SCIM 2.0 provisioning

SCIM is a separate externally facing identity-management surface under /scim/v2. Configure it through your identity provider and StackAI's SCIM settings. Use the dedicated SCIM bearer token and application/scim+json payloads for provisioning; normal workflow API keys are not interchangeable. See the existing StackAI SCIM setup guide.

Use the discovery endpoints below to read the SCIM capabilities and schemas available in your deployment. SCIM responses follow their own protocol rather than the REST v2 envelope.

Method	Path	Usage
GET	/scim/v2/ServiceProviderConfig	Discover supported provisioning capabilities before configuring the IdP
GET	/scim/v2/ResourceTypes	Discover Users and Groups resource types
GET	/scim/v2/ResourceTypes/{resource_type_id}	Read one resource-type descriptor
GET	/scim/v2/Schemas	Discover schema attributes and extensions
GET	/scim/v2/Schemas/{schema_id}	Read a specific schema URI
GET	/scim/v2/Users	List/filter users with startIndex and count
POST	/scim/v2/Users	Provision a user from a SCIM user body; retain returned ID
GET	/scim/v2/Users/{user_id}	Read the provisioned user by SCIM ID
PUT	/scim/v2/Users/{user_id}	Replace the user's supported attributes using a complete desired representation
PATCH	/scim/v2/Users/{user_id}	Apply SCIM PatchOp operations, such as updating active state
DELETE	/scim/v2/Users/{user_id}	Deprovision the user; treat this as an access-changing action
GET	/scim/v2/Groups	List/filter groups; use the returned SCIM IDs
POST	/scim/v2/Groups	Create a group and supported membership representation
GET	/scim/v2/Groups/{group_id}	Read a group and its members
PUT	/scim/v2/Groups/{group_id}	Replace the supported group representation
PATCH	/scim/v2/Groups/{group_id}	Add/remove members with SCIM PatchOp semantics
DELETE	/scim/v2/Groups/{group_id}	Delete the group; review membership/access effects first

Read discovery → match existing users by a supported filter → create or update → reconcile group membership → verify by GET → deprovision when the IdP revokes access. User filters include userName eq "[e-mail]", externalId eq "idp-id", and supported email filters. URL-encode the filter. Pagination is 1-based; count=0 requests totals without Resources. A SCIM ID, an external IdP ID, and a StackAI project/user identifier should not be guessed interchangeable.

curl --fail-with-body -sS --get "$STACKAI_BASE_URL/scim/v2/Users" \
  -H "Authorization: Bearer $STACKAI_SCIM_TOKEN" \
  -H 'Accept: application/scim+json' \
  --data-urlencode 'filter=userName eq "[e-mail]"' \
  --data-urlencode 'startIndex=1' --data-urlencode 'count=100'

SCIM error responses and Resources/totalResults pagination follow the provisioning protocol, not the v2 REST data envelope. Do not use the generic REST client's parsing rules without a SCIM adapter.