> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange an authorization code or rotate a refresh token



## OpenAPI

````yaml /api-reference/openapi.json post /oauth/token
openapi: 3.0.0
info:
  title: AIRCTRL API
  description: >-
    Programmatic access to AIRCTRL. Record values are encrypted by the client,
    so the API stores ciphertext and encrypted keys instead of plaintext record
    values.
  version: '1'
  contact: {}
servers:
  - url: https://api.airctrl.dev/v1
    description: Production
  - url: https://api.staging.airctrl.dev/v1
    description: QA
security: []
tags:
  - name: Context
    description: Find the accounts available to the caller.
  - name: Projects
    description: Create and manage projects.
  - name: Records
    description: Store and use client-encrypted records.
  - name: Audit
    description: Read record activity and access history.
  - name: Providers
    description: Discover supported AI providers.
  - name: Provider Credentials
    description: Manage encrypted provider credentials.
  - name: Gateways
    description: Create and operate AI gateways.
  - name: Usage
    description: Read gateway usage and spend data.
  - name: Service Accounts
    description: Read Service Account metadata and grant records.
paths:
  /oauth/token:
    post:
      tags:
        - OAuth
      summary: Exchange an authorization code or rotate a refresh token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  enum:
                    - authorization_code
                    - refresh_token
                code:
                  type: string
                redirect_uri:
                  type: string
                  format: uri
                code_verifier:
                  type: string
                refresh_token:
                  type: string
              required:
                - grant_type
      responses:
        '200':
          description: Opaque access token and optional rotating refresh token.
          content:
            application/json:
              schema:
                type: object
                required:
                  - access_token
                  - token_type
                  - expires_in
                  - scope
                properties:
                  access_token:
                    type: string
                    writeOnly: true
                  token_type:
                    type: string
                    enum:
                      - Bearer
                  expires_in:
                    type: integer
                    minimum: 1
                  refresh_token:
                    type: string
                    writeOnly: true
                  scope:
                    type: string
        '400':
          description: OAuth error response (`error` and `error_description`).
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    oneOf:
                      - type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          message:
                            type: string
                        required:
                          - code
                          - message
                  code:
                    type: string
                  message:
                    type: string
                  error_description:
                    type: string
                  requestId:
                    type: string
                additionalProperties: true
        '401':
          description: Invalid confidential client authentication.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    oneOf:
                      - type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          message:
                            type: string
                        required:
                          - code
                          - message
                  code:
                    type: string
                  message:
                    type: string
                  error_description:
                    type: string
                  requestId:
                    type: string
                additionalProperties: true
        '429':
          description: Token endpoint rate limit exceeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    oneOf:
                      - type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          message:
                            type: string
                        required:
                          - code
                          - message
                  code:
                    type: string
                  message:
                    type: string
                  error_description:
                    type: string
                  requestId:
                    type: string
                additionalProperties: true
      security:
        - oauthClientSecretBasic: []
components:
  securitySchemes:
    oauthClientSecretBasic:
      type: http
      scheme: basic
      description: OAuth confidential client id and client secret.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.