> ## Documentation Index
> Fetch the complete documentation index at: https://docs.linquid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and Provisioning APIs

> OAuth provider + app management, SAML SSO, and SCIM user/group provisioning

# Identity and Provisioning APIs

Identity APIs span three areas:

* OAuth 2.0 provider and OAuth app management
* SAML SSO connection and login flow
* SCIM 2.0 directory/user/group provisioning

## OAuth provider endpoints

* `GET /oauth/authorize`
* `POST /oauth/authorize`
* `POST /oauth/token`
* `GET /oauth/userinfo`
* `POST /oauth/revoke`

OAuth app management endpoints:

* `GET /oauth/apps`
* `POST /oauth/apps`
* `GET /oauth/apps/:id`
* `PATCH /oauth/apps/:id`
* `DELETE /oauth/apps/:id`
* `POST /oauth/apps/:id/rotate-secret`

OAuth behavior highlights:

* Authorization Code flow with optional/required PKCE (per app settings).
* Scope validation against app-allowed scopes.
* Role-aware granted scope trimming at consent time.
* Token endpoint supports `authorization_code` and `refresh_token`.
* UserInfo requires valid access token with `user.read` scope.
* Revocation follows RFC-style idempotent behavior.

## SAML endpoints

* `GET /saml/metadata/:workspaceId`
* `POST /saml/connections`
* `GET /saml/connections`
* `PATCH /saml/connections/:id`
* `DELETE /saml/connections/:id`
* `PATCH /saml/enforce`
* `GET /saml/authorize/:workspaceId`
* `POST /saml/callback`
* `GET /saml/check`
* `GET /saml/logout/:workspaceId`
* `POST /saml/logout/callback`
* `GET /saml/logout/callback`

SAML behavior highlights:

* Workspace admin setup only.
* Enterprise plan required.
* Supports metadata-based or manual IdP configuration.
* Enforce mode requires valid corporate allowed domains.
* Assertion replay defenses and certificate validation are applied server-side.

## SCIM endpoints

Directory management:

* `POST /scim/directories`
* `GET /scim/directories`
* `PATCH /scim/directories/:id`
* `DELETE /scim/directories/:id`
* `POST /scim/directories/:id/regenerate-token`

SCIM service resources:

* `GET /scim/v2/ServiceProviderConfig`
* `GET /scim/v2/ResourceTypes`
* `GET /scim/v2/Schemas`
* `GET|POST /scim/v2/Users`
* `GET|PUT|PATCH|DELETE /scim/v2/Users/:id`
* `GET|POST /scim/v2/Groups`
* `GET|PUT|PATCH|DELETE /scim/v2/Groups/:id`

SCIM behavior highlights:

* `/scim/directories/*` endpoints are workspace-admin management APIs.
* SCIM provisioning routes (`/scim/v2/*`) use bearer token auth tied to the SCIM directory.
* User provisioning can auto-create workspace members and auto-deactivate/remove on IdP deactivation.
* Group provisioning supports full replace and PATCH member add/remove operations.

## Availability and access

* SAML and SCIM are enterprise-focused capabilities.
* OAuth app management requires integration read/manage permissions.
* SAML and SCIM management require workspace admin/owner scope.
* SCIM provisioning endpoints use bearer-token authentication from your IdP (no dashboard session cookie).
* CSRF protection applies to state-changing management routes.

## Typical failures

* `400/422` invalid OAuth/SAML/SCIM payloads
* `401` invalid client credentials, bearer tokens, or session state
* `403` plan or permission restrictions
* `404` unknown connection/app/directory/resource IDs
* `409` duplicate OAuth app/SCIM user/group uniqueness conflicts

Related docs:

* `/user-guides/manual/workspace/security-and-compliance`
* `/api-reference/auth/overview`
* `/api-reference/identity/oauth-apps-and-provider`
* `/api-reference/identity/saml-sso`
* `/api-reference/identity/scim-provisioning`