Short-lived access token / long-lived refresh token endpoints. On login (POST /minerva/api/doLogin) the response contains an accessToken, a refreshToken and their lifetimes. Send the access token as Authorization: Bearer <token> on API calls, and use the endpoints below to keep the session alive. Do not send the (possibly expired) access token as a Bearer header when calling these endpoints. The endpoints are served from /new_api/token.

1. Refresh the access token

Rotates the refresh token and returns a new access/refresh pair. The previous refresh token becomes invalid, so the returned refreshToken must replace the stored one. A 401 response means the refresh token is unknown, expired or was reused - the client should log in again.

1.1. HTTP request

POST /minerva/new_api/token/refresh HTTP/1.1

1.2. Request Fields

Path Type Description

refreshToken

String

the raw refresh token previously issued to the client

1.3. CURL sample

$ curl 'https://minerva-dev.lcsb.uni.lu/minerva/new_api/token/refresh' -X POST \
    -d '{"refreshToken":"mZmuRLXNW2QvZtrXGuTXx1hTOQMR2m5iSYe1fLZUrVU"}' \
    -H 'Content-Type: application/json'

1.4. HTTP response

HTTP/1.1 200 OK

1.5. Response Fields

Path Type Description

accessToken

String

short-lived bearer access token (send as 'Authorization: Bearer <token>')

refreshToken

String

new refresh token; the previous one is rotated away and must be replaced with this value

accessTokenExpiresAt

String

absolute access token expiration (ISO-8601 with zone offset)

refreshTokenExpiresAt

String

absolute refresh token expiration (ISO-8601 with zone offset)

accessTokenExpiresIn

Number

access token lifetime in seconds (prefer over the absolute value for scheduling refreshes)

refreshTokenExpiresIn

Number

refresh token (sliding inactivity window) lifetime in seconds

1.6. Sample Response

{
  "accessToken" : "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiIsImZpcnN0TmFtZSI6IiIsImxhc3ROYW1lIjoiIiwidHlwZSI6IkFDQ0VTUyIsImp0aSI6ImVmNGIxY2QxLTNlMTMtNDU5ZC1hNjg5LTAyOWFkNGNmMDRkNyIsImlhdCI6MTc5NDcwMTQ1NSwiZXhwIjoxNzk0NzAyMzU1fQ.wVsS4g5z1K87ovCxe35tyBH087E1Letpm0dUaoQWBGqtHSlpNtHfBSKxc5yun4L24v25yXegK-jc0g50uSjKfQ",
  "refreshToken" : "pF9A-8rsz58ejgakr1rxMoQS3VQqRjJtwVnMVGITM1g",
  "accessTokenExpiresAt" : "2026-11-15T00:25:55Z",
  "refreshTokenExpiresAt" : "2026-11-15T02:10:55Z",
  "accessTokenExpiresIn" : 900,
  "refreshTokenExpiresIn" : 7200
}

2. Revoke a refresh token (logout)

Revokes the whole rotation chain the refresh token belongs to and drops its outstanding access tokens.

2.1. HTTP request

POST /minerva/new_api/token/revoke HTTP/1.1

2.2. Request Fields

Path Type Description

refreshToken

String

the raw refresh token previously issued to the client

2.3. CURL sample

$ curl 'https://minerva-dev.lcsb.uni.lu/minerva/new_api/token/revoke' -X POST \
    -d '{"refreshToken":"WyAs4DwmM7Miean0aFq8xa5MvFqAYCQkVdl-8xN3c1U"}' \
    -H 'Content-Type: application/json'

2.4. HTTP response

HTTP/1.1 200 OK

2.5. Response Fields

Path Type Description

status

String

status message

2.6. Sample Response

{
  "status" : "OK"
}