@@ -0,0 +1,18 @@
+---
+'@objectstack/platform-objects': patch
+'@objectstack/plugin-auth': patch
+---
+
+feat(platform-objects): mint and revoke SCIM connection credentials from the console
+
+Clause-②: no
+Metadata-protocol: none
+
+`sys_scim_connection_credential` gains two actions, so a platform administrator setting up SCIM provisioning no longer needs curl to get a bearer token:
+
+- **Mint Credential** (list toolbar) posts `POST /api/v1/auth/admin/scim/mint-credential` with a connection ID and the optional label, organization, provisioning domain and expiry, then shows the token once in a result dialog the administrator must close. Only the token's one-way digest is stored, so it cannot be shown again. Mint is not exposed to AI tools: an agent that ran it would hold a live SCIM bearer.
+- **Revoke Credential** (a credential row or its record header) posts `POST /api/v1/auth/admin/scim/revoke-credential` for that row, after a confirmation. It is offered on an active credential only; the route's 404 and 409 answers show as the action's error. Revoke is exposed to AI tools and always asks the human to confirm first.
+
+Both are offered only to a platform administrator and declare the routes' own gate (`manage_platform_settings`). Who may mint or revoke is unchanged: the routes still decide.
+
+`@objectstack/plugin-auth`: a mint made on an impersonation session now names the administrator at the keyboard in its `sys_audit_log` row, as `metadata.impersonated_by` (the key the audit writers use). A mint on an ordinary session writes the same row as before.
@@ -2282,6 +2282,49 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       all: {
         label: "All"
       }
+    },
+    _actions: {
+      mint_scim_credential: {
+        label: "Mint Credential",
+        description: "Mint a bearer credential for a SCIM connection. Give it to the identity provider as the SCIM token; it is shown once.",
+        params: {
+          connectionId: {
+            label: "Connection ID",
+            helpText: "The SCIM connection this credential authenticates, e.g. \"okta-prod\". At most 246 characters. To rotate, mint a second credential for the same connection, move the identity provider to it, then revoke the old one."
+          },
+          label: {
+            label: "Label",
+            helpText: "Optional. A name for this credential, e.g. \"rotation 2026-Q3\"."
+          },
+          organizationId: {
+            label: "Organization",
+            helpText: "Optional. The organization that owns the connection. Leave empty for the Default Organization."
+          },
+          provisioningDomainId: {
+            label: "Provisioning Domain",
+            helpText: "Optional. The boundary that receives the provisioned users and groups. Leave empty to use the connection ID."
+          },
+          expiresAt: {
+            label: "Expires At",
+            helpText: "Optional. After this time the credential is refused. Leave empty for a credential that does not expire."
+          }
+        },
+        resultDialog: {
+          title: "SCIM credential minted",
+          description: "Copy the token now — it is shown only once and cannot be recovered. Paste it into the identity provider as the SCIM bearer token. If it leaks, revoke it and mint a new one.",
+          acknowledge: "I have saved the token",
+          fields: {
+            token: "Token",
+            connectionId: "Connection ID",
+            expiresAt: "Expires At"
+          }
+        }
+      },
+      revoke_scim_credential: {
+        label: "Revoke Credential",
+        confirmText: "Revoke this SCIM credential? The identity provider using it is refused from its next request on. This cannot be undone: to restore provisioning, mint a new credential.",
+        successMessage: "SCIM credential revoked"
+      }
     }
   },
   sys_scim_group: {
 
@@ -2282,6 +2282,49 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       all: {
         label: "Todas"
       }
+    },
+    _actions: {
+      mint_scim_credential: {
+        label: "Emitir credencial",
+        description: "Emite una credencial de portador para una conexión SCIM. Entrégala al IdP como token SCIM; solo se muestra una vez.",
+        params: {
+          connectionId: {
+            label: "ID de conexión",
+            helpText: "Conexión SCIM que autentica esta credencial, p. ej., «okta-prod». Máximo 246 caracteres. Para rotarla, emite una segunda credencial para la misma conexión, cambia el IdP a ella y después revoca la anterior."
+          },
+          label: {
+            label: "Etiqueta",
+            helpText: "Opcional. Un nombre para esta credencial, p. ej., «rotation 2026-Q3»."
+          },
+          organizationId: {
+            label: "Organización",
+            helpText: "Opcional. La organización propietaria de la conexión. Déjalo vacío para usar la organización predeterminada."
+          },
+          provisioningDomainId: {
+            label: "Dominio de aprovisionamiento",
+            helpText: "Opcional. El límite que recibe los usuarios y grupos aprovisionados. Déjalo vacío para usar el ID de conexión."
