As a user I would like to GET a list of all my refresh tokens
As an administrator I would like to be able to get a list of user refresh token such that I can remove them.
Have you ever seen an api that list all active refresh tokens?
You’re right, the refresh token does not need to be in the response body, only the client_id should be necessary.
I pushed a new version without the token in the response