Rotate the SCIM bearer token. Runs Stytch's start + complete in one call (same shape as the M2M secret rotation): the old token stops working immediately and the new one is returned exactly once. If completing fails after start, the rotation is cancelled best-effort so the IdP keeps syncing with its current token.

POST

/account/scim/connection/rotate_token

curl --request POST \
  --url https://api.siteqwality.com/account/scim/connection/rotate_token \
  --header 'Authorization: Bearer <token>'

• Production

Authorizations

• bearer_auth

Responses

200

New bearer token; only returned once

Media type application/json

Create / rotate response: carries the bearer token exactly once.

object

connection

required

SCIM connection as returned to the dashboard. Never carries the bearer token; only the last four characters.

object

connection_id

required

string

display_name

required

string

status

required

string

base_url

SCIM base URL the customer pastes into their IdP.

string | null

bearer_token_last_four

string | null

last_rotated_at

string | null format: date-time

created_at

required

string format: date-time

bearer_token

required

Full bearer token. Shown once, never stored, never retrievable again.

string

Example ^generated

{
  "connection": {
    "connection_id": "example",
    "display_name": "example",
    "status": "example",
    "base_url": "example",
    "bearer_token_last_four": "example",
    "last_rotated_at": "2026-04-15T12:00:00Z",
    "created_at": "2026-04-15T12:00:00Z"
  },
  "bearer_token": "example"
}

401

Missing or invalid authentication

403

Caller is not a super admin, or the plan does not include SCIM

404

No SCIM connection configured

500

Internal server error