v1/mgmt/scim/key/createAuthorization
Descope Project ID and Management Key Project ID:Management Key as bearer token.
In: header
Request Body
application/json
The SSO configuration this key provisions into. Omit it to target the tenant's default configuration - it does NOT mean "every configuration".
Defaults to a name derived from the tenant and SSO configuration.
Epoch seconds. 0, the default, means the key never expires. An expired SCIM key stops the identity provider from provisioning, so prefer 0 unless you have a rotation process.
Create a SCIM access key for a tenant, using a valid management key. The key is scoped to the given tenant and carries the roles and custom claims SCIM requires, so the returned bearer token can be pasted straight into an identity provider's SCIM configuration. Existing SCIM keys for the same SSO configuration stay valid. The cleartext is returned exactly once.
curl -X POST "https://api.descope.com/v1/mgmt/scim/key/create" \ -H "Content-Type: application/json" \ -d '{}'{ "cleartext": "string", "key": { "id": "string", "name": "string", "roleNames": [ "string" ], "keyTenants": [ { "tenantId": "string", "roleNames": [ "string" ], "tenantName": "string" } ], "status": "string", "createdTime": 0, "expireTime": 0, "createdBy": "string", "clientId": "string", "boundUserId": "string", "customClaims": { "claim-name": "claim-value" }, "editable": true, "description": "string", "permittedIps": [ "string" ], "customAttributes": { "attribute-key": "attribute-value" } }, "scimUrl": "string", "revokedKeyIds": [ "string" ]}export interface Response {/** * The bearer token to configure in the identity provider, in "<projectId>:<key>" form. * Returned exactly once. */cleartext?: stringkey?: {id?: stringname?: stringroleNames?: string[]keyTenants?: AssociatedTenantAK[]status?: stringcreatedTime?: numberexpireTime?: numbercreatedBy?: stringclientId?: stringboundUserId?: string/** * Custom claims to include in the JWT as key-value pairs. Keys must be strings; values can be strings, numbers, or booleans. */customClaims?: {[k: string]: string}editable?: booleandescription?: stringpermittedIps?: string[]/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}}/** * The SCIM base URL to configure in the identity provider alongside the bearer token. */scimUrl?: string/** * The keys revoked by this call, if any. */revokedKeyIds?: string[]}export interface AssociatedTenantAK {tenantId?: stringroleNames?: string[]tenantName?: string}Activate SCIM Access Keys POST
Re-enable specific deactivated SCIM access keys of a tenant, using a valid management key. This reverses a revoke that used revokeMode DEACTIVATE; keys that were deleted cannot be restored. The keys to activate must be named explicitly - call Load SCIM Access Keys to get their ids - so that a key deactivated because its secret leaked is never restored as a side effect.
Load SCIM Access Keys GET
Load the SCIM access keys of a tenant, using a valid management key. Returns key metadata only - the cleartext of an access key is available exactly once, when the key is created or rotated, and is never returned again.