router.post("/api/tokens/{token_id}/refresh-at")
nothing calls this directly
no outgoing calls
no test coverage detected