REST-API-Endpunkte für SCIM

About SCIM (Informationen zu SCIM)

Note

SCIM für GitHub Enterprise Server befindet sich derzeit in der beta und kann noch geändert werden. GitHub empfiehlt zuerst das Testen mit einer Staginginstanz. Weitere Informationen finden Sie unter Testinstanz einrichten.

Diese Endpunkte unterstützen nur die Authentifizierung über ein personal access token (classic). Weitere Informationen findest du unter Verwalten deiner persönlichen Zugriffstoken.

GitHub Enterprise Server stellt Endpunkte für die Verwendung durch SCIM-fähige Identitätsanbieter (Identity Providers, IdP) bereit. Bei einer Integration im IdP können mithilfe der REST-API Benutzerkonten in einer GitHub Enterprise Server-Instanz, die das einmalige Anmelden mit SAML zur Authentifizierung verwendet, automatisch bereitgestellt, verwaltet oder die Bereitstellung aufgehoben werden. Weitere Informationen finden Sie unter Informationen zu Benutzerbereitstellung mit SCIM auf GitHub Enterprise Server.

Diese Endpunkte basieren auf SCIM 2.0. Weitere Informationen findest du in der Dokumentation deines Identitätsanbieters oder in der Spezifikation auf der IETF-Website.

Stamm-URLs

Ein Identitätsanbieter kann über die folgende Stamm-URL mit den Endpunkten für eine GitHub Enterprise Server-Instanz kommunizieren.

http(s)://HOSTNAME/api/v3/scim/v2/

Schließen Sie nicht den enterprises/{enterprise}/ Teil der URLs ein, die in der unten aufgeführten Endpunktdokumentation bereitgestellt werden. Dieser Teil des Pfads gilt nicht für GitHub Enterprise Server. In Zukunft werden in dieser Dokumentation die richtigen URLs für GitHub Enterprise Server angezeigt.

Bei Endpunkten in dieser Kategorie wird Groß-/Kleinschreibung beachtet. Beispielsweise muss der erste Buchstabe des Users-Endpunkts großgeschrieben werden.

GET /scim/v2/Users/{scim_user_id}

Authentifizierung

Bei der SCIM-Integration mit dem Identitätsanbieter werden Aktionen im Auftrag eines Unternehmensbesitzers für die GitHub Enterprise Server-Instanz ausgeführt. Weitere Informationen findest du unter Rollen in einem Unternehmen.

Zur Authentifizierung von API-Anforderungen ist für die SCIM-Konfiguration beim Identitätsanbieter personal access token (classic) mit dem Bereich admin:enterprise erforderlich, die der Identitätsanbieter im Authorization-Header der Anforderung bereitstellen muss. Weitere Informationen zu personal access tokens (classic) findest du unter Verwalten deiner persönlichen Zugriffstoken.

Hinweis: Unternehmensbesitzer müssen für die Authentifizierung von Anforderungen an Endpunkte in dieser Kategorie ein personal access token (classic) generieren und verwenden. Fine-grained personal access token and Aufrufer der GitHub-App werden derzeit nicht unterstützt.

Zuordnen von SAML- und SCIM-Daten

Die GitHub Enterprise Server-Instanz verknüpft alle Benutzerinnen, die sich erfolgreich über die einmalige Anmeldung mit SAML authentifiziert haben, mit einer SCIM-Identität. Für eine erfolgreiche Verknüpfung der Identitäten müssen der SAML-Identitätsanbieter und die SCIM-Integration für alle Benutzerinnen übereinstimmende SAML-NameID- und SCIM-userName-Werte verwenden.

Hinweis: Wenn GitHub Enterprise Server Entra ID als SAML-Identitätsanbieter verwendet, überprüft GitHub Enterprise Server auch den SCIM-Anspruch externalId und den SAML-Anspruch http://schemas.microsoft.com/identity/claims/objectidentifier, anstelle von NameID und userName, um Benutzer*innen abzugleichen.

Unterstützte SCIM-Benutzerattribute

User-Endpunkte in dieser Kategorie unterstützen innerhalb eines Anforderungsparameters die folgenden Attribute.

