only refresh string. This base token endpoint does not declare an Authorization header. Never paste a real refresh token into a published teaching image. The read-only viewer does not submit this request.

The expanded refresh operation describes signed refresh exchange, configured rotation, temporary/logout-invalidated refusals and the separate tenant-session handler. Request Schema requires one write-only refresh string.123
Recorded release 912828b3 · 2026-10-19 · 1728 × 921

Read the required refresh string

Capture details

Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The expanded refresh operation describes signed refresh exchange, configured rotation, temporary/logout-invalidated refusals and the separate tenant-session handler. Request Schema requires one write-only refresh string.

Image SHA-256 cd90569ba9c9e35fac228a3afbb5d2f6ae1632de7e8dfcd9b456cd4363f52de7

  1. Exact refresh path: Confirm POST /api/v1/auth/token/refresh/.
  2. Read the deployment boundary: The operation description distinguishes base refresh from tenant-session refresh.
  3. Required write-only input: The star marks refresh as required; string is a type, not a real token.

2. Match the response to the deployment rotation setting

Read response 200 Schema. The captured base profile has refresh rotation enabled and requires access and refresh strings. A new refresh identifier was observed in the separate normal local API check. A nonrotating deployment returns access only and needs its own generated contract; do not assume the pictured rotating shape applies to every deployment. Rotation does not itself prove that every previous token or session was revoked.

The selected base profile shows required access and refresh strings in HTTP 200 Schema, with the required write-only refresh input above. These are typed definitions, not live JWT values.1234
Recorded release 912828b3 · 2026-10-19 · 1728 × 921

Read the rotating response types

Capture details

Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The selected base profile shows required access and refresh strings in HTTP 200 Schema, with the required write-only refresh input above. These are typed definitions, not live JWT values.

Image SHA-256 e0eb79a8d60517ef1b4fa409c247d1a4cd9c75414318768ef25a8d03dc294437

  1. Required refresh input: Supply the documented input through an authorized client, not this read-only viewer.
  2. Success status: Read the schema under the correct HTTP response code.
  3. New access string: The rotating response requires access.
  4. Rotated refresh string: This captured profile also requires refresh. A nonrotating deployment has a different generated response.

3. Handle failures and the tenant boundary

Expand the documented responses. HTTP 400 covers required-field and parser detail alternatives; HTTP 401 describes signed-token failures; HTTP 403 describes refused temporary or custom logout-invalidated refresh tokens. Read the description: tenant deployments resolve this route to a separate tenant-session refresh handler. The schema does not establish tenant launch access or a currently authorized clinical role.

All three documented refresh refusal codes are visible: 400 with field-error/detail alternatives, 401 with detail/code strings and 403 with a detail string. The examples show types rather than actual server messages.123456
Recorded release 912828b3 · 2026-10-19 · 1728 × 921

Distinguish refresh failure contracts

Capture details

Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. All three documented refresh refusal codes are visible: 400 with field-error/detail alternatives, 401 with detail/code strings and 403 with a detail string. The examples show types rather than actual server messages.

Image SHA-256 746cd6cc6968f372b993a33cba0e5be7cdd77c647d35fe187f6753541b8bd83d

  1. Input failure 400: Read the One of alternatives for required-field or parser errors.
  2. Field error arrays: The field-error alternative needs at least one error property.
  3. Parser detail alternative: The second alternative requires a detail string.
  4. Signed-token failure 401: This response requires detail and code.
  5. Refusal 403: Temporary or custom logout-invalidated refresh can be refused.
  6. 403 detail string: Do not invent an access/refresh payload for a refused response.
The expanded refresh operation describes signed refresh exchange, configured rotation, temporary/logout-invalidated refusals and the separate tenant-session handler. Request Schema requires one write-only refresh string.123
Recorded release 912828b3 · 2026-10-19 · 1728 × 921

Read the required refresh string

Capture details

Fresh genuine 1728×921 Chrome capture of the exact committed 912828b3 read-only API reference. No credentials were entered or endpoint requests submitted. The expanded refresh operation describes signed refresh exchange, configured rotation, temporary/logout-invalidated refusals and the separate tenant-session handler. Request Schema requires one write-only refresh string.

Image SHA-256 cd90569ba9c9e35fac228a3afbb5d2f6ae1632de7e8dfcd9b456cd4363f52de7

  1. Exact refresh path: Confirm POST /api/v1/auth/token/refresh/.
  2. Read the deployment boundary: The operation description distinguishes base refresh from tenant-session refresh.
  3. Required write-only input: The star marks refresh as required; string is a type, not a real token.

Source evidence

Every citation uses this exact committed version. The private source repository requires access.