HTTP 401 on Expired Gitter API Token

Gitter authenticates users via GitHub OAuth and issues access tokens that carry scope modifiers such as message:read for least‑privilege bot operation. The platform documentation states that these tokens expire after a fixed interval, typically 24 hours, or upon revocation, after which subsequent API calls return HTTP 401. The web interface prompts re‑authentication upon encountering an expired token, but the API does not automatically refresh the credential without user interaction. This behavior creates a gap for bots that depend on continuous API access without manual intervention.

The precise goal is to determine whether Gitter's OAuth access tokens for least‑privilege scoped applications are consistently treated the same as full‑access tokens regarding expiration, non‑refresh, and the interaction between token revocation and active WebSocket sessions. Particular attention is paid to whether scope granularity influences the refresh policy or if all tokens follow the same lifecycle.

Key uncertainties include whether revocation immediately terminates active WebSocket connections or allows them to persist until their next heartbeat, and if least‑privilege scopes such as message:read are subject to the same automatic‑refresh prohibition as broader tokens. Additionally, it is unclear if the 24‑hour expiration window is fixed across all OAuth application types or varies by deployment.

Does Gitter's API return HTTP 401 for all authenticated calls after the token's exp claim passes, regardless of scope? When a token is revoked via the GitHub OAuth revocation endpoint, do active WebSocket connections continue functioning until their next heartbeat or message exchange? Are least‑privilege scopes ('message:read', etc.) subject to the same expiration and non‑refresh behavior as full‑access tokens?