+          },
+          expiresAt: {
+            label: "Caduca el",
+            helpText: "Opcional. Pasado este momento, la credencial se rechaza. Déjalo vacío para una credencial que no caduca."
+          }
+        },
+        resultDialog: {
+          title: "Credencial SCIM emitida",
+          description: "Copia el token ahora: solo se muestra una vez y no se puede recuperar. Pégalo en el IdP como token de portador SCIM. Si se filtra, revócalo y emite uno nuevo.",
+          acknowledge: "He guardado el token",
+          fields: {
+            token: "Token de portador",
+            connectionId: "ID de conexión",
+            expiresAt: "Caduca el"
+          }
+        }
+      },
+      revoke_scim_credential: {
+        label: "Revocar credencial",
+        confirmText: "¿Revocar esta credencial SCIM? El IdP que la usa se rechaza a partir de su siguiente solicitud. No se puede deshacer: para restablecer el aprovisionamiento, emite una credencial nueva.",
+        successMessage: "Credencial SCIM revocada"
+      }
     }
   },
   sys_scim_group: {
 
@@ -2282,6 +2282,49 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       all: {
         label: "すべて"
       }
+    },
+    _actions: {
+      mint_scim_credential: {
+        label: "資格情報を発行",
+        description: "SCIM 接続用のベアラー資格情報を発行します。SCIM トークンとして IdP に渡してください。一度しか表示されません。",
+        params: {
+          connectionId: {
+            label: "接続 ID",
+            helpText: "この資格情報が認証する SCIM 接続（例: 「okta-prod」）。最大 246 文字です。ローテーションするには、同じ接続に 2 つ目の資格情報を発行し、IdP をそちらに切り替えてから、古いものを失効させます。"
+          },
+          label: {
+            label: "ラベル",
+            helpText: "任意。この資格情報の名前（例: 「rotation 2026-Q3」）。"
+          },
+          organizationId: {
+            label: "組織",
+            helpText: "任意。この接続を所有する組織。空欄の場合は既定の組織になります。"
+          },
+          provisioningDomainId: {
+            label: "プロビジョニングドメイン",
+            helpText: "任意。プロビジョニングされたユーザーとグループを受け取る境界。空欄の場合は接続 ID が使われます。"
+          },
+          expiresAt: {
+            label: "有効期限",
+            helpText: "任意。この日時を過ぎると資格情報は拒否されます。空欄の場合は期限のない資格情報になります。"
+          }
+        },
+        resultDialog: {
+          title: "SCIM 資格情報を発行しました",
+          description: "今すぐトークンをコピーしてください。トークンは一度しか表示されず、後から取得することはできません。IdP に SCIM ベアラートークンとして貼り付けてください。漏えいした場合は失効させて新しく発行してください。",
+          acknowledge: "トークンを保存しました",
+          fields: {
+            token: "トークン",
+            connectionId: "接続 ID",
+            expiresAt: "有効期限"
+          }
+        }
+      },
+      revoke_scim_credential: {
+        label: "資格情報を失効",
+        confirmText: "この SCIM 資格情報を失効させますか？これを使っている IdP は次のリクエストから拒否されます。この操作は元に戻せません。プロビジョニングを再開するには新しい資格情報を発行してください。",
+        successMessage: "SCIM 資格情報を失効させました"
+      }
     }
   },
   sys_scim_group: {
 
@@ -2282,6 +2282,49 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       all: {
         label: "全部"
       }
+    },
+    _actions: {
+      mint_scim_credential: {
+        label: "签发凭据",
+        description: "为 SCIM 连接签发一个 Bearer 凭据。把它作为 SCIM 令牌交给 IdP；它只显示一次。",
+        params: {
+          connectionId: {
+            label: "连接 ID",
+            helpText: "该凭据认证的 SCIM 连接，例如 “okta-prod”。最多 246 个字符。如需轮换，请为同一连接再签发一个凭据，让 IdP 改用它，然后撤销旧凭据。"
+          },
+          label: {
+            label: "标签",
+            helpText: "可选。该凭据的名称，例如 “rotation 2026-Q3”。"
+          },
+          organizationId: {
+            label: "组织",
