Refresh a branded guest session

POST /v1/developer/guest-auth/session/refresh

Operation ID: refreshDeveloperGuestSession

Exchanges a BFF-held Kismet refresh token for a new short-lived guest access token after re-authorizing the Developer installation, same-origin CSRF proof, and branded host. The refresh token remains server-side and is not rotated in this contract version.

Contract status

Field	Value
Maturity	`beta`
Required capability	`guest_auth.write`
Freshness class	`authenticated-state`
Quota cost	`1`
Operational owner	Identity + Developer Experience

All operations require a Kismet Developer Bearer credential. Collection and resource authority is resolved from the credential’s installation grants; identifiers in the URL never grant access.

Request parameters

Name	In	Type	Required	Description
`x-kismet-csrf`	header	string	yes	Opaque CSRF proof validated by the same-origin host BFF before it calls Kismet. Never a Kismet credential.
`origin`	header	string	no	Original branded browser origin forwarded by the same-origin BFF. Must match Collection.authorizedDomains.
`x-forwarded-host`	header	string	no	Original branded host fallback for server route handlers that do not forward Origin. Must match Collection.authorizedDomains.

Request body

The request body is JSON. The canonical schema is:

{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "refreshToken"
  ],
  "properties": {
    "refreshToken": {
      "type": "string",
      "minLength": 1,
      "maxLength": 4096
    }
  }
}

Minimal example:

{
  "refreshToken": "BFF_HELD_REFRESH_TOKEN"
}

cURL

curl --request POST \
  "$KISMET_API_ORIGIN/v1/developer/guest-auth/session/refresh" \
  --header "Authorization: Bearer $KISMET_DEVELOPER_API_KEY" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data '{"refreshToken":"BFF_HELD_REFRESH_TOKEN"}'

Responses

Status	Meaning
200	Success.
400	Invalid request parameters or body.
401	Missing, invalid, expired, or inappropriate credential/session.
403	Credential lacks the required grant/capability, or an origin/CSRF check failed.
429	Rate limit or quota exceeded; inspect response metadata before retrying.
503	A required Kismet dependency is temporarily unavailable.

Success example

{
  "session": {
    "accessToken": "<server-only-refreshed-access-token>",
    "expiresAt": "2026-08-18T18:15:00.000Z"
  }
}