SCIM provisioning

SCIM root: https://api.syauth.com/e/v1/scim/v2. Resource paths have no trailing slash. Provisioning uses a workspace SCIM Bearer token; token management uses developer credentials. Send application/json for JSON writes; responses use application/scim+json. Check compatibility limits before configuring your identity provider.

API conventions · All endpoints · Schemas

`/e/v1/developer/scim/tokens/`

List or issue workspace-scoped SCIM credentials.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_scim.

Required query workspace_id UUID.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	`workspace_id`	`not supplied`

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "results": [
    {
      "id": "11111111-1111-4111-8111-111111111111",
      "workspace_id": "EXAMPLE_WORKSPACE_ID",
      "name": "Example",
      "created_by": "EXAMPLE_CREATED_BY",
      "created_at": "EXAMPLE_CREATED_AT",
      "last_used_at": "EXAMPLE_LAST_USED_AT",
      "expires_at": "EXAMPLE_EXPIRES_AT",
      "revoked_at": "EXAMPLE_REVOKED_AT",
      "is_live": true
    }
  ]
}

400 — json

{
  "error": "workspace_id is required"
}

403 — json

{
  "error": "Forbidden"
}

POST

Required developer-token scope: write_scim.

Required JSON workspace_id (workspace alias accepted); optional name string (default SCIM token), expires_in_days integer or null. Returns metadata plus plaintext token once.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	`workspace_id`	`not supplied`
body	`workspace`	`not supplied`
body	`expires_in_days`	`not supplied`
body	`name`	`not supplied`

Example request body:

{
  "workspace_id": "11111111-1111-4111-8111-111111111111",
  "name": "Development IdP",
  "expires_in_days": 30
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

201 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "workspace_id": "EXAMPLE_WORKSPACE_ID",
  "name": "Example",
  "created_by": "EXAMPLE_CREATED_BY",
  "created_at": "EXAMPLE_CREATED_AT",
  "last_used_at": "EXAMPLE_LAST_USED_AT",
  "expires_at": "EXAMPLE_EXPIRES_AT",
  "revoked_at": "EXAMPLE_REVOKED_AT",
  "is_live": true
}

400 — json

{
  "error": "workspace_id is required"
}

400 — json

{
  "error": "expires_in_days must be an integer"
}

403 — json

{
  "error": "Forbidden"
}

`/e/v1/developer/scim/tokens/{token_id}/`

Revoke a workspace SCIM token.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

DELETE

Required developer-token scope: write_scim.

No body. Requires access to the token’s workspace; returns 204.

Path parameters: token_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

204 — json

No response body.

403 — json

{
  "error": "Forbidden"
}

404 — json

{
  "error": "Token not found"
}

`/e/v1/scim/v2/Users`

Provision or list SCIM users in the token’s workspace.

Availability note: standalone access with the credential described below has a known authentication limitation. Check integration availability before relying on this operation. If it returns an unexpected 401, contact support with the endpoint and sanitized response.

Send Authorization: Bearer SCIM_TOKEN. Use Content-Type: application/json for writes. See the availability note before connecting an identity provider.

GET

Optional filter, startIndex (1-based, default 1), count (default 100, max 200). Returns SCIM ListResponse. Unsupported filter paths/operators return SCIM errors.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	`filter`	`not supplied`
query	`count`	`100`
query	`startIndex`	`1`

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 0,
  "startIndex": 1,
  "itemsPerPage": 0,
  "Resources": []
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "EXAMPLE_VALUE"
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

POST

Required userName string; optional name.givenName/familyName, emails array (primary value takes precedence), active boolean (default true). Unknown attributes are not persisted; no password provisioning.

Example request body:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "userName": "[email protected]",
  "name": {
    "givenName": "Alex",
    "familyName": "Developer"
  },
  "active": true
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

201 — json

{
  "schemas": [
    "EXAMPLE_SCHEMAS"
  ],
  "id": "11111111-1111-4111-8111-111111111111",
  "externalId": "EXAMPLE_EXTERNALID",
  "userName": "EXAMPLE_USERNAME",
  "name": {
    "givenName": "EXAMPLE_GIVENNAME",
    "familyName": "EXAMPLE_FAMILYNAME",
    "formatted": "EXAMPLE_FORMATTED"
  },
  "emails": "EXAMPLE_EMAILS",
  "active": "EXAMPLE_ACTIVE",
  "meta": "EXAMPLE_META"
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "userName is required"
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "Could not create user: EXAMPLE"
}

409 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "409",
  "detail": "A user with that userName already exists."
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

`/e/v1/scim/v2/Users/{user_id}`

Read, replace, patch or remove a SCIM user.