Name	Typ	Beschreibung
`displayName`	String	Für Menschen lesbarer Benutzername.
`name.formatted`	String	Der vollständige und für die Anzeige formatierte Name des Benutzers/der Benutzerin, einschließlich aller zweiter Vornamen, Titel und Namenszusätze.
`name.givenName`	String	Der Vorname des Benutzers.
`name.familyName`	String	Der Nachname des Benutzers.
`userName`	String	Der vom Identitätsanbieter generierte Benutzername des Benutzers/der Benutzerin. Wird vor der Verwendung einer Normalisierung unterzogen.
`emails`	Array	Liste der Benutzer-E-Mails.
`roles`	Array	Liste der Benutzerrollen.
`externalId`	String	Dieser Bezeichner wird von einem Identitätsanbieter generiert. Du findest die `externalId` für Benutzer*innen entweder beim Identitätsanbieter oder indem du den Endpunkt zum Auflisten durch SCIM bereitgestellter Identitäten verwendest und nach anderen bekannten Attributen filterst, z. B. dem Benutzernamen oder der E-Mail-Adresse in der GitHub Enterprise Server-Instanz.
`id`	String	Vom SCIM-Endpunkt der Instanz generierter Bezeichner.
`active`	Boolean	Gibt an, ob die Identität aktiv ist (`true`) oder angehalten werden soll (`false`).

List provisioned SCIM groups for an enterprise

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Lists provisioned SCIM groups in an enterprise.

You can improve query search time by using the excludedAttributes query parameter with a value of members to exclude members from the response.

Differenzierte Zugriffstoken für "List provisioned SCIM groups for an enterprise"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „List provisioned SCIM groups for an enterprise“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Abfrageparameter
Name, type, BESCHREIBUNG
`filter` string If specified, only results that match the specified filter will be returned. Multiple filters are not supported. Possible filters are `externalId`, `id`, and `displayName`. For example, `?filter="externalId eq '9138790-10932-109120392-12321'"`.
`excludedAttributes` string Excludes the specified attribute from being returned in the results. Using this parameter can speed up response time.
`startIndex` integer Used for pagination: the starting index of the first result to return when paginating through values. Standard: `1`
`count` integer Used for pagination: the number of results to return per page. Standard: `30`

HTTP-Antwortstatuscodes für „List provisioned SCIM groups for an enterprise“

Statuscode	BESCHREIBUNG
`200`	Success, either groups were found or not found
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „List provisioned SCIM groups for an enterprise“

Anforderungsbeispiel

get/scim/v2/enterprises/{enterprise}/Groups

curl -L \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Groups

Success, either groups were found or not found

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 1,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "externalId": "8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159",
      "id": "927fa2c08dcb4a7fae9e",
      "displayName": "Engineering",
      "members": [
        {
          "value": "879db59-3bdf-4490-ad68-ab880a2694745",
          "$+ref": "https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745",
          "displayName": "User 1"
        },
        {
          "value": "0db508eb-91e2-46e4-809c-30dcbda0c685",
          "$+ref": "https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685",
          "displayName": "User 2"
        }
      ],
      "meta": {
        "resourceType": "Group",
        "created": "2012-03-27T19:59:26.000Z",
        "lastModified": "2018-03-27T19:59:26.000Z",
        "location": "https://api.github.localhost/scim/v2/Groups/927fa2c08dcb4a7fae9e"
      }
    }
  ],
  "startIndex": 1,
  "itemsPerPage": 20
}

Provision a SCIM enterprise group

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Creates a SCIM group for an enterprise.

If members are included as part of the group provisioning payload, they will be created as external group members. It is up to a provider to store a mapping between the externalId and id of each user.

Differenzierte Zugriffstoken für "Provision a SCIM enterprise group"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Provision a SCIM enterprise group“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Name, type, BESCHREIBUNG

schemas array of strings Erforderlich

The URIs that are used to indicate the namespaces of the SCIM schemas. Supported values are: urn:ietf:params:scim:schemas:core:2.0:Group

externalId string Erforderlich

A unique identifier for the resource as defined by the provisioning client.

displayName string Erforderlich

A human-readable name for a security group.

members array of objects Erforderlich

The group members.

