POST /_api/oauth/refresh accepts JSON with refresh_token. A missing field returns 400; an invalid or expired token returns 401. On success, data contains access_token, token_type, expires_in, refresh_token and scope. Renewal calls oauth2_renovar_token().
/_api/oauth/ without refresh redirects to oauth-authenticate/. The scope field is issued, but api_authenticate() does not check scopes per endpoint. Use profile permissions and each handler's contract; see authentication and OAuth2.