Skip to main content

SCIM 2.0 Technical Reference

Written by Louis Lloyd-Besson

AutoRFP supports SCIM 2.0 (RFC 7643/7644) for automated user provisioning and deprovisioning.

Authentication

SCIM requests are authenticated via OAuth 2.0 Bearer Tokens (RFC 6750).

Supported Endpoints

User Operations

Endpoint

Methods

Description

/scim/:version/Users

GET, POST

List users (with filtering/pagination) or create a new user

/scim/:version/Users/:userId

GET, PUT, PATCH, DELETE

Retrieve, replace, update, or deactivate a specific user

Discovery

Endpoint

Method

Description

/scim/:version/ServiceProviderConfig

GET

SCIM provider capabilities

/scim/:version/ResourceTypes

GET

Supported resource types

/scim/:version/Schemas

GET

All supported schemas

/scim/:version/Schemas/:schemaId

GET

A specific schema definition

User Schema

SCIM Attribute

Required

Notes

userName

Yes

Must be a valid email address. Used as the primary user identifier.

name.givenName

Yes

First name

name.familyName

Yes

Last name

displayName

Read-only

Auto-generated from given/family name

active

Yes

Controls whether the user can access the account

title

No

Job title

externalId

No

External identifier from your IdP

Filtering & Pagination

Filtering

The GET /Users endpoint supports SCIM filtering via the filter query parameter.

Filterable attributes: userName, name.givenName, name.familyName, displayName, active, title, externalId, id

Supported operators: eq, ne, co, sw, ew, gt, ge, lt, le, pr

Logical operators: and, or, not

Examples:

filter=userName eq "[email protected]"
filter=active eq true and name.givenName sw "John"

Pagination

Parameter

Default

Max

startIndex

1

count

100

1000

Deprovisioning Behaviour

When a user is deactivated via DELETE or by setting active to false, the user is soft-deleted. Their access is revoked immediately but their record is retained for audit purposes.

Current Limitations

  • Groups - Group resources are not currently supported. User provisioning and deprovisioning is managed at the individual user level.

  • Roles - Role assignment via SCIM is not currently supported. Roles are managed within the application.

Did this answer your question?