APG PayAPG Paydocs

Identity

Update sessions

PATCH/sessions

Act in a different domain, which needs your session's bearer, or trade a refresh token for a new bearer, which needs no credential. See below.

2 actionsSessUpdateRefreshSessUpdateSelectDomain

Permissions

Required permission
sessions:create

Requires the `create` action on `sessions` for the supplied runtime context

Request body

This body is a typed union. Pick a variant to see its fields and a matching example.

Discriminated by type
type = "SessUpdateRefresh"
refreshTokenstringrequired

Example tok_9f2Kd8QpLzXwR4mN

curl -X PATCH https://api.tst.au.apgpay.dev/sessions \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "type": "SessUpdateRefresh",
  "refreshToken": "tok_9f2Kd8QpLzXwR4mN"
}'

Responses

The response is a tagged shape: type is always "SessUpdateRspAttributes". Switch on it; subtypes can be added, and a client that already reads it will not break.

Discriminated by type
type = "SessUpdateRspAttributes"

The resource as it stands after the change.

Example
{
  "type": "SessUpdateRspAttributes",
  "updated": {
    "type": "SessViewAuthenticated",
    "userId": "user_9f2Kd8QpLzXw",
    "displayName": "Ada Lovelace",
    "activeDomain": {
      "type": "SessDomainAttributes",
      "domain": {
        "type": "UserDomainAnonymous",
        "restrictedTo": {
          "type": "UserDomainCustomer",
          "customerId": "cust_9f2Kd8QpLzXw"
        }
      },
      "description": "string"
    },
    "roleIds": [
      "role_9f2Kd8QpLzXw"
    ],
    "capabilities": [
      {
        "type": "SessCapabilityAttributes",
        "resource": "BlockedCard",
        "actions": [
          "Create"
        ]
      }
    ],
    "rbacHash": "string",
    "directDebitAccountKinds": [
      "Au"
    ],
    "expiresAt": "2026-08-19T04:21:07Z"
  }
}

Error responses