Unable to successfully verify nonce

Looking at the documentation, the 2nd argument of check_ajax_referer() is:

(false|string) (Optional) Key to check for the nonce in $_REQUEST (since 2.5). If false, $_REQUEST values will be evaluated for ‘_ajax_nonce’, and ‘_wpnonce’ (in that order).

Not the value itself. So the correct usage would be:

check_ajax_referer('fmsapi_refresh_nonce', 'security' );