+            helpText: "可选。拥有该连接的组织。留空则为默认组织。"
+          },
+          provisioningDomainId: {
+            label: "预配域",
+            helpText: "可选。接收所预配的用户和组的边界。留空则使用连接 ID。"
+          },
+          expiresAt: {
+            label: "过期时间",
+            helpText: "可选。超过此时间后该凭据会被拒绝。留空则凭据永不过期。"
+          }
+        },
+        resultDialog: {
+          title: "SCIM 凭据已签发",
+          description: "请立即复制令牌——它只显示这一次，之后无法找回。请把它粘贴到 IdP 中作为 SCIM Bearer 令牌。如果泄露，请撤销它并签发新的凭据。",
+          acknowledge: "我已保存令牌",
+          fields: {
+            token: "令牌",
+            connectionId: "连接 ID",
+            expiresAt: "过期时间"
+          }
+        }
+      },
+      revoke_scim_credential: {
+        label: "撤销凭据",
+        confirmText: "确定要撤销此 SCIM 凭据吗？使用它的 IdP 从下一次请求起将被拒绝。此操作无法撤销：如需恢复预配，请签发新的凭据。",
+        successMessage: "SCIM 凭据已撤销"
+      }
     }
   },
   sys_scim_group: {
 
@@ -2282,6 +2282,49 @@ export const zhHantObjects: NonNullable<TranslationData['objects']> = {
       all: {
         label: "全部"
       }
+    },
+    _actions: {
+      mint_scim_credential: {
+        label: "簽發憑證",
+        description: "為 SCIM 連線簽發一個 Bearer 憑證。把它作為 SCIM 權杖交給 IdP；它只顯示一次。",
+        params: {
+          connectionId: {
+            label: "連線 ID",
+            helpText: "該憑證驗證的 SCIM 連線，例如「okta-prod」。最多 246 個字元。如需輪換，請為同一連線再簽發一個憑證，讓 IdP 改用它，然後撤銷舊憑證。"
+          },
+          label: {
+            label: "標籤",
+            helpText: "選填。該憑證的名稱，例如「rotation 2026-Q3」。"
+          },
+          organizationId: {
+            label: "組織",
+            helpText: "選填。擁有該連線的組織。留空則為預設組織。"
+          },
+          provisioningDomainId: {
+            label: "佈建網域",
+            helpText: "選填。接收所佈建使用者與群組的邊界。留空則使用連線 ID。"
+          },
+          expiresAt: {
+            label: "到期時間",
+            helpText: "選填。超過此時間後該憑證會被拒絕。留空則憑證永不到期。"
+          }
+        },
+        resultDialog: {
+          title: "SCIM 憑證已簽發",
+          description: "請立即複製權杖——它只顯示這一次，之後無法找回。請把它貼到 IdP 中作為 SCIM Bearer 權杖。如果洩露，請撤銷它並簽發新的憑證。",
+          acknowledge: "我已儲存權杖",
+          fields: {
+            token: "權杖",
+            connectionId: "連線 ID",
+            expiresAt: "到期時間"
+          }
+        }
+      },
+      revoke_scim_credential: {
+        label: "撤銷憑證",
+        confirmText: "確定要撤銷此 SCIM 憑證嗎？使用它的 IdP 從下一次請求起將被拒絕。此操作無法復原：如需恢復佈建，請簽發新的憑證。",
+        successMessage: "SCIM 憑證已撤銷"
+      }
     }
   },
   sys_scim_group: {
 
@@ -0,0 +1,109 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The console's two SCIM credential actions — mint and revoke — wired to
+ * plugin-auth's platform-admin mounts, and the AI exposure each one declares.
+ *
+ * What the console cannot be allowed to drift from is the mount's contract:
+ * the route and method, the body keys the mint reads (`connectionId`, `label`,
+ * `organizationId`, `provisioningDomainId`, `expiresAt`) and the one the revoke
+ * reads (`credentialId`). A param renamed to the row's column spelling would
+ * reach the mount as an unknown key and be answered 400 ("connectionId is
+ * required"), so the names are pinned against the mount's own spelling.
+ *
+ * The neighbouring pins this file does not repeat: the one-shot reveal of the
+ * minted token is held by `two-factor-one-shot-reveal.test.ts` (its route
+ * table names the mint), and the platform-admin standing plus the declared
+ * gate by `platform-admin-affordance-standing.test.ts` (its family floor names
+ * both actions).