Properties of members

Name, type, BESCHREIBUNG
`value` string Erforderlich The local unique identifier for the member
`displayName` string Erforderlich The display name associated with the member

HTTP-Antwortstatuscodes für „Provision a SCIM enterprise group“

Statuscode	BESCHREIBUNG
`201`	Group has been created
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`409`	Duplicate record detected
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Provision a SCIM enterprise group“

Anforderungsbeispiel

post/scim/v2/enterprises/{enterprise}/Groups

curl -L \
  -X POST \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Groups \
  -d '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"externalId":"8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159","displayName":"Engineering"}'

Group has been created

Status: 201

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "id": "abcd27f8-a9aa-11ea-8221-f59b2be9cccc",
  "externalId": "8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159",
  "displayName": "Engineering",
  "members": [
    {
      "value": "879db59-3bdf-4490-ad68-ab880a2694745",
      "$+ref": "https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745",
      "displayName": "User 1"
    },
    {
      "value": "0db508eb-91e2-46e4-809c-30dcbda0c685",
      "$+ref": "https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685",
      "displayName": "User 2"
    }
  ],
  "meta": {
    "resourceType": "Group",
    "created": "2012-03-27T19:59:26.000Z",
    "lastModified": "2018-03-27T19:59:26.000Z",
    "location": "https://api.github.localhost/scim/v2/Groups/927fa2c08dcb4a7fae9e"
  }
}

Get SCIM provisioning information for an enterprise group

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Gets information about a SCIM group.

Differenzierte Zugriffstoken für "Get SCIM provisioning information for an enterprise group"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Get SCIM provisioning information for an enterprise group“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`scim_group_id` string Erforderlich A unique identifier of the SCIM group.
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Abfrageparameter
Name, type, BESCHREIBUNG
`excludedAttributes` string Excludes the specified attribute from being returned in the results. Using this parameter can speed up response time.

HTTP-Antwortstatuscodes für „Get SCIM provisioning information for an enterprise group“

Statuscode	BESCHREIBUNG
`200`	Success, a group was found
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`404`	Resource not found
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Get SCIM provisioning information for an enterprise group“

Anforderungsbeispiel

get/scim/v2/enterprises/{enterprise}/Groups/{scim_group_id}

curl -L \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Groups/SCIM_GROUP_ID

Success, a group was found

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "id": "abcd27f8-a9aa-11ea-8221-f59b2be9cccc",
  "externalId": "8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159",
  "displayName": "Engineering",
  "members": [
    {
      "value": "879db59-3bdf-4490-ad68-ab880a2694745",
      "$+ref": "https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745",
      "displayName": "User 1"
    },
    {
      "value": "0db508eb-91e2-46e4-809c-30dcbda0c685",
      "$+ref": "https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685",
      "displayName": "User 2"
    }
  ],
  "meta": {
    "resourceType": "Group",
    "created": "2012-03-27T19:59:26.000Z",
    "lastModified": "2018-03-27T19:59:26.000Z",
    "location": "https://api.github.localhost/scim/v2/Groups/927fa2c08dcb4a7fae9e"
  }
}

Set SCIM information for a provisioned enterprise group

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Replaces an existing provisioned group’s information.

You must provide all the information required for the group as if you were provisioning it for the first time. Any existing group information that you don't provide will be removed, including group membership. If you want to only update a specific attribute, use the Update an attribute for a SCIM enterprise group endpoint instead.

Differenzierte Zugriffstoken für "Set SCIM information for a provisioned enterprise group"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Set SCIM information for a provisioned enterprise group“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`scim_group_id` string Erforderlich A unique identifier of the SCIM group.
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Name, type, BESCHREIBUNG

schemas array of strings Erforderlich

The URIs that are used to indicate the namespaces of the SCIM schemas. Supported values are: urn:ietf:params:scim:schemas:core:2.0:Group

externalId string Erforderlich

A unique identifier for the resource as defined by the provisioning client.

displayName string Erforderlich

A human-readable name for a security group.

members array of objects Erforderlich

The group members.

