v1/mgmt/scim/keyAuthorization
Descope Project ID and Management Key Project ID:Management Key as bearer token.
In: header
Query Parameters
Omit to return the tenant's SCIM keys across every SSO configuration.
Load the SCIM access keys of a tenant, using a valid management key. Returns key metadata only - the cleartext of an access key is available exactly once, when the key is created or rotated, and is never returned again.
curl -X GET "https://api.descope.com/v1/mgmt/scim/key"{ "keys": [ { "key": { "id": "string", "name": "string", "roleNames": [ "string" ], "keyTenants": [ { "tenantId": "string", "roleNames": [ "string" ], "tenantName": "string" } ], "status": "string", "createdTime": 0, "expireTime": 0, "createdBy": "string", "clientId": "string", "boundUserId": "string", "customClaims": { "claim-name": "claim-value" }, "editable": true, "description": "string", "permittedIps": [ "string" ], "customAttributes": { "attribute-key": "attribute-value" } }, "ssoId": "string" } ]}export interface Response {keys?: SCIMAccessKey[]}export interface SCIMAccessKey {key?: {id?: stringname?: stringroleNames?: string[]keyTenants?: AssociatedTenantAK[]status?: stringcreatedTime?: numberexpireTime?: numbercreatedBy?: stringclientId?: stringboundUserId?: string/** * Custom claims to include in the JWT as key-value pairs. Keys must be strings; values can be strings, numbers, or booleans. */customClaims?: {[k: string]: string}editable?: booleandescription?: stringpermittedIps?: string[]/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}}/** * The SSO configuration this key provisions into. */ssoId?: string}export interface AssociatedTenantAK {tenantId?: stringroleNames?: string[]tenantName?: string}Create SCIM Access Key POST
Create a SCIM access key for a tenant, using a valid management key. The key is scoped to the given tenant and carries the roles and custom claims SCIM requires, so the returned bearer token can be pasted straight into an identity provider's SCIM configuration. Existing SCIM keys for the same SSO configuration stay valid. The cleartext is returned exactly once.
Revoke SCIM Access Keys POST
Revoke every SCIM access key of a tenant for the given SSO configuration, using a valid management key. This disables SCIM provisioning for that tenant until a new key is created and configured in the identity provider. Use revokeMode DEACTIVATE to suspend the keys reversibly instead of deleting them.