v1/mgmt/scim/key/rotateAuthorization
Descope Project ID and Management Key Project ID:Management Key as bearer token.
In: header
Request Body
application/json
The SSO configuration to rotate. Omit it to target the tenant's default configuration - it does NOT mean "every configuration", so a tenant with several SSO configurations keeps provisioning through the keys of the ones not named here.
How the keys being replaced are taken out of service. SCIM_KEY_REVOKE_MODE_DELETE (0, the default) deletes them permanently. SCIM_KEY_REVOKE_MODE_DEACTIVATE (1) disables them reversibly, so they can be restored later with Activate SCIM Access Keys.
enumRotate the SCIM access keys of a tenant, using a valid management key. A new key is created and the tenant's existing SCIM keys for the same SSO configuration are revoked, either deleted or deactivated according to revokeMode. Update the identity provider with the new bearer token immediately - until you do, SCIM provisioning for that tenant will fail. The cleartext is returned exactly once.
curl -X POST "https://api.descope.com/v1/mgmt/scim/key/rotate" \ -H "Content-Type: application/json" \ -d '{}'{ "cleartext": "string", "key": { "id": "string", "name": "string", "roleNames": [ "string" ], "keyTenants": [ { "tenantId": "string", "roleNames": [ "string" ], "tenantName": "string" } ], "status": "string", "createdTime": 0, "expireTime": 0, "createdBy": "string", "clientId": "string", "boundUserId": "string", "customClaims": { "claim-name": "claim-value" }, "editable": true, "description": "string", "permittedIps": [ "string" ], "customAttributes": { "attribute-key": "attribute-value" } }, "scimUrl": "string", "revokedKeyIds": [ "string" ]}export interface Response {/** * The bearer token to configure in the identity provider, in "<projectId>:<key>" form. * Returned exactly once. */cleartext?: stringkey?: {id?: stringname?: stringroleNames?: string[]keyTenants?: AssociatedTenantAK[]status?: stringcreatedTime?: numberexpireTime?: numbercreatedBy?: stringclientId?: stringboundUserId?: string/** * Custom claims to include in the JWT as key-value pairs. Keys must be strings; values can be strings, numbers, or booleans. */customClaims?: {[k: string]: string}editable?: booleandescription?: stringpermittedIps?: string[]/** * Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays. */customAttributes?: {[k: string]: string}}/** * The SCIM base URL to configure in the identity provider alongside the bearer token. */scimUrl?: string/** * The keys revoked by this call, if any. */revokedKeyIds?: string[]}export interface AssociatedTenantAK {tenantId?: stringroleNames?: string[]tenantName?: string}Revoke SCIM Access Keys POST
Revoke every SCIM access key of a tenant for the given SSO configuration, using a valid management key. This disables SCIM provisioning for that tenant until a new key is created and configured in the identity provider. Use revokeMode DEACTIVATE to suspend the keys reversibly instead of deleting them.
Delete Scope Claim Mapping POST
Remove the project-wide scope-to-claims mapping.