I'm assuming that you have already found the information you are looking for, however for the future benefit of the community I'll provide some details. The Refresh Token that you obtain from the BlueXP services page is a global token for the entire account. If you want to use principles of least privilege, I recommend using a service account in BlueXP Identity and Access Management (IAM). When using a service account you can grant privileges at the Project or folder level to prevent the account from accessing other projects/folders via the BlueXP API.
Access BlueXP IAM by selecting the Gear icon in the upper right corner, choosing "Identity and Access Management" and selecting the "Members" tab. Choose "Add a Member" and select the radio button for service account. Select the level you want to grant access for the service account, along with the role and Add it. Don't forget to copy and save the Client ID and secret in a safe place, you only have one opportunity to save it.