+ */
+
+import { describe, expect, it } from 'vitest';
+import { celEngine } from '@objectstack/formula';
+import type { Action } from '@objectstack/spec/ui';
+import { SysScimConnectionCredential } from './sys-scim-connection-credential.object.js';
+
+const MINT_ROUTE = '/api/v1/auth/admin/scim/mint-credential';
+const REVOKE_ROUTE = '/api/v1/auth/admin/scim/revoke-credential';
+
+function action(name: string): Action {
+  const found = ((SysScimConnectionCredential.actions ?? []) as Action[]).find((a) => a.name === name);
+  expect(found, `sys_scim_connection_credential declares no action '${name}'`).toBeDefined();
+  return found!;
+}
+
+/** Every action on this object whose target is one of the two mounts. */
+function actionsOnTheMounts(): Action[] {
+  return ((SysScimConnectionCredential.actions ?? []) as Action[]).filter(
+    (a) => a.target === MINT_ROUTE || a.target === REVOKE_ROUTE,
+  );
+}
+
+function offered(source: string, record: Record<string, unknown>): string {
+  const admin = { id: 'u_pa', isPlatformAdmin: true, positions: [] };
+  const r = celEngine.evaluate(
+    { dialect: 'cel', source },
+    { record, extra: { current_user: admin, user: admin, ctx: { user: admin }, os: { user: admin }, features: {} } },
+  );
+  return r.ok ? String(r.value) : `FAULT ${r.error.message.split('\n')[0]}`;
+}
+
+describe('sys_scim_connection_credential: mint and revoke reach the platform-admin mounts', () => {
+  it('mint POSTs the mint mount from the list toolbar, with the body keys the mount reads', () => {
+    const mint = action('mint_scim_credential');
+    expect(mint).toMatchObject({ type: 'api', method: 'POST', target: MINT_ROUTE, locations: ['list_toolbar'] });
+    const params = (mint.params ?? []) as Array<{ name?: string; required?: boolean; type?: string; reference?: string }>;
+    expect(params.map((p) => p.name)).toEqual(['connectionId', 'label', 'organizationId', 'provisioningDomainId', 'expiresAt']);
+    // The mount refuses a mint with no connection id; nothing else is required.
+    expect(params.filter((p) => p.required).map((p) => p.name)).toEqual(['connectionId']);
+    // The organization is picked, not typed: the mount refuses an id that names no organization.
+    expect(params.find((p) => p.name === 'organizationId')).toMatchObject({ type: 'lookup', reference: 'sys_organization' });
+    // The mint answers `{ success, data: { token, ... } }`; the reveal reads the inner payload.
+    expect(mint.resultDialog?.fields?.find((f) => f.format === 'secret')?.path).toBe('token');
+  });
+
+  it('revoke POSTs the revoke mount from a credential row, sending the row id as credentialId', () => {
+    const revoke = action('revoke_scim_credential');
+    expect(revoke).toMatchObject({
+      type: 'api',
+      method: 'POST',
+      target: REVOKE_ROUTE,
+      recordIdParam: 'credentialId',
+      locations: ['list_item', 'record_header'],
+    });
+    // No param dialog: the row is the whole input, so the confirmation is the one dialog.
+    expect(revoke.params ?? []).toEqual([]);
+    expect(revoke.confirmText).toBeTruthy();
+  });
+
+  it('revoke is offered on an active credential, not on a revoked one, and never faults on a row without `active`', () => {
+    const visible = action('revoke_scim_credential').visible as unknown;
+    // The served predicate: the authored string, or the parsed `{ source }` form.
+    const source = typeof visible === 'string' ? visible : String((visible as { source?: unknown })?.source);
+    expect(offered(source, { active: true })).toBe('true');
+    expect(offered(source, { active: false })).toBe('false');
+    expect(offered(source, {})).toBe('false');
+    expect(offered(source, { active: null })).toBe('false');
+  });
+
+  it('the instrument is live: both mounts have exactly one action each on this object', () => {
+    // Positive control for the exposure pins below: a renamed target would
+    // leave them judging nothing.
+    expect(actionsOnTheMounts().map((a) => a.target).sort()).toEqual([MINT_ROUTE, REVOKE_ROUTE]);
+  });
+});
+
+describe('sys_scim_connection_credential: AI exposure (ADR-0011 identity-actions note)', () => {
+  it('mint is NOT exposed to AI tools: an agent that ran it would hold a live SCIM bearer', () => {
+    // Bucket H. Exposing it is a security boundary and needs a maintainer
+    // ruling that names this action, so any `ai.exposed` here is refused.
+    const mint = action('mint_scim_credential');
+    expect(mint.ai?.exposed ?? false, 'mint_scim_credential declares ai.exposed').toBe(false);
+  });
+
+  it('revoke is exposed with its confirmation: bucket C, and the confirmation is never relaxed', () => {
+    const revoke = action('revoke_scim_credential');
+    expect(revoke.ai).toMatchObject({ exposed: true, requiresConfirmation: true });
+    expect(revoke.ai?.description?.length ?? 0).toBeGreaterThan(0);
+  });
+});