API
SCIM provisioning
SCIM 2.0 for your identity provider: people and groups kept in step with your organization.
Your identity provider (Okta, Entra ID, or any SCIM 2.0 client) calls /v1/scim/<orgId> with the SCIM token an owner makes in Tenant → Single Sign-On, as Authorization: Bearer scim_…. Answers are application/scim+json; errors carry SCIM's scimType.
A new user is invited with the token's role, or linked when they're already a member; active: false blocks them and signs them out. Groups are Tenant groups. Owners are never changed.
Every route below, with its parameters, request and response, errors and samples, is in the API reference.
| Route | What it does |
|---|---|
GET /v1/scim/:orgId/ServiceProviderConfig | SCIM discovery (RFC 7643): PATCH, filters and ETags supported; bulk, sort and password changes not. With the org's SCIM token. |
GET /v1/scim/:orgId/ResourceTypes | SCIM discovery: the User and Group resource types. |
GET /v1/scim/:orgId/ResourceTypes/:id | SCIM discovery: one resource type. |
GET /v1/scim/:orgId/Schemas | SCIM discovery: the User and Group schemas this endpoint keeps. |
GET /v1/scim/:orgId/Schemas/:id | SCIM discovery: one schema. |
GET /v1/scim/:orgId/Users | Provisioned users; filter with eq on userName, externalId, id or emails.value, startIndex and count (up to 200). |
POST /v1/scim/:orgId/Users | Provisions a person: the member with that address is linked, anyone else invited with the token's role. userName is unique. |
GET /v1/scim/:orgId/Users/:id | A provisioned user, with the groups the identity provider gave them. |
PUT /v1/scim/:orgId/Users/:id | Replaces a provisioned user. active: false blocks the member (or withdraws the invite); true unblocks. Owners are never changed. |
PATCH /v1/scim/:orgId/Users/:id | Changes a provisioned user with SCIM PATCH operations (Okta's and Entra ID's shapes), as PUT applies them. |
DELETE /v1/scim/:orgId/Users/:id | Removes the member (restorable in Tenant for 30 days) or withdraws the invite. |
GET /v1/scim/:orgId/Groups | Groups the identity provider manages; filter with eq on displayName, externalId or id. |
POST /v1/scim/:orgId/Groups | Makes a Tenant group with its members; people who haven't joined are added once they do. |
GET /v1/scim/:orgId/Groups/:id | A managed group and its members. |
PUT /v1/scim/:orgId/Groups/:id | Replaces a managed group's name and members. |
PATCH /v1/scim/:orgId/Groups/:id | Adds, removes or replaces a managed group's members, or renames it. |
DELETE /v1/scim/:orgId/Groups/:id | Deletes the managed group. |