AuthOS exposes SCIM user and group provisioning under /scim/v2. Authenticate
every request with Authorization: Bearer <scim-token>. Create and revoke those
tokens through the organization SCIM-token API; do not use user access tokens or
service API keys on this surface.
The token fixes the tenant scope. Resource identifiers from another tenant are not disclosed.
User endpoints
| Method | Path |
|---|---|
GET, POST |
/scim/v2/Users |
GET, PUT, PATCH, DELETE |
/scim/v2/Users/{id} |
User resources use the core User schema URN and expose id, externalId,
userName, name, displayName, emails, active, and SCIM meta fields as
applicable. List responses use SCIM pagination fields and a capitalized
Resources array.
Group endpoints
| Method | Path |
|---|---|
GET, POST |
/scim/v2/Groups |
GET, PUT, PATCH, DELETE |
/scim/v2/Groups/{id} |
Group resources expose id, externalId, displayName, optional members,
and SCIM meta. Group membership maps to organization membership and remains
tenant-scoped.
Writes
PUT is a full resource update and rejects a body id that differs from the
path. PATCH requires the
urn:ietf:params:scim:api:messages:2.0:PatchOp schema and an Operations array.
Supported operation names are add, remove, and replace; supported paths
are deliberately limited by the user and group handlers.
Send Content-Type: application/scim+json or JSON. Malformed bodies and SCIM
validation failures return SCIM Error resources with the standard error schema,
numeric status, optional scimType, and detail.
Security checklist
- Generate a separate token for each provisioning integration.
- Store tokens only in the identity provider’s secret store.
- Revoke a token immediately when an integration is retired or compromised.
- Use TLS and never place tokens in URLs or logs.
- Treat deactivation and deletion as distinct lifecycle actions.
- Verify provisioning in a non-production organization before rollout.
The Complete Endpoint Catalog is the authoritative method/path inventory.