Send Authorization: Bearer SCIM_TOKEN for the workspace containing this resource.

GET

Path ID must belong to the SCIM token’s workspace.

Path parameters: user_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "EXAMPLE_SCHEMAS"
  ],
  "id": "11111111-1111-4111-8111-111111111111",
  "externalId": "EXAMPLE_EXTERNALID",
  "userName": "EXAMPLE_USERNAME",
  "name": {
    "givenName": "EXAMPLE_GIVENNAME",
    "familyName": "EXAMPLE_FAMILYNAME",
    "formatted": "EXAMPLE_FORMATTED"
  },
  "emails": "EXAMPLE_EMAILS",
  "active": "EXAMPLE_ACTIVE",
  "meta": "EXAMPLE_META"
}

404 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "404",
  "detail": "User not found"
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

PUT

User replacement maps supplied SCIM fields; omitted names become empty strings and active defaults true. Inspect schema mapping before sending sparse replacements.

Path parameters: user_id (uuid, required).

Example request body:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "userName": "[email protected]",
  "name": {
    "givenName": "Alex",
    "familyName": "Developer"
  },
  "active": true
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "EXAMPLE_SCHEMAS"
  ],
  "id": "11111111-1111-4111-8111-111111111111",
  "externalId": "EXAMPLE_EXTERNALID",
  "userName": "EXAMPLE_USERNAME",
  "name": {
    "givenName": "EXAMPLE_GIVENNAME",
    "familyName": "EXAMPLE_FAMILYNAME",
    "formatted": "EXAMPLE_FORMATTED"
  },
  "emails": "EXAMPLE_EMAILS",
  "active": "EXAMPLE_ACTIVE",
  "meta": "EXAMPLE_META"
}

404 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "404",
  "detail": "User not found"
}

409 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "409",
  "detail": "userName conflicts with an existing user."
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

PATCH

JSON Operations array. Each operation has op (add/replace/remove), path and value as appropriate. See supported paths in the SCIM feature guide. Unknown paths return invalidPath.

Path parameters: user_id (uuid, required).

Example request body:

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "active",
      "value": false
    }
  ]
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "EXAMPLE_SCHEMAS"
  ],
  "id": "11111111-1111-4111-8111-111111111111",
  "externalId": "EXAMPLE_EXTERNALID",
  "userName": "EXAMPLE_USERNAME",
  "name": {
    "givenName": "EXAMPLE_GIVENNAME",
    "familyName": "EXAMPLE_FAMILYNAME",
    "formatted": "EXAMPLE_FORMATTED"
  },
  "emails": "EXAMPLE_EMAILS",
  "active": "EXAMPLE_ACTIVE",
  "meta": "EXAMPLE_META"
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "Operations must be a list"
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "EXAMPLE_VALUE"
}

404 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "404",
  "detail": "User not found"
}

409 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "409",
  "detail": "Conflict after patch."
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

DELETE

Soft-deactivates user and removes group memberships.

Path parameters: user_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

204 — json

No response body.

404 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "404",
  "detail": "User not found"
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

`/e/v1/scim/v2/Groups`

Provision or list SCIM groups in the token’s workspace.

Send Authorization: Bearer SCIM_TOKEN. Use Content-Type: application/json for writes. See the availability note before connecting an identity provider.

GET

Optional filter, startIndex (1-based, default 1), count (default 100, max 200). Returns SCIM ListResponse. Unsupported filter paths/operators return SCIM errors.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	`filter`	`not supplied`
query	`count`	`100`
query	`startIndex`	`1`

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 0,
  "startIndex": 1,
  "itemsPerPage": 0,
  "Resources": []
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "EXAMPLE_VALUE"
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

POST

Required displayName string; optional members array of objects with value=user UUID. Members must resolve within the token workspace.

Example request body:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "displayName": "Engineering",
  "members": [
    {
      "value": "11111111-1111-4111-8111-111111111111"
    }
  ]
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

201 — json

{
  "schemas": [
    "EXAMPLE_SCHEMAS"
  ],
  "id": "11111111-1111-4111-8111-111111111111",
  "displayName": "EXAMPLE_DISPLAYNAME",
  "members": "EXAMPLE_MEMBERS",
  "meta": "EXAMPLE_META"
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "displayName is required"
}

409 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "409",
  "detail": "A group with that displayName already exists."
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

`/e/v1/scim/v2/Groups/{group_id}`

Read, replace, patch or remove a SCIM group.

