post https://public-api.demo.spendesk.com/v1/oauth2/token/refresh
Request new access and refresh tokens. Upon requesting new tokens, both old access_token and refresh_token values will be invalidated - make sure you update the refresh_token in your database every time you call this endpoint.
New refresh tokens should be requested at least once every 30 days (daily or weekly is fine) in order to keep the connection alive.
If you get a 401 or 403 response, delete the old refresh token and disconnect the user.