Skip to content

Create a SCIM token

POST /scim-token

Mints the bearer token an IdP uses to provision users and groups through `/scim/v2/*`. The raw `token` (`escim_…`) is in THIS response only and cannot be retrieved again. It authorizes SCIM alone — it is not an org API token. Requires `sso:manage`, an interactive human session (a credential cannot mint one), and a fresh step-up reauthentication (`X-Step-Up-Token`, obtained from `/auth/step-up`) — this bearer carries full provisioning rights over the directory and outlives whatever minted it, so minting one is what a stolen session would otherwise do to walk around every step-up gate. Without the token the call answers `428 step_up_required`.

Request Body

namestring

Response Body

created_atstring · date-time
idstring

SCIM token id.

last_used_atstring,null · date-time
namestring
organization_idstring

Organization (org_…) it provisions into.

tokenstring

Raw SCIM token — shown once.

updated_atstring · date-time
user_idstring

User (usr_…) who minted it.

curl -X POST 'https://api.elaichi.ai/scim-token' \
  -H 'Authorization: Bearer $ELAICHI_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"name":"your_name"}'
const body = {
  "name": "your_name"
};

const response = await fetch('https://api.elaichi.ai/scim-token', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + process.env.ELAICHI_API_TOKEN,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
import os
import requests

url = "https://api.elaichi.ai/scim-token"
headers = {
    "Authorization": f"Bearer {os.environ['ELAICHI_API_TOKEN']}",
    "Content-Type": "application/json",
}
payload = {
    "name": "your_name"
}

response = requests.post(url, headers=headers, json=payload)
print(response.json())