POST
/v1/mgmt/tenant/create

Authorization

Descope Project ID and Management Key
AuthorizationBearer <token>

Project ID:Management Key as bearer token.

In: header

Request Body

application/json

name*string
Length1 <= length <= 254
id?string
selfProvisioningDomains?array<string>
string
customAttributes?object

Custom attributes as key-value pairs. Keys must be strings; values can be strings, numbers, booleans, or arrays.

Example{ "attribute-key": "attribute-value" }
authType?string
disabled?boolean
enforceSSO?boolean
enforceSSOExclusions?array<string>
string
federatedAppIds?array<string>
string
parent?string
roleInheritance?string
approvedDomains?array<string>
string

The tenant's vanity hostname (e.g. surveys.example.com), unique across the project's tenants. Requests that reach the project through its trusted proxy on this hostname are bound to this tenant. One item for now

Itemsitems <= 1
enforceSSOExclusionPermissions?array<string>
string

Permission names or IDs whose holders in the tenant may sign in without SSO while enforceSSO is on (break-glass accounts)

strict?boolean

When true, setting custom attributes the project does not declare for tenants returns error E111843 listing them: the request fails and nothing is saved. When false (default), those keys are ignored. An attribute declared in the last few seconds may still be ignored.

Create a new tenant, using a valid management key.

This API endpoint will create a new tenant utilizing a valid management key.

Creation of a new tenant can set the name, id, and selfProvisioningDomains. The id and selfProvisioningDomains are not mandatory. The id will be autogenerated if not provided. The response will always include the tenantId.

Next Steps

See also

curl -X POST "https://api.descope.com/v1/mgmt/tenant/create" \  -H "Content-Type: application/json" \  -d '{    "name": "string"  }'
{  "id": "string"}
export interface Response {id?: string}
Was this helpful?