Does Canva rotate refresh tokens and revoke access tokens immediately when OAuth scopes are reduced?

When building an integration against the Canva Connect API, teams must decide how to enforce least-privilege access over time. The OAuth 2.0 authorization code flow lets an app request specific scopes, but those scopes operate at the resource level rather than the record level. Because access tokens are short-lived, an integration must store and use refresh tokens to maintain sessions. The uncertainty is that public documentation does not clearly define whether refresh tokens are rotated on each exchange, what their maximum lifetime is, or whether a token revocation endpoint exists to invalidate outstanding credentials immediately. In addition, reducing an app's granted scopes may not retroactively invalidate tokens issued earlier, so a least-privilege reduction can lag behind actual credential validity. Since token policies can be version-sensitive, behavior should be confirmed against the specific Canva Connect API version in use.

Does Canva rotate refresh tokens on every token exchange, and is replay of an old refresh token rejected? Is there a documented revocation mechanism that immediately disables access tokens when a user disconnects the integration? Do changes to an app's OAuth scopes invalidate previously issued tokens, or must the integration wait for natural expiry?