Properties of members

Name, type, BESCHREIBUNG
`value` string Erforderlich The local unique identifier for the member
`displayName` string Erforderlich The display name associated with the member

HTTP-Antwortstatuscodes für „Set SCIM information for a provisioned enterprise group“

Statuscode	BESCHREIBUNG
`200`	Group was updated
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`404`	Resource not found
`409`	Duplicate record detected
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Set SCIM information for a provisioned enterprise group“

Beispiele für Anforderungen

Select the example type

put/scim/v2/enterprises/{enterprise}/Groups/{scim_group_id}

curl -L \
  -X PUT \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Groups/SCIM_GROUP_ID \
  -d '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"externalId":"8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159","displayName":"Engineering"}'

Group was updated

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "id": "abcd27f8-a9aa-11ea-8221-f59b2be9cccc",
  "externalId": "8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159",
  "displayName": "Engineering",
  "members": [
    {
      "value": "879db59-3bdf-4490-ad68-ab880a2694745",
      "$+ref": "https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745",
      "displayName": "User 1"
    },
    {
      "value": "0db508eb-91e2-46e4-809c-30dcbda0c685",
      "$+ref": "https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685",
      "displayName": "User 2"
    }
  ],
  "meta": {
    "resourceType": "Group",
    "created": "2012-03-27T19:59:26.000Z",
    "lastModified": "2018-03-27T19:59:26.000Z",
    "location": "https://api.github.localhost/scim/v2/Groups/927fa2c08dcb4a7fae9e"
  }
}

Update an attribute for a SCIM enterprise group

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Update a provisioned group’s individual attributes.

To change a group’s values, you must provide a specific Operations JSON format that contains at least one of the add, remove, or replace operations. For examples and more information on the SCIM operations format, see the SCIM specification. Update can also be used to add group memberships.

Group memberships can be sent one at a time or in batches for faster performance. Note: The memberships are referenced through a local user id, and the user will need to be created before they are referenced here.

Differenzierte Zugriffstoken für "Update an attribute for a SCIM enterprise group"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Update an attribute for a SCIM enterprise group“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`scim_group_id` string Erforderlich A unique identifier of the SCIM group.
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Name, type, BESCHREIBUNG

Operations array of objects Erforderlich

patch operations list

Properties of Operations

Name, type, BESCHREIBUNG
`op` string Erforderlich Kann eine der Folgenden sein: `add`, `replace`, `remove`
`path` string
`value` string Corresponding 'value' of that field specified by 'path'

schemas array of strings Erforderlich

undefinedSupported values are: urn:ietf:params:scim:api:messages:2.0:PatchOp

HTTP-Antwortstatuscodes für „Update an attribute for a SCIM enterprise group“

Statuscode	BESCHREIBUNG
`200`	Success, group was updated
`204`	No Content
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`404`	Resource not found
`409`	Duplicate record detected
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Update an attribute for a SCIM enterprise group“

Beispiele für Anforderungen

Select the example type

patch/scim/v2/enterprises/{enterprise}/Groups/{scim_group_id}

curl -L \
  -X PATCH \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Groups/SCIM_GROUP_ID \
  -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"replace","path":"displayName","value":"Employees"}]}'

Success, group was updated

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "id": "abcd27f8-a9aa-11ea-8221-f59b2be9cccc",
  "externalId": "8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159",
  "displayName": "Engineering",
  "members": [
    {
      "value": "879db59-3bdf-4490-ad68-ab880a2694745",
      "$+ref": "https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745",
      "displayName": "User 1"
    },
    {
      "value": "0db508eb-91e2-46e4-809c-30dcbda0c685",
      "$+ref": "https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685",
      "displayName": "User 2"
    }
  ],
  "meta": {
    "resourceType": "Group",
    "created": "2012-03-27T19:59:26.000Z",
    "lastModified": "2018-03-27T19:59:26.000Z",
    "location": "https://api.github.localhost/scim/v2/Groups/927fa2c08dcb4a7fae9e"
  }
}

Delete a SCIM group from an enterprise

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Deletes a SCIM group from an enterprise.

