SCIM

SCIM 2.0

SCIM 2.0 provisioning for automated user and group sync from your identity provider. Protocol endpoints use a bearer token at /api/os/scim/v2 on your app domain.

scim_config.read

scim_config.write

SCIM 2.0 provisioning for automated user and group sync from your identity provider. Protocol endpoints use a bearer token at <code>/api/os/scim/v2</code> on your app domain.

SCIM protocol requests use a bearer token configured in the dashboard — not an API key. Send Authorization: Bearer scim-token with Content-Type: application/scim+json.

GET

/Users

List provisioned users (SCIM 2.0 Users resource).

Request Headers

Param	Type	Required	Description
Authorization	string	Yes	SCIM bearer token from the dashboard
Content-Type	string	No	Use application/scim+json for SCIM requests

Query Parameters

Param	Type	Required	Description
filter	string	No	SCIM filter expression, e.g. userName eq "[email protected]"

POST

/Users

Provision a new user via SCIM.

Request Headers

Param	Type	Required	Description
Authorization	string	Yes	SCIM bearer token from the dashboard
Content-Type	string	No	Use application/scim+json for SCIM requests

Request Body

Param	Type	Required	Description
userName	string	Yes	User email address
displayName	string	No	Display name
active	boolean	No	Whether the user is active

GET

/Groups

List provisioned groups (SCIM 2.0 Groups resource).

Request Headers

Param	Type	Required	Description
Authorization	string	Yes	SCIM bearer token from the dashboard
Content-Type	string	No	Use application/scim+json for SCIM requests

POST

/Groups

Create a group via SCIM.

Request Headers

Param	Type	Required	Description
Authorization	string	Yes	SCIM bearer token from the dashboard
Content-Type	string	No	Use application/scim+json for SCIM requests

Full SCIM 2.0 paths are relative to your provisioned endpoint URL shown in the dashboard:

https://your-app.com/api/os/scim/v2/Users

Authenticate with your organization API key. Include subOrgId as a query parameter or in the request body when using an org-wide key. Sub-org-scoped keys automatically target their sub-organization.

SCIM configuration (REST)

GET

/v1/scim/config

Get SCIM provisioning configuration. Requires scim_config.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "config": { "enabled": true, "endpointUrl": "..." } }

PATCH

/v1/scim/config

Enable SCIM or link an SSO connection. Requires scim_config.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Request Body

Param	Type	Required	Description
enabled	boolean	No	Whether SCIM provisioning is enabled
sso_connection_id	string	No	Linked SSO connection for group mapping
subOrgId	string	Yes	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "config": { /* updated */ } }

POST

/v1/scim/config

Rotate the SCIM bearer token. Requires scim_config.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Request Body

Param	Type	Required	Description
action	string	Yes	Use rotate-token to rotate the SCIM bearer token
subOrgId	string	Yes	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "token": "scim_...", "config": { /* ... */ } }