PWA ODATA Refresh Account

I have a customer that is trying to connect to an On-Prem PWA ODATA using a refresh acccount.  Currently it is failing.  What is the least amount of privildges this account should have on Project Server for this to work correctly?