{ "openapi": "3.0.3", "info": { "title": "ShiftForest SCIM provisioning profile", "version": "0.1.0", "description": "Configurable SAML/SCIM support. Provider commissioning is required. 128 KiB requests; 300 authenticated admissions per key per minute, plus per-process IP limits. Keys are workspace-scoped, expiring and revocable. No Bulk, sort, password changes, search POST, attribute projection or enterprise-schema extensions. No automatic permission grants." }, "servers": [ { "url": "https://api.shiftforest.com/scim/v2/{connectionId}", "variables": { "connectionId": { "default": "00000000-0000-0000-0000-000000000000", "description": "Administrator-created identity connection UUID" } } } ], "security": [ { "scimBearer": [] } ], "paths": { "/Users": { "get": { "operationId": "getUserCollection", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "200": { "description": "Success", "content": { "application/scim+json": { "schema": { "type": "object", "required": [ "schemas", "totalResults", "startIndex", "itemsPerPage", "Resources" ], "properties": { "schemas": { "type": "array", "items": { "type": "string" } }, "totalResults": { "type": "integer" }, "startIndex": { "type": "integer" }, "itemsPerPage": { "type": "integer" }, "Resources": { "type": "array", "items": { "$ref": "#/components/schemas/User" } } } } } } } }, "parameters": [ { "name": "startIndex", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 100000, "default": 1 } }, { "name": "count", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "maximum": 100, "default": 100 } }, { "name": "filter", "in": "query", "required": false, "schema": { "type": "string", "maxLength": 2048, "description": "Equality only: id, externalId, userName. Example: userName eq \"worker@example.com\". Repeated/unknown parameters are rejected." } } ] }, "post": { "operationId": "postUserCollection", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "201": { "description": "Success", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/User" } } } } }, "requestBody": { "required": true, "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/User" } } } } } }, "/Users/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "get": { "operationId": "getUserById", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "200": { "description": "Success", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/User" } } } } }, "parameters": [ { "name": "If-Match", "in": "header", "required": false, "schema": { "type": "string", "pattern": "^W/\"[1-9][0-9]*\"$", "description": "Use the resource ETag to reject stale writes." } } ] }, "put": { "operationId": "putUserById", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "200": { "description": "Success", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/User" } } } } }, "parameters": [ { "name": "If-Match", "in": "header", "required": false, "schema": { "type": "string", "pattern": "^W/\"[1-9][0-9]*\"$", "description": "Use the resource ETag to reject stale writes." } } ], "requestBody": { "required": true, "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/User" } } } } }, "patch": { "operationId": "patchUserById", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "200": { "description": "Success", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/User" } } } } }, "parameters": [ { "name": "If-Match", "in": "header", "required": false, "schema": { "type": "string", "pattern": "^W/\"[1-9][0-9]*\"$", "description": "Use the resource ETag to reject stale writes." } } ], "requestBody": { "required": true, "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Patch" } } } } }, "delete": { "operationId": "deleteUserById", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "204": { "description": "Success" } }, "parameters": [ { "name": "If-Match", "in": "header", "required": false, "schema": { "type": "string", "pattern": "^W/\"[1-9][0-9]*\"$", "description": "Use the resource ETag to reject stale writes." } } ] } }, "/Groups": { "get": { "operationId": "getGroupCollection", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "200": { "description": "Success", "content": { "application/scim+json": { "schema": { "type": "object", "required": [ "schemas", "totalResults", "startIndex", "itemsPerPage", "Resources" ], "properties": { "schemas": { "type": "array", "items": { "type": "string" } }, "totalResults": { "type": "integer" }, "startIndex": { "type": "integer" }, "itemsPerPage": { "type": "integer" }, "Resources": { "type": "array", "items": { "$ref": "#/components/schemas/Group" } } } } } } } }, "parameters": [ { "name": "startIndex", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 100000, "default": 1 } }, { "name": "count", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "maximum": 100, "default": 100 } }, { "name": "filter", "in": "query", "required": false, "schema": { "type": "string", "maxLength": 2048, "description": "Equality only: id, externalId, displayName. Example: userName eq \"worker@example.com\". Repeated/unknown parameters are rejected." } } ] }, "post": { "operationId": "postGroupCollection", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "201": { "description": "Success", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Group" } } } } }, "requestBody": { "required": true, "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Group" } } } } } }, "/Groups/{id}": { "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "get": { "operationId": "getGroupById", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "200": { "description": "Success", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Group" } } } } }, "parameters": [ { "name": "If-Match", "in": "header", "required": false, "schema": { "type": "string", "pattern": "^W/\"[1-9][0-9]*\"$", "description": "Use the resource ETag to reject stale writes." } } ] }, "put": { "operationId": "putGroupById", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "200": { "description": "Success", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Group" } } } } }, "parameters": [ { "name": "If-Match", "in": "header", "required": false, "schema": { "type": "string", "pattern": "^W/\"[1-9][0-9]*\"$", "description": "Use the resource ETag to reject stale writes." } } ], "requestBody": { "required": true, "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Group" } } } } }, "patch": { "operationId": "patchGroupById", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "200": { "description": "Success", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Group" } } } } }, "parameters": [ { "name": "If-Match", "in": "header", "required": false, "schema": { "type": "string", "pattern": "^W/\"[1-9][0-9]*\"$", "description": "Use the resource ETag to reject stale writes." } } ], "requestBody": { "required": true, "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Patch" } } } } }, "delete": { "operationId": "deleteGroupById", "responses": { "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "204": { "description": "Success" } }, "parameters": [ { "name": "If-Match", "in": "header", "required": false, "schema": { "type": "string", "pattern": "^W/\"[1-9][0-9]*\"$", "description": "Use the resource ETag to reject stale writes." } } ] } }, "/ServiceProviderConfig": { "get": { "operationId": "discoverServiceProviderConfig", "parameters": [], "responses": { "200": { "description": "Authenticated SCIM discovery", "content": { "application/scim+json": { "schema": { "type": "object" } } } }, "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/Schemas": { "get": { "operationId": "discoverSchemas", "parameters": [], "responses": { "200": { "description": "Authenticated SCIM discovery", "content": { "application/scim+json": { "schema": { "type": "object" } } } }, "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/Schemas/{schemaId}": { "get": { "operationId": "discoverSchemasschemaId", "parameters": [ { "name": "schemaId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Authenticated SCIM discovery", "content": { "application/scim+json": { "schema": { "type": "object" } } } }, "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/ResourceTypes": { "get": { "operationId": "discoverResourceTypes", "parameters": [], "responses": { "200": { "description": "Authenticated SCIM discovery", "content": { "application/scim+json": { "schema": { "type": "object" } } } }, "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/ResourceTypes/{resourceType}": { "get": { "operationId": "discoverResourceTypesresourceType", "parameters": [ { "name": "resourceType", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Authenticated SCIM discovery", "content": { "application/scim+json": { "schema": { "type": "object" } } } }, "400": { "description": "Invalid or unsupported request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid, expired, revoked or disabled credential", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Resource not found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "405": { "description": "Unsupported method", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Identity conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "412": { "description": "ETag changed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 128 KiB", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported content type", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Rate limit; retry after Retry-After seconds", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Provisioning failed", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Provisioning unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } } }, "components": { "securitySchemes": { "scimBearer": { "type": "http", "scheme": "bearer", "description": "Dedicated sfscim_ provisioning key, not an application API key or Supabase token." } }, "schemas": { "Error": { "type": "object", "required": [ "schemas", "status", "detail" ], "properties": { "schemas": { "type": "array", "items": { "type": "string" } }, "status": { "type": "string" }, "detail": { "type": "string" }, "scimType": { "type": "string" } } }, "Meta": { "type": "object", "properties": { "resourceType": { "type": "string" }, "created": { "type": "string", "format": "date-time" }, "lastModified": { "type": "string", "format": "date-time" }, "version": { "type": "string" }, "location": { "type": "string", "format": "uri" } } }, "User": { "type": "object", "required": [ "schemas", "externalId", "userName" ], "properties": { "schemas": { "type": "array", "items": { "type": "string", "enum": [ "urn:ietf:params:scim:schemas:core:2.0:User" ] } }, "id": { "type": "string", "format": "uuid" }, "externalId": { "type": "string", "minLength": 1, "maxLength": 255, "description": "Immutable provider NameID. Reserved after deletion; never match by email." }, "userName": { "type": "string", "format": "email", "maxLength": 254 }, "displayName": { "type": "string", "maxLength": 200 }, "name": { "type": "object", "properties": { "formatted": { "type": "string" }, "givenName": { "type": "string" }, "familyName": { "type": "string" } }, "additionalProperties": false }, "active": { "type": "boolean", "default": true }, "emails": { "type": "array", "minItems": 1, "maxItems": 1, "items": { "type": "object", "required": [ "value" ], "properties": { "value": { "type": "string", "format": "email" }, "type": { "type": "string", "enum": [ "work" ] }, "primary": { "type": "boolean" } } } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "description": "Provide displayName or name.formatted or givenName/familyName. Only one work email matching userName is supported. Provisioning does not grant a role or automatically bind an Auth user.", "additionalProperties": false }, "Group": { "type": "object", "required": [ "schemas", "displayName" ], "properties": { "schemas": { "type": "array", "items": { "type": "string", "enum": [ "urn:ietf:params:scim:schemas:core:2.0:Group" ] } }, "id": { "type": "string", "format": "uuid" }, "externalId": { "type": "string", "maxLength": 255 }, "displayName": { "type": "string", "minLength": 1, "maxLength": 200 }, "members": { "type": "array", "maxItems": 1000, "items": { "type": "object", "required": [ "value" ], "properties": { "value": { "type": "string", "format": "uuid" } } } }, "meta": { "$ref": "#/components/schemas/Meta" } }, "description": "Members must be users in this same identity connection. Groups do not grant permissions.", "additionalProperties": false }, "Patch": { "type": "object", "required": [ "schemas", "Operations" ], "properties": { "schemas": { "type": "array", "items": { "type": "string", "enum": [ "urn:ietf:params:scim:api:messages:2.0:PatchOp" ] } }, "Operations": { "type": "array", "minItems": 1, "maxItems": 25, "items": { "type": "object", "required": [ "op" ], "properties": { "op": { "type": "string", "enum": [ "add", "replace", "remove" ] }, "path": { "type": "string" }, "value": {} } } } }, "description": "Atomic ordered operations. Users: active, userName, displayName. Groups: displayName, members; remove also supports members[value eq \"UUID\"]. Required scalar attributes cannot be removed. externalId is immutable. Pathless add/replace accepts supported attributes only." } } } }