Refresh access

RefreshAccess exchanges the refresh cookie for a new access token. The refresh token is read from the cookie and never appears in a request or a response body: the credential that lasts a month is not one a caller should be able to copy out of a log.

curl -X POST "https://example.com/api/v1/auth/refresh" \  -H "Content-Type: application/json" \  -d '{}'

{  "accessToken": "string",  "accessTokenExpiresAt": "string"}