See T13393. Almost all cluster instance queries are now driven by instances.state, but "Synchronize Services" still uses instances.queryinstances.

Most of the information this method provides is available elsewhere, but this method is currently the only source for OAuth token information.

The likely path forward is:

• Add OAuth token information to some new standalone call. This could be part of instances.state, but the policy/visibility behavior of this information is different from other instance state information and it's likely desirable to separate them.
• Swap the instances.queryinstances call to use the instance ref (possibly forcing a cache refresh first) for instance data, the new instances.authentication API (or whatever) for OAuth info, and then almanac.*.search methods for service details.