Differenzierte Zugriffstoken für "Delete a SCIM group from an enterprise"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Delete a SCIM group from an enterprise“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`scim_group_id` string Erforderlich A unique identifier of the SCIM group.
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

HTTP-Antwortstatuscodes für „Delete a SCIM group from an enterprise“

Statuscode	BESCHREIBUNG
`204`	Group was deleted, no content
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`404`	Resource not found
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Delete a SCIM group from an enterprise“

Anforderungsbeispiel

delete/scim/v2/enterprises/{enterprise}/Groups/{scim_group_id}

curl -L \
  -X DELETE \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Groups/SCIM_GROUP_ID

Group was deleted, no content

Status: 204

List SCIM provisioned identities for an enterprise

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Lists provisioned SCIM enterprise members.

When a user with a SCIM-provisioned external identity is removed from an enterprise through a patch with active flag set to false, the account's metadata is preserved to allow the user to re-join the enterprise in the future. However, the user's account will be suspended and the user will not be able to sign-in. In order to permanently suspend the users account with no ability to re-join the enterprise in the future, use the delete request. Users that were not permanently deleted will be visible in the returned results.

Differenzierte Zugriffstoken für "List SCIM provisioned identities for an enterprise"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „List SCIM provisioned identities for an enterprise“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Abfrageparameter
Name, type, BESCHREIBUNG
`filter` string If specified, only results that match the specified filter will be returned. Multiple filters are not supported. Possible filters are `userName`, `externalId`, `id`, and `displayName`. For example, `?filter="externalId eq '9138790-10932-109120392-12321'"`.
`startIndex` integer Used for pagination: the starting index of the first result to return when paginating through values. Standard: `1`
`count` integer Used for pagination: the number of results to return per page. Standard: `30`

HTTP-Antwortstatuscodes für „List SCIM provisioned identities for an enterprise“

Statuscode	BESCHREIBUNG
`200`	Success, either users were found or not found
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „List SCIM provisioned identities for an enterprise“

Anforderungsbeispiel

get/scim/v2/enterprises/{enterprise}/Users

curl -L \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Users

Success, either users were found or not found

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 1,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "externalId": "E012345",
      "id": "7fce0092-d52e-4f76-b727-3955bd72c939",
      "active": true,
      "userName": "E012345",
      "name": {
        "formatted": "Ms. Mona Lisa Octocat",
        "familyName": "Octocat",
        "givenName": "Mona",
        "middleName": "Lisa"
      },
      "displayName": "Mona Lisa",
      "emails": [
        {
          "value": "mlisa@example.com",
          "type": "work",
          "primary": true
        }
      ],
      "roles": [
        {
          "value": "User",
          "primary": false
        }
      ]
    }
  ],
  "startIndex": 1,
  "itemsPerPage": 20
}

Provision a SCIM enterprise user

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Creates an external identity for a new SCIM enterprise user.

SCIM does not authenticate users, it only provisions them. The authentication of users is done by SAML. However, when SCIM is enabled, all users need to be provisioned through SCIM before a user can sign in through SAML. The matching of a user to a SCIM provisioned user is done when the SAML assertion is consumed. The user will be matched on SAML response NameID to SCIM userName.

When converting existing enterprise to use SCIM, the user handle (userName) from the SCIM payload will be used to match the provisioned user to an already existing user in the enterprise. Since the new identity record is created for newly provisioned users the matching for those records is done using a user's handle. Currently the matching will be performed to all of the users no matter if they were SAML JIT provisioned or created as local users.

Differenzierte Zugriffstoken für "Provision a SCIM enterprise user"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Provision a SCIM enterprise user“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Name, type, BESCHREIBUNG

schemas array of strings Erforderlich

The URIs that are used to indicate the namespaces of the SCIM schemas. Supported values are: urn:ietf:params:scim:schemas:core:2.0:User

externalId string Erforderlich

A unique identifier for the resource as defined by the provisioning client.

active boolean Erforderlich

Whether the user active in the IdP.

userName string Erforderlich

The username for the user.

name object

Properties of name

Name, type, BESCHREIBUNG
`formatted` string The full name, including all middle names, titles, and suffixes as appropriate, formatted for display.
`familyName` string Erforderlich The family name of the user.
`givenName` string Erforderlich The given name of the user.
`middleName` string The middle name(s) of the user.

displayName string Erforderlich

A human-readable name for the user.

emails array of objects Erforderlich

The emails for the user.

