> ## Documentation Index
> Fetch the complete documentation index at: https://www.everbility.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange Partner Token

> Exchange an authorization code (with its PKCE code_verifier) or a refresh token for a new access and refresh token pair. Accepts form-encoded or JSON bodies. Refresh tokens are single use: each refresh returns a new pair and revokes the previous access token. Reusing a consumed refresh token revokes the whole connection and requires re-authorization by a practice admin.



## OpenAPI

````yaml /developer-docs/api/openapi.json post /v1/partner/oauth/token
openapi: 3.1.0
info:
  title: Everbility Public API
  version: 1.0.0
  description: >-
    Pull reports from Everbility, upload notes and files, poll asynchronous
    jobs, and generate reports from saved templates. Partner endpoints let
    approved platforms connect practices with OAuth 2.0, launch report-writing
    sessions, receive signed lifecycle webhooks, and retrieve completed
    documents.
servers:
  - url: https://api.everbility.com
    description: Production
security:
  - bearerAuth: []
paths:
  /v1/partner/oauth/token:
    post:
      tags:
        - partner
      summary: Exchange Partner Token
      description: >-
        Exchange an authorization code (with its PKCE code_verifier) or a
        refresh token for a new access and refresh token pair. Accepts
        form-encoded or JSON bodies. Refresh tokens are single use: each refresh
        returns a new pair and revokes the previous access token. Reusing a
        consumed refresh token revokes the whole connection and requires
        re-authorization by a practice admin.
      operationId: exchange_partner_token_v1_partner_oauth_token_post
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PartnerTokenRequest'
          application/json:
            schema:
              $ref: '#/components/schemas/PartnerTokenRequest'
      responses:
        '200':
          description: >-
            New token pair. The access token lasts 1 hour, the refresh token 90
            days.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PartnerTokenResponse'
        '400':
          description: Invalid code, verifier, redirect_uri, or grant_type.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PartnerErrorResponse'
              example:
                detail: Invalid authorization code
        '401':
          description: >-
            Invalid client credentials, or invalid, reused, or expired refresh
            token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PartnerErrorResponse'
              example:
                detail: Refresh token reuse detected
      security: []
components:
  schemas:
    PartnerTokenRequest:
      type: object
      title: PartnerTokenRequest
      description: >-
        Token request. Send as application/x-www-form-urlencoded or
        application/json. Fields beyond grant_type, client_id, and client_secret
        depend on the grant type.
      properties:
        grant_type:
          type: string
          enum:
            - authorization_code
            - refresh_token
          title: Grant Type
        client_id:
          type: string
          title: Client Id
          description: Your partner app's OAuth client ID.
        client_secret:
          type: string
          title: Client Secret
          description: Your partner app's OAuth client secret. Server-side only.
        code:
          type: string
          title: Code
          description: >-
            Authorization code from the consent callback. Required for
            grant_type=authorization_code. Single use, expires after 5 minutes.
        redirect_uri:
          type: string
          title: Redirect Uri
          description: >-
            Must exactly match the registered redirect URI. Required for
            grant_type=authorization_code.
        code_verifier:
          type: string
          title: Code Verifier
          pattern: ^[A-Za-z0-9\-._~]{43,128}$
          description: >-
            PKCE code verifier whose S256 challenge was sent to the consent
            page. Required for grant_type=authorization_code.
        refresh_token:
          type: string
          title: Refresh Token
          description: >-
            Current refresh token. Required for grant_type=refresh_token. Single
            use — a new pair is returned.
      required:
        - grant_type
        - client_id
        - client_secret
    PartnerTokenResponse:
      type: object
      title: PartnerTokenResponse
      properties:
        access_token:
          type: string
          title: Access Token
          description: Opaque bearer token for partner endpoints. Valid for 1 hour.
        refresh_token:
          type: string
          title: Refresh Token
          description: Single-use refresh token. Valid for 90 days.
        token_type:
          type: string
          enum:
            - Bearer
          title: Token Type
          default: Bearer
        expires_in:
          type: integer
          title: Expires In
          description: Access token lifetime in seconds (3600).
      required:
        - access_token
        - refresh_token
        - token_type
        - expires_in
      example:
        access_token: pat_Zl9nB1qFhOQe2kQ4rW8xJ3Ty
        refresh_token: prt_M4kQ9wY2eXvB7cJ1sL6pR8Ud
        token_type: Bearer
        expires_in: 3600
    PartnerErrorResponse:
      type: object
      title: PartnerErrorResponse
      properties:
        detail:
          type: string
          title: Detail
          description: Human-readable error code or message.
      required:
        - detail
      example:
        detail: Invalid authorization code
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: >-
        Use a Clerk-backed Everbility user or organisation API key directly as
        the bearer token.

````