SAMPLE EVIDENCE for PD-01 (made-up app Tidyhaus; not a real review)

Old refresh token -> HTTP 400. Old access token on /rest/v1/bookings -> HTTP 200, [].