SCIM 的 REST API 端点

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Lists provisioned SCIM groups in an enterprise.

You can improve query search time by using the excludedAttributes query parameter with a value of members to exclude members from the response.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Creates a SCIM group for an enterprise.

When members are part of the group provisioning payload, they're designated as external group members. Providers are responsible for maintaining a mapping between the externalId and id for each user.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Gets information about a SCIM group.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Replaces an existing provisioned group’s information.

You must provide all the information required for the group as if you were provisioning it for the first time. Any existing group information that you don't provide will be removed, including group membership. If you want to only update a specific attribute, use the Update an attribute for a SCIM enterprise group endpoint instead.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Update a provisioned group’s individual attributes.

To modify a group's values, you'll need to use a specific Operations JSON format which must include at least one of the following operations: add, remove, or replace. For examples and more information on this SCIM format, consult the SCIM specification. The update function can also be used to add group memberships.

You can submit group memberships individually or in batches for improved efficiency.

Note: Memberships are referenced via a local user id. Ensure users are created before referencing them here.

Note: SCIM provisioning using the REST API is in public beta and subject to change.

Deletes a SCIM group from an enterprise.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Lists provisioned SCIM enterprise members.

When you remove a user with a SCIM-provisioned external identity from an enterprise using a patch with active flag to false, the user's metadata remains intact. This means they can potentially re-join the enterprise later. Although, while suspended, the user can't sign in. If you want to ensure the user can't re-join in the future, use the delete request. Only users who weren't permanently deleted will appear in the result list.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Creates an external identity for a new SCIM enterprise user.

SCIM is responsible for user provisioning, not authentication. The actual user authentication is handled by SAML. However, with SCIM enabled, users must first be provisioned via SCIM before they can sign in through SAML.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Gets information about a SCIM user.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Replaces an existing provisioned user's information.

You must supply complete user information, just as you would when provisioning them initially. Any previously existing data not provided will be deleted. To update only a specific attribute, refer to the Update an attribute for a SCIM user endpoint.

Warning: Setting active: false will suspend a user, and their handle and email will be obfuscated.

Note: SCIM provisioning for users and groups using the REST API is in public beta and subject to change.

Update a provisioned user's individual attributes.

To modify a user's attributes, you'll need to provide a Operations JSON formatted request that includes at least one of the following actions: add, remove, or replace. For specific examples and more information on the SCIM operations format, please refer to the SCIM specification.

Note: Complex SCIM path selectors that include filters are not supported. For example, a path selector defined as "path": "emails[type eq \"work\"]" will be ineffective.

Warning: Setting active: false will suspend a user, and their handle and email will be obfuscated.

{
  "Operations":[{
    "op":"replace",
    "value":{
      "active":false
    }
  }]
}

Note: SCIM provisioning using the REST API is in public beta and subject to change.

Suspends a SCIM user permanently from an enterprise. This action will: remove all the user's data, anonymize their login, email, and display name, erase all external identity SCIM attributes, delete the user's emails, avatar, PATs, SSH keys, OAuth authorizations, GPG keys, and SAML mappings. This action is irreversible.