## Refreshing the access token

An OAuth access token has a specified lifetime (expiration) of 12 hours. The refresh token, on the other hand, is long-lived, and can be used to obtain a new access token as long as it is not revoked. If the access token is not refreshed, the administrator must authorize access to the web services again. See Authorizing an application to call Symantec Endpoint Protection Manager web services.

To refresh the access token

1. Include the refresh token in a query parameter, as in the following example:

   GET https://hostname:port_number/sepm/oauth/​token?grant_type=refresh_token&client_id=client_id&​client_secret=client_secret&​redirect_uri=https://hostname:port_number/sepm&refresh_token=refresh_token

   where client_id and client_secret are the client ID and client secret that were obtained when the remote management application was registered with Symantec Endpoint Protection Manager, and where the value of refresh_token is the value that was returned when the access token request was made.

   The new access token is returned as a JSON formatted object, like the access token that is returned from a request that is issued with an authorization code (grant_type=authorization_code).

2. Include the new access token in your web service calls. See Including the OAuth token in calls to web services.

See Using OAuth with Symantec Endpoint Protection Manager web services.

See Getting an OAuth access token from the authorization code.