Skip to main content
POST
Refresh user profile data

Authorizations

x-access-token
string
header
required

JWT token passed in x-access-token header

Body

application/json
brandingId
string

Optional branded-link hint — the institution publicId from a /login?brandingId= link opened while this session was still valid. When the caller is an active member of that twin (or a platform operator) and the twin's account is active, the active institution is switched before the profile is built; the outcome is reported in brandingSwitch. Never grants access.

Response

Profile refreshed successfully

success
boolean

Whether the operation was successful

token
string

Fresh JWT token (sliding session). Each profile refresh extends the session by the configured expiration period (default 6 hours). Store this token and use it for subsequent API requests.

profile
object

Full user profile object (User model fields merged with populated institution, plus Google OAuth flags). Sensitive fields (password, permissions, __v, created) are stripped.

brandingSwitch
object

Outcome of a branded-link switch attempt. Present only when the request carried a brandingId (an institution publicId from a /login?brandingId= link). The hint never grants access: switched requires an active membership on the twin (or platform-operator status) and an active parent account. Clients clear the stored hint on switched/already and show the no-access notice on refused.