Properties of emails

Name, type, BESCHREIBUNG
`value` string Erforderlich The email address.
`type` string Erforderlich The type of email address.
`primary` boolean Erforderlich Whether this email address is the primary address.

roles array of objects

The roles assigned to the user.

Properties of roles

Name, type, BESCHREIBUNG
`display` string
`type` string
`value` string Erforderlich The role value representing a user role in GitHub. Kann eine der Folgenden sein: `user`, `27d9891d-2c17-4f45-a262-781a0e55c80a`, `guest_collaborator`, `1ebc4a02-e56c-43a6-92a5-02ee09b90824`, `enterprise_owner`, `981df190-8801-4618-a08a-d91f6206c954`, `ba4987ab-a1c3-412a-b58c-360fc407cb10`, `billing_manager`, `0e338b8c-cc7f-498a-928d-ea3470d7e7e3`, `e6be2762-e4ad-4108-b72d-1bbe884a0f91`
`primary` boolean Is the role a primary role for the user.

HTTP-Antwortstatuscodes für „Provision a SCIM enterprise user“

Statuscode	BESCHREIBUNG
`201`	User has been created
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`409`	Duplicate record detected
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Provision a SCIM enterprise user“

Beispiele für Anforderungen

Select the example type

post/scim/v2/enterprises/{enterprise}/Users

curl -L \
  -X POST \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Users \
  -d '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"externalId":"E012345","active":true,"userName":"E012345","name":{"formatted":"Ms. Mona Lisa Octocat","familyName":"Octocat","givenName":"Mona","middleName":"Lisa"},"displayName":"Mona Lisa","emails":[{"value":"mlisa@example.com","type":"work","primary":true}],"roles":[{"value":"User","primary":false}]}'

User has been created

Status: 201

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "7fce0092-d52e-4f76-b727-3955bd72c939",
  "externalId": "E012345",
  "active": true,
  "userName": "E012345",
  "name": {
    "formatted": "Ms. Mona Lisa Octocat",
    "familyName": "Octocat",
    "givenName": "Mona",
    "middleName": "Lisa"
  },
  "displayName": "Mona Lisa",
  "emails": [
    {
      "value": "mlisa@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "roles": [
    {
      "value": "User",
      "primary": false
    }
  ],
  "meta": {
    "resourceType": "User",
    "created": "2012-03-27T19:59:26.000Z",
    "lastModified": "2018-03-27T19:59:26.000Z",
    "location": "https://api.github.localhost/scim/v2/Users/7fce0092-d52e-4f76-b727-3955bd72c939"
  }
}

Get SCIM provisioning information for an enterprise user

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Gets information about a SCIM user.

Differenzierte Zugriffstoken für "Get SCIM provisioning information for an enterprise user"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Get SCIM provisioning information for an enterprise user“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`scim_user_id` string Erforderlich The unique identifier of the SCIM user.
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

HTTP-Antwortstatuscodes für „Get SCIM provisioning information for an enterprise user“

Statuscode	BESCHREIBUNG
`200`	Success, a user was found
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`404`	Resource not found
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Get SCIM provisioning information for an enterprise user“

Anforderungsbeispiel

get/scim/v2/enterprises/{enterprise}/Users/{scim_user_id}

curl -L \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Users/SCIM_USER_ID

Success, a user was found

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "7fce0092-d52e-4f76-b727-3955bd72c939",
  "externalId": "E012345",
  "active": true,
  "userName": "E012345",
  "name": {
    "formatted": "Ms. Mona Lisa Octocat",
    "familyName": "Octocat",
    "givenName": "Mona",
    "middleName": "Lisa"
  },
  "displayName": "Mona Lisa",
  "emails": [
    {
      "value": "mlisa@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "roles": [
    {
      "value": "User",
      "primary": false
    }
  ],
  "meta": {
    "resourceType": "User",
    "created": "2012-03-27T19:59:26.000Z",
    "lastModified": "2018-03-27T19:59:26.000Z",
    "location": "https://api.github.localhost/scim/v2/Users/7fce0092-d52e-4f76-b727-3955bd72c939"
  }
}

Set SCIM information for a provisioned enterprise user

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Replaces an existing provisioned user's information.

