diff --git a/cmd/climc/shell/identity/keystone.go b/cmd/climc/shell/identity/keystone.go
new file mode 100644
index 0000000000..d35cba53f5
--- /dev/null
+++ b/cmd/climc/shell/identity/keystone.go
@@ -0,0 +1,34 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package identity
+
+import (
+	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/mcclient/modules"
+)
+
+func init() {
+	type ScopeResourceRefreshOptions struct {
+	}
+	R(&ScopeResourceRefreshOptions{}, "scope-resource-refresh", "Refresh scope resource count", func(s *mcclient.ClientSession, args *ScopeResourceRefreshOptions) error {
+		result, err := modules.ScopeResource.PerformClassAction(s, "refresh", nil)
+		if err != nil {
+			return err
+		}
+		printObject(result)
+		return nil
+	})
+
+}
diff --git a/pkg/keystone/cronjobs/project_resources.go b/pkg/keystone/cronjobs/project_resources.go
index e9abd237bc..5d5625a2af 100644
--- a/pkg/keystone/cronjobs/project_resources.go
+++ b/pkg/keystone/cronjobs/project_resources.go
@@ -20,14 +20,19 @@ import (
 	"net/http"
 	"time"
 
+	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/pkg/errors"
 
 	"yunion.io/x/onecloud/pkg/apis"
 	api "yunion.io/x/onecloud/pkg/apis/identity"
+	"yunion.io/x/onecloud/pkg/appsrv"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/keystone/models"
 	"yunion.io/x/onecloud/pkg/keystone/tokens"
 	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/mcclient/auth"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 )
 
@@ -47,10 +52,16 @@ type sServiceEndpoints struct {
 }
 
 func FetchScopeResourceCount(ctx context.Context, userCred mcclient.TokenCredential, isStart bool) {
+	err := refreshScopeResourceCount(ctx)
+	if err != nil {
+		log.Errorf("refreshScopeResourceCount error: %v", err)
+	}
+}
+func refreshScopeResourceCount(ctx context.Context) error {
 	log.Debugf("FetchScopeResourceCount")
 	eps, err := models.EndpointManager.FetchAll()
 	if err != nil {
-		return
+		return errors.Wrapf(err, "EndpointManager.FetchAll")
 	}
 	serviceTbl := make(map[string]*sServiceEndpoints)
 	for _, ep := range eps {
@@ -113,6 +124,7 @@ func FetchScopeResourceCount(ctx context.Context, userCred mcclient.TokenCredent
 		}
 		syncScopeResourceCount(ctx, ep.regionId, ep.serviceId, projectResCounts)
 	}
+	return nil
 }
 
 func syncScopeResourceCount(ctx context.Context, regionId string, serviceId string, projResCnt map[string][]db.SScopeResourceCount) {
@@ -185,3 +197,27 @@ func syncScopeResourceCount(ctx context.Context, regionId string, serviceId stri
 		}
 	}
 }
+
+func AddRefreshHandler(prefix string, app *appsrv.Application) {
+	app.AddHandler2("POST", fmt.Sprintf("%s/scope-resource/refresh", prefix), auth.Authenticate(refreshHandler), nil, "scope_resource_refresh", nil)
+}
+
+func refreshHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) {
+	userCred := auth.FetchUserCredential(ctx, nil)
+	if userCred == nil || !db.IsDomainAllowList(userCred, models.DomainManager) {
+		httperrors.ForbiddenError(ctx, w, "not enough privilege")
+		return
+	}
+
+	err := refreshScopeResourceCount(ctx)
+	if err != nil {
+		httperrors.GeneralServerError(ctx, w, err)
+		return
+	}
+	ret := map[string]interface{}{
+		"scope-resource": map[string]string{
+			"status": "ok",
+		},
+	}
+	fmt.Fprintf(w, jsonutils.Marshal(ret).String())
+}
diff --git a/pkg/keystone/service/handlers.go b/pkg/keystone/service/handlers.go
index b45263dbe2..6daef227d6 100644
--- a/pkg/keystone/service/handlers.go
+++ b/pkg/keystone/service/handlers.go
@@ -20,6 +20,7 @@ import (
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
+	"yunion.io/x/onecloud/pkg/keystone/cronjobs"
 	"yunion.io/x/onecloud/pkg/keystone/models"
 	"yunion.io/x/onecloud/pkg/keystone/tokens"
 	"yunion.io/x/onecloud/pkg/keystone/usages"
@@ -34,6 +35,7 @@ func InitHandlers(app *appsrv.Application) {
 
 	// add version handler with API_VERSION prefix
 	app.AddDefaultHandler("GET", API_VERSION+"/version", appsrv.VersionHandler, "version")
+	cronjobs.AddRefreshHandler(API_VERSION, app)
 
 	quotas.AddQuotaHandler(&models.IdentityQuotaManager.SQuotaBaseManager, API_VERSION, app)
 
diff --git a/pkg/mcclient/modules/mod_scope_resource.go b/pkg/mcclient/modules/mod_scope_resource.go
new file mode 100644
index 0000000000..2ecfef860f
--- /dev/null
+++ b/pkg/mcclient/modules/mod_scope_resource.go
@@ -0,0 +1,35 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package modules
+
+import (
+	"yunion.io/x/onecloud/pkg/mcclient/modulebase"
+)
+
+type ScopeResourceManager struct {
+	modulebase.ResourceManager
+}
+
+var (
+	ScopeResource ScopeResourceManager
+)
+
+func init() {
+	ScopeResource = ScopeResourceManager{NewIdentityV3Manager("scope-resource", "scope-resource",
+		[]string{},
+		[]string{})}
+
+	register(&ScopeResource)
+}