> ## Documentation Index > Fetch the complete documentation index at: https://docs.skortorent.com/llms.txt > Use this file to discover all available pages before exploring further. # Generate Tenant Onboarding Token > Generates a short-lived **tenant onboarding token** used to start a browser profile session with the JavaScript SDK for the application participant identified by `tenant_email`. The email must belong to the application. If no tenant account exists for that email, SKOR creates the minimal tenant record required for onboarding and associates it with the API key. The participant is linked to the tenant but remains pending while onboarding is incomplete. Its `consent_status` changes to `accepted` only after onboarding is completed in the iframe. If an existing tenant account is not linked to the requesting API key, the response contains a restricted verification token and `requires_login_with_skor: true`. The SDK asks the tenant to log in with SKOR and verify an OTP; this token is not a tenant login token. For an incomplete profile, successful OTP verification links the key and displays Profile linked with a Continue onboarding action if profile is pending. Clicking it redirects the tenant to onboarding and resumes from the stored step using the returned onboarding token. Application consent remains pending until onboarding is completed. Later requests for the same linked tenant and key can receive the normal onboarding token directly. A completed tenant also uses restricted verification while application consent is pending or the profile is outdated. An outdated tenant sees Profile linked after OTP and must explicitly choose Redo onboarding to restart the normal iframe flow. OTP verification alone does not complete or close that session. If application consent was already accepted and the profile is current, the response contains `token: null`. Call this from your server after creating the property and application. If the response contains a token, hand it to the SDK's `startProfileSession({ token })` in the browser. See the [SDK guide](/sdk) for the full flow. ## OpenAPI ````yaml /api-reference/openapi.yaml post /tenants/onboarding-token openapi: 3.1.0 info: title: SKOR Modular API version: 1.0.0 description: > ## Overview This is the SKOR Modular API v1. It provides access to tenant workflows, API keys, webhooks, document processing, identity verification, banking connectivity, and forensic analysis. ## Error Statuses The API uses standard HTTP status codes to indicate the success or failure of requests. Each error response provides guidance to help identify the issue and take corrective action. ### Success — `200 OK` The request was processed successfully and the expected response data is returned. ### Validation Error — `400 Bad Request` The request is invalid due to missing, malformed, or incorrect parameters. **Common causes:** - Required fields are missing from the request. - Invalid data formats or unsupported values are provided. - File size or payload limits are exceeded. **How to resolve:** - Verify all required parameters are present. - Ensure the request payload matches the documented schema. - Validate data formats and constraints before retrying. ### Unauthorized — `401 Unauthorized` Authentication failed or the provided token is missing or invalid. **Common causes:** - The `Authorization` header is missing. - An invalid or expired bearer token is provided. **How to resolve:** - Ensure the token is included in the request as an `Authorization: Bearer ` header. - Verify the token is valid and has not expired. - Generate a new token if required. ### Not Found — `404 Not Found` The requested resource does not exist or is not accessible. **Common causes:** - An invalid or non-existent resource identifier. - The resource has not been created or has been deleted. **How to resolve:** - Confirm the resource identifier is correct. - Ensure the resource exists before accessing it. ### Server Error — `500 Internal Server Error` An unexpected error occurred on the server while processing the request. **How to resolve:** - Retry the request after a short delay. - If the issue persists, **[contact us](mailto:info@skortorent.com)** with relevant request details. ### Need Help? If you encounter unexpected behavior, please **[contact us](mailto:info@skortorent.com)** for assistance. servers: - url: https://api.skortorent.com/api/v1 description: Live - url: https://dev-api.skortorent.com/api/v1 description: Sandbox security: - BearerAuth: [] paths: /tenants/onboarding-token: post: tags: - Tenants summary: Generate Tenant Onboarding Token description: > Generates a short-lived **tenant onboarding token** used to start a browser profile session with the JavaScript SDK for the application participant identified by `tenant_email`. The email must belong to the application. If no tenant account exists for that email, SKOR creates the minimal tenant record required for onboarding and associates it with the API key. The participant is linked to the tenant but remains pending while onboarding is incomplete. Its `consent_status` changes to `accepted` only after onboarding is completed in the iframe. If an existing tenant account is not linked to the requesting API key, the response contains a restricted verification token and `requires_login_with_skor: true`. The SDK asks the tenant to log in with SKOR and verify an OTP; this token is not a tenant login token. For an incomplete profile, successful OTP verification links the key and displays Profile linked with a Continue onboarding action if profile is pending. Clicking it redirects the tenant to onboarding and resumes from the stored step using the returned onboarding token. Application consent remains pending until onboarding is completed. Later requests for the same linked tenant and key can receive the normal onboarding token directly. A completed tenant also uses restricted verification while application consent is pending or the profile is outdated. An outdated tenant sees Profile linked after OTP and must explicitly choose Redo onboarding to restart the normal iframe flow. OTP verification alone does not complete or close that session. If application consent was already accepted and the profile is current, the response contains `token: null`. Call this from your server after creating the property and application. If the response contains a token, hand it to the SDK's `startProfileSession({ token })` in the browser. See the [SDK guide](/sdk) for the full flow. requestBody: required: true content: application/json: schema: type: object required: - tenant_email - application_id - property_id properties: tenant_email: type: string format: email description: Email of the application participant starting onboarding. application_id: type: string description: Application containing the tenant email. property_id: type: string description: Property linked to the application. responses: '200': description: Tenant onboarding request processed successfully content: application/json: schema: type: object properties: status: type: string enum: - success message: type: string description: >- Describes whether onboarding, SKOR login, or no further action is required. data: type: object properties: token: type: string nullable: true description: > Token to pass to the SDK profile session in the browser. For an existing tenant not yet linked to the API key, a completed tenant with pending application consent, or a completed tenant whose profile is outdated, this is a restricted OTP-verification token, not a tenant login token. Null when consent was already accepted and the profile is current. tenant_id: type: string description: Resolved or newly created tenant identifier. is_profile_outdated: type: boolean description: >- True when an existing tenant must complete onboarding again. requires_login_with_skor: type: boolean description: > True when an existing tenant must verify an OTP to link the requesting API key, accept pending application consent, or re-onboard an outdated profile. '400': $ref: '#/components/responses/ErrorResponse' '401': $ref: '#/components/responses/ErrorResponse' '403': $ref: '#/components/responses/ErrorResponse' '404': $ref: '#/components/responses/ErrorResponse' '500': $ref: '#/components/responses/ErrorResponse' components: responses: ErrorResponse: description: Error response content: application/json: schema: type: object properties: status: type: string enum: - error message: type: string securitySchemes: BearerAuth: type: http scheme: bearer description: | HTTP Bearer Authentication. Generate a shared token via `/authenticate/token`, then pass it as `Authorization: Bearer `. ````