Session and tokens

Get a new user token from a refresh token

Refreshes the X-token without making the person log in again. Read the expiry from the response rather than assuming one.

GET/v3/profile/account/request/token

Authorizations

Authorizationbearer tokenRequired

The accessToken from POST /api/hiecm/gateway/v3/sessions. Send it as Authorization: Bearer <ACCESS_TOKEN>.

Headers

REQUEST-IDstringRequired

Unique UUID v4 per request. Used for idempotency and distributed tracing. Generate a fresh UUID for every call.

TIMESTAMPstringRequired

ISO 8601 UTC timestamp of the request.

R-tokenstringRequired

The refresh token, sent when asking for a new user token without making the person log in again. Required for token refresh. See the shared RToken parameter for the general description.

Responses

200

The user token and refresh token, with their expiries.

400

Bad Request, invalid scope, loginHint, or encrypted field

Error codes for this module

401

Unauthorized, missing, invalid, or expired Bearer token

Everything returns 401

403

Forbidden, the token is valid but not permitted for this operation

Error codes for this module

500

Server error, retry

Error codes for this module

Get a new user token from a refresh token

curl --request GET \
  --url https://abhasbx.abdm.gov.in/abha/api/v3/profile/account/request/token \
  --header 'Authorization: Bearer <ACCESS_TOKEN_FROM_SESSIONS_CALL>' \
  --header 'REQUEST-ID: <REQUEST_ID>' \
  --header 'TIMESTAMP: <TIMESTAMP>' \
  --header 'R-token: <R_TOKEN>'

{
  "token": "<TOKEN>",
  "expiresIn": 0,
  "refreshToken": "<REFRESH_TOKEN>",
  "refreshExpiresIn": 0
}

Generated from the schema. The values are placeholders, not a captured response.