---
title: "POST /orgs/{org_id}/scim-tokens"
method: POST
path: "/orgs/{org_id}/scim-tokens"
tags: ["orgs"]
---

# POST /orgs/{org_id}/scim-tokens

`POST /orgs/{org_id}/scim-tokens`

Create a SCIM bearer token for the organization.

## Path parameters

- `org_id` string, required

## Request body

- CreateScimTokenReqBody — Create a SCIM token for an org.
  - `label` string, nullable — Human label for the admin UI (e.g. "Entra prod").
  - `provider_id` integer, nullable — Optional IdP connection to bind this token to. When set, SCIM group pushes resolve roles through that connection's group→role mappings; when omitted the token does membership-only SCIM (auto add/remove).

## Response `201`

Token created

- CreateScimTokenResBody — Create response: the only time the plaintext token is ever returned. The caller (IdP admin) must copy `token` now — it can't be retrieved later.
  - `created_at` integer, required
  - `enabled` boolean, required
  - `id` string, required
  - `label` string, nullable
  - `last_used_at` integer, nullable
  - `org_id` string, required
  - `provider_id` string, nullable
  - `updated_at` integer, required
  - `base_url` string, required — The base URL the IdP should target, e.g. `https://api.timbal.ai/scim/v2`.
  - `token` string, required — The bearer token to paste into the IdP's SCIM config. Shown once.

---

[API](https://skmtc.net/timbal-ai/apis/timbal-platform-api.md) · [All operations](https://skmtc.net/timbal-ai/apis/timbal-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/timbal-ai/timbal-platform-api/revisions/dd7e398ce0d3/schema)