Generate SCIM Token

Setting up SCIM provisioning for an organisation:

1. POST /organisations/{org_id}/scim/token (this endpoint) - mint a bearer token. The plaintext value is returned exactly once; only its hash is stored, so save it now.
2. Configure the identity provider (Okta, Azure AD, ...) with the returned scim_base_url and token.
3. PUT /organisations/{org_id}/scim/role-mappings - define which SCIM group maps to which organisation role, if group-based roles are wanted.
4. POST /organisations/{org_id}/scim/sync - recompute existing users' roles against the mapping table; role-mapping changes are not applied retroactively without this.

Regenerating the token immediately invalidates the previous one.

curl -X POST "https://example.com/v1/organisations/497f6eca-6276-4993-bfeb-53cbbbba6f08/scim/token"

{  "token": "string",  "scim_base_url": "string"}

{  "detail": [    {      "loc": [        "string"      ],      "msg": "string",      "type": "string"    }  ]}