Skip to main content

​
SCIM Provisioning

SCIM provides IdP-driven provisioning for enterprise workspaces.

​
Directory management endpoints

  • POST /api/scim/directories
  • GET /api/scim/directories
  • PATCH /api/scim/directories/:id
  • DELETE /api/scim/directories/:id
  • POST /api/scim/directories/:id/regenerate-token

​
SCIM discovery endpoints

  • GET /api/scim/v2/ServiceProviderConfig
  • GET /api/scim/v2/ResourceTypes
  • GET /api/scim/v2/Schemas

​
User resource endpoints

  • GET /api/scim/v2/Users
  • GET /api/scim/v2/Users/:id
  • POST /api/scim/v2/Users
  • PUT /api/scim/v2/Users/:id
  • PATCH /api/scim/v2/Users/:id
  • DELETE /api/scim/v2/Users/:id

​
Group resource endpoints

  • GET /api/scim/v2/Groups
  • GET /api/scim/v2/Groups/:id
  • POST /api/scim/v2/Groups
  • PUT /api/scim/v2/Groups/:id
  • PATCH /api/scim/v2/Groups/:id
  • DELETE /api/scim/v2/Groups/:id

​
Auth and access model

  • Directory management uses session auth and admin-level workspace permissions.
  • SCIM /v2/* resources use SCIM bearer token auth.

​
Provisioning behavior

Directory settings control automation:
  • user sync
  • group sync
  • auto-create users
  • auto-deactivate users
  • default role assignment
Token regeneration invalidates old token material for subsequent SCIM requests.

​
Common errors

  • 401: missing or invalid SCIM token
  • 403: unauthorized directory/workspace access
  • 404: user/group/directory not found
  • 409: identity conflict on provisioning operations