Authorization

Supply the single-use renewal credential in the request body. It is bound to a managed session and registered application.

Valid managed-session renewal credential

Request headers

Content-Typeapplication/json: Encode the request body as JSON.

Request body

applicationIdstring · required: Registered application bound to this managed session.
renewalTokenstring · required: Opaque single-use renewal token. Rotate atomically and replace it with the returned token.

Response

200OK

Returns the authorized resource or result for this operation. List results use items, nextCursor, and hasMore.

Behavior to account for

Managed sessions only. The renewal credential is presented in the request body, not in an Authorization header. Rotate once, revoke the family on reuse, and never log or persist tokens in browser storage.

Errors

Authentication failures return 401 or 403. Inaccessible resources return 404. Business and idempotency conflicts return 409. Rate limits return 429 with retry guidance.

Error handling guide

curl --request POST 'https://api.wincora.com/api/v1/auth/token-renewals' \ --header 'Content-Type: application/json' \ --data '{ "applicationId": "app_example", "renewalToken": "YOUR_SINGLE_USE_RENEWAL_TOKEN" }'

const response = await fetch('https://api.wincora.com/api/v1/auth/token-renewals', { method: 'POST', headers: { "Content-Type": "application/json" }, body: JSON.stringify({ "applicationId": "app_example", "renewalToken": "YOUR_SINGLE_USE_RENEWAL_TOKEN" }) }); if (!response.ok) throw new Error(await response.text()); const result = await response.json();

import os import requests response = requests.request( 'POST', 'https://api.wincora.com/api/v1/auth/token-renewals', headers={ "Content-Type": "application/json" }, json={ "applicationId": "app_example", "renewalToken": "YOUR_SINGLE_USE_RENEWAL_TOKEN" }, timeout=30, ) response.raise_for_status() result = response.json()

{ "sessionId": "session_example", "accessToken": "CUSTOMER_ACCESS_TOKEN", "tokenType": "Bearer", "expiresIn": 300, "scopes": [ "traveler:profile:read", "traveler:cases:read" ], "renewalToken": "REPLACEMENT_RENEWAL_TOKEN", "renewalExpiresIn": 28500 }