REST API: OIDC token refresh_token response includes new refresh token when it should not

In the documentation for authentication, netcup states:

Zitat

Refresh access token

• The offline refresh token can be used multiple times and does not expire as long as it is used at least once every 30 days.

Code

curl '.../realms/scp/protocol/openid-connect/token' \
  -d 'client_id=scp'\
  -d 'refresh_token=<refresh_token>' \
  -d 'grant_type=refresh_token'  | jq

The documentation wording makes me believe netcup's intent is that the original refresh token continues to be valid in perpetuity as long as it is used at least once every 30 days. That should mean it is not necessary to issue a new refresh token in the response for this endpoint. See:

Zitat von https://www.oauth.com/oauth2-servers/access-tokens/refreshing-access-tokens/

The response to the refresh token grant is the same as when issuing an access token. You can optionally issue a new refresh token in the response, or if you don’t include a new refresh token, the client assumes the current refresh token will continue to be valid.

and

Zitat von https://datatracker.ietf.org/doc/html/rfc6749#section-1.5

(H) The authorization server authenticates the client and validates

the refresh token, and if valid, issues a new access token (and,

optionally, a new refresh token).

However, this endpoint provides a response that includes the following key-values, including a new `refresh_token` which does not match behavior expected by documentation:

$ curl -s 'https://servercontrolpanel.de/realms/scp/protocol/openid-connect/token' \
  -d 'client_id=scp'\
  -d 'refresh_token=<refresh jwt 1>' \
  -d 'grant_type=refresh_token'  | jq
{
  "access_token": "...",
  "expires_in": 300,
  "refresh_expires_in": 0,
  "refresh_token": "???? ???? refresh jwt 2 ???? ????",
  "token_type": "Bearer",
  "id_token": "..."
  "not-before-policy": 0,
  "session_state": "...",
  "scope": "openid profile offline_access email"
}