Send Authorization: Bearer SCIM_TOKEN for the workspace containing this resource.

GET

Path ID must belong to the SCIM token’s workspace.

Path parameters: group_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "EXAMPLE_SCHEMAS"
  ],
  "id": "11111111-1111-4111-8111-111111111111",
  "displayName": "EXAMPLE_DISPLAYNAME",
  "members": "EXAMPLE_MEMBERS",
  "meta": "EXAMPLE_META"
}

404 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "404",
  "detail": "Group not found"
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

PUT

Replacement updates displayName and replaces memberships using members; omitted members removes existing membership.

Path parameters: group_id (uuid, required).

Example request body:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "displayName": "Engineering",
  "members": [
    {
      "value": "11111111-1111-4111-8111-111111111111"
    }
  ]
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "EXAMPLE_SCHEMAS"
  ],
  "id": "11111111-1111-4111-8111-111111111111",
  "displayName": "EXAMPLE_DISPLAYNAME",
  "members": "EXAMPLE_MEMBERS",
  "meta": "EXAMPLE_META"
}

404 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "404",
  "detail": "Group not found"
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

PATCH

JSON Operations array. Each operation has op (add/replace/remove), path and value as appropriate. See supported paths in the SCIM feature guide. Unknown paths return invalidPath.

Path parameters: group_id (uuid, required).

Example request body:

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "displayName",
      "value": "Platform"
    }
  ]
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "EXAMPLE_SCHEMAS"
  ],
  "id": "11111111-1111-4111-8111-111111111111",
  "displayName": "EXAMPLE_DISPLAYNAME",
  "members": "EXAMPLE_MEMBERS",
  "meta": "EXAMPLE_META"
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "Operations must be a list"
}

400 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "EXAMPLE_VALUE"
}

404 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "404",
  "detail": "Group not found"
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

DELETE

Deletes group and its memberships.

Path parameters: group_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

204 — json

No response body.

404 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "404",
  "detail": "Group not found"
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

`/e/v1/scim/v2/ServiceProviderConfig`

Read SCIM capabilities or schemas.

GET

No body. SCIM Bearer token required; not anonymous discovery. Bulk, sorting, ETags and password changes are advertised as unsupported.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

`/e/v1/scim/v2/ResourceTypes`

Read SCIM capabilities or schemas.

GET

No body. SCIM Bearer token required; not anonymous discovery. Bulk, sorting, ETags and password changes are advertised as unsupported.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 0,
  "startIndex": 1,
  "itemsPerPage": 0,
  "Resources": []
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

`/e/v1/scim/v2/Schemas`

Read SCIM capabilities or schemas.

GET

No body. SCIM Bearer token required; not anonymous discovery. Bulk, sorting, ETags and password changes are advertised as unsupported.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 0,
  "startIndex": 1,
  "itemsPerPage": 0,
  "Resources": []
}

status_code — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

/e/v1/developer/scim/tokens/​

GET​

POST​

/e/v1/developer/scim/tokens/{token_id}/​

DELETE​

/e/v1/scim/v2/Users​

GET​

POST​

/e/v1/scim/v2/Users/{user_id}​

GET​

PUT​

PATCH​

DELETE​

/e/v1/scim/v2/Groups​

GET​

POST​

/e/v1/scim/v2/Groups/{group_id}​

GET​

PUT​

PATCH​

DELETE​

/e/v1/scim/v2/ServiceProviderConfig​

GET​

/e/v1/scim/v2/ResourceTypes​

GET​

/e/v1/scim/v2/Schemas​

GET​

`/e/v1/developer/scim/tokens/`

GET

POST

`/e/v1/developer/scim/tokens/{token_id}/`

DELETE

`/e/v1/scim/v2/Users`

GET

POST

`/e/v1/scim/v2/Users/{user_id}`

GET

PUT

PATCH

DELETE

`/e/v1/scim/v2/Groups`

GET

POST

`/e/v1/scim/v2/Groups/{group_id}`

GET

PUT

PATCH

DELETE

`/e/v1/scim/v2/ServiceProviderConfig`

GET

`/e/v1/scim/v2/ResourceTypes`

GET

`/e/v1/scim/v2/Schemas`

GET