You must provide all the information required for the user as if you were provisioning them for the first time. Any existing user information that you don't provide will be removed. If you want to only update a specific attribute, use the Update an attribute for a SCIM user endpoint instead.

Warning

Setting active: false will suspend a user and obfuscate the user handle and user email. Since the implementation is a generic SCIM implementation and does not differentiate yet between different IdP providers, for Okta, the user GDPR data will not be purged and the credentials will not be removed.

Differenzierte Zugriffstoken für "Set SCIM information for a provisioned enterprise user"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Set SCIM information for a provisioned enterprise user“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`scim_user_id` string Erforderlich The unique identifier of the SCIM user.
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Name, type, BESCHREIBUNG

schemas array of strings Erforderlich

The URIs that are used to indicate the namespaces of the SCIM schemas. Supported values are: urn:ietf:params:scim:schemas:core:2.0:User

externalId string Erforderlich

A unique identifier for the resource as defined by the provisioning client.

active boolean Erforderlich

Whether the user active in the IdP.

userName string Erforderlich

The username for the user.

name object

Properties of name

Name, type, BESCHREIBUNG
`formatted` string The full name, including all middle names, titles, and suffixes as appropriate, formatted for display.
`familyName` string Erforderlich The family name of the user.
`givenName` string Erforderlich The given name of the user.
`middleName` string The middle name(s) of the user.

displayName string Erforderlich

A human-readable name for the user.

emails array of objects Erforderlich

The emails for the user.

Properties of emails

Name, type, BESCHREIBUNG
`value` string Erforderlich The email address.
`type` string Erforderlich The type of email address.
`primary` boolean Erforderlich Whether this email address is the primary address.

roles array of objects

The roles assigned to the user.

Properties of roles

Name, type, BESCHREIBUNG
`display` string
`type` string
`value` string Erforderlich The role value representing a user role in GitHub. Kann eine der Folgenden sein: `user`, `27d9891d-2c17-4f45-a262-781a0e55c80a`, `guest_collaborator`, `1ebc4a02-e56c-43a6-92a5-02ee09b90824`, `enterprise_owner`, `981df190-8801-4618-a08a-d91f6206c954`, `ba4987ab-a1c3-412a-b58c-360fc407cb10`, `billing_manager`, `0e338b8c-cc7f-498a-928d-ea3470d7e7e3`, `e6be2762-e4ad-4108-b72d-1bbe884a0f91`
`primary` boolean Is the role a primary role for the user.

HTTP-Antwortstatuscodes für „Set SCIM information for a provisioned enterprise user“

Statuscode	BESCHREIBUNG
`200`	User was updated
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`404`	Resource not found
`409`	Duplicate record detected
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Set SCIM information for a provisioned enterprise user“

Anforderungsbeispiel

put/scim/v2/enterprises/{enterprise}/Users/{scim_user_id}

curl -L \
  -X PUT \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Users/SCIM_USER_ID \
  -d '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"externalId":"E012345","active":true,"userName":"E012345","name":{"formatted":"Ms. Mona Lisa Octocat","familyName":"Octocat","givenName":"Mona","middleName":"Lisa"},"displayName":"Mona Lisa","emails":[{"value":"mlisa@example.com","type":"work","primary":true}],"roles":[{"value":"User","primary":false}]}'

User was updated

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "7fce0092-d52e-4f76-b727-3955bd72c939",
  "externalId": "E012345",
  "active": true,
  "userName": "E012345",
  "name": {
    "formatted": "Ms. Mona Lisa Octocat",
    "familyName": "Octocat",
    "givenName": "Mona",
    "middleName": "Lisa"
  },
  "displayName": "Mona Lisa",
  "emails": [
    {
      "value": "mlisa@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "roles": [
    {
      "value": "User",
      "primary": false
    }
  ],
  "meta": {
    "resourceType": "User",
    "created": "2012-03-27T19:59:26.000Z",
    "lastModified": "2018-03-27T19:59:26.000Z",
    "location": "https://api.github.localhost/scim/v2/Users/7fce0092-d52e-4f76-b727-3955bd72c939"
  }
}

Update an attribute for a SCIM enterprise user

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Update a provisioned user's individual attributes.

