scim/api-methods

14 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Generate SCIM token endpoint

POST /scim/generate-token endpoint generates a SCIM bearer token. Requires session authentication. Parameters: providerId (required, string), organizationId (optional, string). The providerId specifies which provider the token is restricted to, and organizationId optionally restricts the token to an organization when the organizations plugin is enabled.

List SCIM provider connections endpoint

GET /scim/list-provider-connections lists existing connections the current user can manage. Requires session authentication. For organization-scoped connections, the user must have one of the configured requiredRole roles for that organization. For personal connections, access is based on ownership when providerOwnership.enabled is turned on.

Get SCIM provider connection endpoint

GET /scim/get-provider-connection gets a single connection by provider id. Requires session authentication. Parameter: providerId (required, string). Access is allowed only if the user can manage that connection: either because they satisfy the configured organization role requirement, or because they own the personal connection.

Delete SCIM provider connection endpoint

POST /scim/delete-provider-connection deletes an existing connection and immediately invalidates the connection's associated token. Requires session authentication. Parameter: providerId (required, string).

List SCIM users endpoint

GET /scim/v2/Users returns a list of available users in the database. Requires bearer token authentication. Restricted to list only users associated to the same provider and organization as the SCIM token. Optional parameter: filter (string, SCIM compliant filter expression).

Get SCIM user endpoint

GET /scim/v2/Users/:userId returns a user from the database. Requires bearer token authentication. Parameter: userId (required, string). The user will be returned only if it belongs to the same provider and organization as the SCIM token.

Create SCIM user endpoint

POST /scim/v2/Users provisions a new user to the database. Requires bearer token authentication. Parameters: externalId (optional, string), name (optional, object with formatted, givenName, familyName), emails (optional, array of objects with value and primary boolean). The user will have an account associated to the same provider and will be member of the same org as the SCIM token.

Update SCIM user endpoint

PUT /scim/v2/Users/:userId replaces an existing user's details in the database. Requires bearer token authentication. Parameter: userId (required, string). Body parameters: externalId (optional, string), name (optional, object with formatted, givenName, familyName), emails (optional, array of objects with value and primary boolean). This operation can only update users that belong to the same provider and organization as the SCIM token.

Patch SCIM user endpoint

PATCH /scim/v2/Users/:userId applies a partial update to user details. Requires bearer token authentication. Parameter: userId (required, string). Body parameters: schemas (required, array of strings), Operations (required, array of objects with op (replace, add, or remove), path (optional, string), and value). This operation can only update users that belong to the same provider and organization as the SCIM token.

Delete SCIM user endpoint

DELETE /scim/v2/Users/:userId removes a user resource. Requires bearer token authentication. Parameter: userId (required, string). For organization-scoped tokens, the user is deprovisioned from the organization: their membership and the provider account are removed, while the global user record is kept. For non-organization tokens, the global user is deleted only when this provider's account is their sole identity; otherwise just that account is unlinked.

Get SCIM service provider config endpoint

GET /scim/v2/ServiceProviderConfig returns SCIM metadata describing supported features of the SCIM server. No authentication required.

Get SCIM schema endpoint

GET /scim/v2/Schemas/:schemaId returns details of a supported SCIM schema. No authentication required. Parameter: schemaId (required, string).

Get SCIM resource type endpoint

GET /scim/v2/ResourceTypes/:resourceTypeId returns details of a supported SCIM resource type. No authentication required. Parameter: resourceTypeId (required, string).

SCIM organization-scoped connection management endpoints

Organization-scoped SCIM connection management endpoints include GET /scim/list-provider-connections, GET /scim/get-provider-connection, and POST /scim/delete-provider-connection. These require organization role authorization as configured by requiredRole.

Give your agent this brain