---
title: "Generate the SCIM token (shown once; replaces the current token, which stops working at once). Owner/admin, session signed in within 5 minutes; the team needs an SSO connection"
method: POST
path: "/orgs/{orgId}/scim/token"
tags: ["Teams"]
---

# Generate the SCIM token (shown once; replaces the current token, which stops working at once). Owner/admin, session signed in within 5 minutes; the team needs an SSO connection

`POST /orgs/{orgId}/scim/token`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/orgs/{orgId}/scim/token`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `orgId` string, uuid, required

## Response `200`

The new token

- object
  - `token` string, required: the new token (hsscim_…): shown only now. Any previous token stopped working
  - `scim` object, required
    - `role` 'owner' | 'admin' | 'developer' | 'viewer' | 'billing' | 'editor', required: your role in this team (owners and admins manage SCIM)
    - `available` boolean, required: the team has an SSO connection: SCIM provisions members into it
    - `baseUrl` string, required: SCIM 2.0 base URL — Okta: "SCIM connector base URL"; Microsoft Entra ID: "Tenant URL"
    - `defaultRole` 'developer' | 'viewer' | 'billing' | 'null', nullable, required: role of members SCIM adds (the SSO connection's default role)
    - `token` object, nullable, required
      - `id` string, uuid, required
      - `hint` string, required: the token's last four characters
      - `createdAt` string, required: ISO-8601 timestamp
      - `lastUsedAt` string, nullable, required: ISO-8601 timestamp
      - `createdBy` object, required
        - `userId` string, uuid, nullable, required
        - `name` string, nullable, required
        - `email` string, nullable, required
      - `authority` 'owner' | 'admin' | 'null', nullable, required: the creator's current role, which is what the token may do (an admin's token cannot deactivate admins); null: the creator is no longer an owner or admin and the token is refused
    - `users` object, required
      - `total` integer, required: SCIM users of this team
      - `active` integer, required
      - `deprovisioned` integer, required: members SCIM removed from the team (they can be reactivated by SCIM)

## Other responses

- `400`: Invalid request (code invalid_request; details.reason sso_not_configured: set up SSO first)
- `401`: Missing or invalid session (code unauthorized)
- `403`: Not permitted (code forbidden): owners and admins, dashboard session only (details.sessionRequired); details.reauthenticate: sign in again (token changes need a session younger than 5 minutes)
- `404`: Not found (code not_found)
- `429`: Too many requests (code rate_limited)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)