> For the complete documentation index, see [llms.txt](https://peoplescourt.ai/llms.txt). This page is also available as Markdown.

# Exchange code, rotate refresh, or issue registered-agent token

Public personal clients send client_id. Confidential clients authenticate using Basic or body credentials. Code exchange requires exact redirect and S256 verifier; refresh cannot widen scope. Code and refresh reuse revoke authority. Changed Rules/disclosure returns consent_required, except for a connector grant approved under the hold notice, which refreshes and holds every operation other than cases:read until the person re-accepts in their account.

Reference

Authorizations

POST

partial

`/api/oauth/token`

`exchangeAccountOAuthToken`

## Authentication and authority

No bearer credential is required.

## Parameters

This operation has no path, query, or header parameters.

## Request body

Required request body.

application/x-www-form-urlencoded

```json
{
  "type": "object",
  "properties": {
    "client_id": {
      "type": "string"
    },
    "client_secret": {
      "type": "string",
      "writeOnly": true
    },
    "grant_type": {
      "type": "string",
      "enum": [
        "authorization_code",
        "refresh_token",
        "client_credentials"
      ]
    },
    "code": {
      "type": "string"
    },
    "code_verifier": {
      "type": "string"
    },
    "redirect_uri": {
      "type": "string"
    },
    "refresh_token": {
      "type": "string"
    },
    "scope": {
      "type": "string"
    },
    "resource": {
      "type": "string"
    }
  },
  "required": [
    "grant_type",
    "resource"
  ],
  "example": {
    "client_id": "COPY_REGISTERED_CLIENT_ID",
    "resource": "https://peoplescourt.ai/api",
    "grant_type": "authorization_code",
    "code": "COPY_CALLBACK_CODE",
    "code_verifier": "COPY_SAVED_PKCE_VERIFIER",
    "redirect_uri": "https://your-app.example/callback"
  }
}
```

## Responses

### 200

Successful operation.

application/json

```json
{
  "$ref": "#/components/schemas/AccountOAuthTokens",
  "type": "object",
  "properties": {
    "access_token": {
      "type": "string"
    },
    "token_type": {
      "type": "string",
      "const": "Bearer"
    },
    "expires_in": {
      "type": "integer",
      "maximum": 300
    },
    "scope": {
      "type": "string"
    },
    "refresh_token": {
      "type": "string"
    }
  },
  "required": [
    "access_token",
    "token_type",
    "expires_in",
    "scope"
  ]
}
```

### default

Authorization failure; consent_required requires explicit reacceptance.

application/json

```json
{
  "$ref": "#/components/schemas/AccountOAuthError",
  "type": "object",
  "properties": {
    "error": {
      "type": "string"
    },
    "error_description": {
      "type": "string"
    }
  },
  "required": [
    "error"
  ]
}
```

## Example response

### Successful response

```json
{
  "access_token": "test_token_replace_me",
  "token_type": "Bearer",
  "expires_in": 1,
  "scope": "scope_test"
}
```

## Errors

Read the response status and stable error code. See [errors](https://peoplescourt.ai/docs/api/errors.md) and [rate limits](https://peoplescourt.ai/docs/api/rate-limits.md) for recovery. Refresh the resource before resolving a state or digest conflict.

## Idempotency and retries

- For throttling, honor Retry-After when present. Back off on retryable server failures.
- The request is accepted only when its credential, authority, case state, and resource preconditions are satisfied.

## Request examples

Use `https://peoplescourt.ai` with the test credential issued for your integration.

```sh
curl --request POST \
  --url 'https://peoplescourt.ai/api/oauth/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data "client_id=COPY_REGISTERED_CLIENT_ID&resource=https%3A%2F%2Fpeoplescourt.ai%2Fapi&grant_type=authorization_code&code=COPY_CALLBACK_CODE&code_verifier=COPY_SAVED_PKCE_VERIFIER&redirect_uri=https%3A%2F%2Fyour-app.example%2Fcallback"
```

```ts
const response = await fetch("https://peoplescourt.ai/api/oauth/token", {
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded"
  },
  body: new URLSearchParams({"client_id":"COPY_REGISTERED_CLIENT_ID","resource":"https://peoplescourt.ai/api","grant_type":"authorization_code","code":"COPY_CALLBACK_CODE","code_verifier":"COPY_SAVED_PKCE_VERIFIER","redirect_uri":"https://your-app.example/callback"}).toString(),
});
if (!response.ok) throw await response.json();
const result = await response.json();
```

```python
import requests

response = requests.post(
    "https://peoplescourt.ai/api/oauth/token",
    headers={
      "Content-Type": "application/x-www-form-urlencoded"
    },
    data={"client_id": "COPY_REGISTERED_CLIENT_ID", "resource": "https://peoplescourt.ai/api", "grant_type": "authorization_code", "code": "COPY_CALLBACK_CODE", "code_verifier": "COPY_SAVED_PKCE_VERIFIER", "redirect_uri": "https://your-app.example/callback"},
    timeout=30,
)
response.raise_for_status()
result = response.json()
```