> ## Documentation Index
> Fetch the complete documentation index at: https://docs.riftmap.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Refresh Token

> Refresh the access token using the refresh cookie. Rotates the refresh token.

Implements refresh-token reuse detection (SEC-20260420-006). Each session row
carries ``used_at`` (set on rotation) and ``replaced_by_id`` (forward chain
link). If a client presents a token whose row has ``used_at`` set, the token
is being replayed — either by an attacker who stole the cookie before the
legitimate client rotated it, or by a buggy client retrying the same token.
Either way we burn the entire rotation family so a stolen cookie is worth
at most one rotation cycle and the theft is loud.



## OpenAPI

````yaml /openapi.json post /api/v1/auth/refresh
openapi: 3.1.0
info:
  description: Change Impact Engine for multi-repo systems
  title: Riftmap
  version: 1.12.3
servers: []
security: []
paths:
  /api/v1/auth/refresh:
    post:
      tags:
        - auth
      summary: Refresh Token
      description: >-
        Refresh the access token using the refresh cookie. Rotates the refresh
        token.


        Implements refresh-token reuse detection (SEC-20260420-006). Each
        session row

        carries ``used_at`` (set on rotation) and ``replaced_by_id`` (forward
        chain

        link). If a client presents a token whose row has ``used_at`` set, the
        token

        is being replayed — either by an attacker who stole the cookie before
        the

        legitimate client rotated it, or by a buggy client retrying the same
        token.

        Either way we burn the entire rotation family so a stolen cookie is
        worth

        at most one rotation cycle and the theft is loud.
      operationId: refresh_token_api_v1_auth_refresh_post
      parameters:
        - in: cookie
          name: riftmap_refresh
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Riftmap Refresh
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties:
                  type: string
                title: Response Refresh Token Api V1 Auth Refresh Post
                type: object
          description: Successful Response
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object

````