`POST /identity-providers/{id}/scim/bearer-tokens` — issue a fresh SCIM bearer for this IdpRecord.

First-time issuance and rotation are the same operation: every call replaces scim_bearer_token_hash with the hash of a freshly- generated 64-hex-char plaintext, and returns the plaintext to the admin once in the response. Subsequent IdpRecord reads never echo it.

Returns:

• 201 with { bearerToken, rotatedAt } on success.
• 404 if the IdpRecord doesn't exist at (org_id, id).
• 404 if it exists but has no scim_config configured — admin must enable SCIM via the regular update path before issuing a token. (Anti-enum: same 404 as "not found at all" so the endpoint doesn't leak whether the IdpRecord exists.)
• 403 if the caller is not an admin.

Atomic invalidation

The scim-bearer-hash-index GSI is what the SCIM auth extractor uses to authenticate every inbound request. Replacing the hash in a single PutItem means the old hash is no longer findable after this returns — concurrent SCIM calls with the old bearer 401 on their next request. No grace window.

Path Parameters

Response Body

curl -X POST "https://example.com/identity-providers/string/scim/bearer-tokens"

{  "bearer_token": "string",  "rotated_at": "string"}