ApiAuthRefresh

Rotate the refresh token

Rotates the refresh token and issues a fresh access token. The current `peridot_refresh` cookie is **invalidated** and replaced with a new one (rotation), so each refresh token can be used exactly once. - 401 if the refresh token is missing, expired, already rotated, or forged. - Rate limited to 10 requests / minute.

POST
/auth/refresh

Rotates the refresh token and issues a fresh access token. The current peridot_refresh cookie is invalidated and replaced with a new one (rotation), so each refresh token can be used exactly once.

  • 401 if the refresh token is missing, expired, already rotated, or forged.
  • Rate limited to 10 requests / minute.

Response Body

application/json

application/json

curl -X POST "https://example.com/auth/refresh"
Empty

Log out POST

Revokes the current refresh token and clears both session cookies. Idempotent — safe to call when already logged out.

Get the current identity GET

Returns the identity of the authenticated user. The identity ID is stable across every product in the Peridot ecosystem.