rocketkind
Security

SCIM 2.0

SCIM 2.0 is the open standard (RFC 7643 and RFC 7644) that SaaS applications expose so an identity system can create, update and remove their accounts.

Authentication

  • Bearer token

Actions

Generic API request. Call any endpoint of the SCIM service provider on this connection, for the case where no shipped action covers it yet — discovery endpoints such as ServiceProviderConfig, Schemas and ResourceTypes, a Bulk request, or a provider's own non-standard resource. The connection supplies the base URL, the authentication and…

  • Add group membersGrant a group's access to one or more people by adding them to a group at the SCIM service provider — how birthright and approved access requests are fulfilled.
  • Create groupCreate a group at the SCIM service provider, optionally with its first members — for a team, a department or an access tier that app permissions are granted to.
  • Create userCreate a person's account at the SCIM service provider — the provisioning half of an onboarding (joiner) workflow.
  • Deactivate userDestructiveStop a person from signing in to the SCIM service provider without deleting their account — the first step of offboarding (leaver), which keeps the account, its data and its history for a later hard delete or a rehire.
  • Delete groupDestructivePermanently remove a group from the SCIM service provider.
  • Delete userDestructivePermanently remove a person's account from the SCIM service provider — the final step of offboarding, once any retention period has passed.
  • Get groupRead one group at the SCIM service provider by its provider id, including its members unless you exclude them — to check who holds the access the group grants, or to reconcile its membership against your records.
  • Get userRead one person's account at the SCIM service provider by its provider id — to check whether it is active, which groups it belongs to, or which attributes drifted from your records.
  • List groupsList or search the groups at the SCIM service provider — to find a group by name before granting it, or to read every group for a membership reconciliation.
  • List usersList or search the people provisioned at the SCIM service provider — to find an account by user name or by your external id before creating it, or to read every account for a drift reconciliation.
  • Remove group memberDestructiveRevoke a group's access from one person by removing them from a group at the SCIM service provider — how movers lose their old department's access and expired just-in-time grants are taken back.
  • Replace userDestructiveOverwrite a person's whole account at the SCIM service provider with the attributes you send — full synchronization from an authoritative source that holds every attribute the account should keep.
  • Update groupDestructiveChange selected attributes of a group at the SCIM service provider — rename it, or make any membership change the add and remove actions do not cover, such as replacing the whole member list.
  • Update userDestructiveChange selected attributes of a person's account at the SCIM service provider and leave the rest untouched — a mover's new department or manager, a corrected email, or any custom extension attribute the typed actions do not cover.

Product names, logos and brands are the property of their respective owners and are used here for identification only. Their use does not imply endorsement by, or affiliation with, those owners.