To change a user's values, you must provide a specific Operations JSON format that contains at least one of the add, remove, or replace operations. For examples and more information on the SCIM operations format, see the SCIM specification.

Note

Complicated SCIM path selectors that include filters are not supported. For example, a path selector defined as "path": "emails[type eq \"work\"]" will not work.

Warning

Setting active: false will suspend a user and obfuscate the user handle and user email. Since the implementation is a generic SCIM implementation and does not differentiate yet between different IdP providers, for Okta, the user GDPR data will not be purged and the credentials will not be removed.

{
  "Operations":[{
    "op":"replace",
    "value":{
      "active":false
    }
  }]
}

Differenzierte Zugriffstoken für "Update an attribute for a SCIM enterprise user"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Update an attribute for a SCIM enterprise user“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`scim_user_id` string Erforderlich The unique identifier of the SCIM user.
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Name, type, BESCHREIBUNG

Operations array of objects Erforderlich

patch operations list

Properties of Operations

Name, type, BESCHREIBUNG
`op` string Erforderlich Kann eine der Folgenden sein: `add`, `replace`, `remove`
`path` string
`value` string Corresponding 'value' of that field specified by 'path'

schemas array of strings Erforderlich

undefinedSupported values are: urn:ietf:params:scim:api:messages:2.0:PatchOp

HTTP-Antwortstatuscodes für „Update an attribute for a SCIM enterprise user“

Statuscode	BESCHREIBUNG
`200`	Success, user was updated
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`404`	Resource not found
`409`	Duplicate record detected
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Update an attribute for a SCIM enterprise user“

Beispiele für Anforderungen

Select the example type

patch/scim/v2/enterprises/{enterprise}/Users/{scim_user_id}

curl -L \
  -X PATCH \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Users/SCIM_USER_ID \
  -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"replace","path":"emails[type eq '\''work'\''].value","value":"updatedEmail@microsoft.com"},{"op":"replace","path":"name.familyName","value":"updatedFamilyName"}]}'

Success, user was updated

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "7fce0092-d52e-4f76-b727-3955bd72c939",
  "externalId": "E012345",
  "active": true,
  "userName": "E012345",
  "name": {
    "formatted": "Ms. Mona Lisa Octocat",
    "familyName": "Octocat",
    "givenName": "Mona",
    "middleName": "Lisa"
  },
  "displayName": "Mona Lisa",
  "emails": [
    {
      "value": "mlisa@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "roles": [
    {
      "value": "User",
      "primary": false
    }
  ],
  "meta": {
    "resourceType": "User",
    "created": "2012-03-27T19:59:26.000Z",
    "lastModified": "2018-03-27T19:59:26.000Z",
    "location": "https://api.github.localhost/scim/v2/Users/7fce0092-d52e-4f76-b727-3955bd72c939"
  }
}

Delete a SCIM user from an enterprise

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Permanently suspends a SCIM user from an enterprise, removes all data for the user, obfuscates the login, email, and display name of the user, removes all external-identity SCIM attributes, and deletes the emails, avatar, PATs, SSH keys, OAuth authorizations credentials, GPG keys, and SAML mappings for the user. You will not be able to undo this action.

Differenzierte Zugriffstoken für "Delete a SCIM user from an enterprise"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss einen der folgenden Berechtigungssätze aufweisen.:

"Enterprise administration" business permissions (write)

Parameter für „Delete a SCIM user from an enterprise“

Header
Name, type, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, type, BESCHREIBUNG
`scim_user_id` string Erforderlich The unique identifier of the SCIM user.
`enterprise` string Erforderlich The slug version of the enterprise name. You can also substitute this value with the enterprise id.

HTTP-Antwortstatuscodes für „Delete a SCIM user from an enterprise“

Statuscode	BESCHREIBUNG
`204`	User was deleted, no content
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`404`	Resource not found
`429`	Too many requests
`500`	Internal server error

Codebeispiele für „Delete a SCIM user from an enterprise“

Anforderungsbeispiel

delete/scim/v2/enterprises/{enterprise}/Users/{scim_user_id}

curl -L \
  -X DELETE \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Users/SCIM_USER_ID

User was deleted, no content

Status: 204