SCIM provisioning

SCIM synchronizes organization membership from an identity provider. It is separate from SSO and from tenant API keys: SSO signs people in, SCIM creates and removes their membership.

Connect an identity provider

curl https://api.aacsearch.com/scim/v2/ServiceProviderConfig \
  -H "Authorization: Bearer $SCIM_TOKEN"

Verify: the config answers 200 and lists the supported options below. A missing or revoked token answers 401.

What the implementation supports

Read this from ServiceProviderConfig rather than assuming full SCIM coverage: an identity provider that requires a feature in the "No" column needs a different sync strategy for it.

Users

A SCIM User is a console user plus their membership row in the token's organization. The mapping matters when you configure the provider:

• userName / emails — the email that identifies the account.
• displayName / name — the person's name.
• externalId — stored so the provider and the platform agree on identity.
• active — whether the user is a member of this organization.

GET /Users lists members and supports filtering; POST /Users creates one, PUT /Users/{id} replaces it, PATCH /Users/{id} changes it, and DELETE /Users/{id} removes the membership.

Verify: create a test user through the provider, confirm they appear in Console under Team, then deactivate them and confirm the membership disappears while the user's account remains.

Groups

A SCIM Group is more limited than a provider's UI usually suggests: a user's group is their organization role.

GET /Groups and GET /Groups/{id} list them; PATCH /Groups/{id} changes membership of a role. There is no POST or DELETE for Groups — the set of roles is defined by the platform, not created by your provider.

Configure the provider to map its groups onto the organization's existing roles, and confirm in Console → Team → Roles that the expected people end up with the expected role.

Operate and revoke

Review recent SCIM activity and the organization audit log. Revoke unused tokens from the SCIM settings page. To rotate:

1. Create a replacement token.
2. Update the identity provider with it.
3. Verify a request succeeds.
4. Revoke the old token.

Never paste tokens into tickets, source control or logs. A token is bound to one organization and cannot be used for the tenant API.

Troubleshooting

Next

• Single sign-on — the authentication half of the same setup.
• Console authentication — sessions, passwords and invitations.
• Console → Organization — roles and the audit log.