oauth_refresh_tokens

{“what”:“Cryptographic hash of the refresh token string; the row’s primary key.”,“why”:“Without it, the raw token cannot be looked up without storing it in plaintext.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.694636278+00:00”}

{“what”:“Identifier of the OAuth client that requested the token.”,“why”:“Without it, a token cannot be tied to its originating client for validation or revocation.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.712182821+00:00”}

{“what”:“Identifier of the user who authorized the token.”,“why”:“Without it, tokens cannot be associated with a user for account-level revocation.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.749249422+00:00”}

{“what”:“Space-separated list of granted OAuth scopes.”,“why”:“Without it, the token’s allowed permissions are undefined.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.763429958+00:00”}

{“what”:“UTC timestamp when the token was issued.”,“why”:“Without it, token age cannot be computed for rotation or cleanup.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.778217088+00:00”}

{“what”:“UTC timestamp after which the token is no longer valid.”,“why”:“Without it, expired tokens would be accepted indefinitely.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.794206770+00:00”}

{“what”:“Hash of the token that was rotated to create this one; null for first token.”,“why”:“Without it, token rotation chains cannot be followed to invalidate old tokens.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.827385382+00:00”}

{“what”:“Hash of the token that replaced this one after rotation; null if not yet rotated.”,“why”:“Without it, the system cannot know which token superseded this one for revocation.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.840542279+00:00”}

{“what”:“Boolean flag indicating whether the token has been revoked.”,“why”:“Without it, a revoked token cannot be distinguished from an active one.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.854409596+00:00”}

{“what”:“UTC timestamp when the token was revoked; null if not revoked.”,“why”:“Without it, the time of revocation is unknown, preventing audit and cleanup.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:47.871051182+00:00”}