> For the complete documentation index, see [llms.txt](https://docs.stackai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stackai.com/stackai-api/stackai-api-developer-guide/scim-2.0-provisioning.md).

# SCIM 2.0 provisioning

SCIM is a separate externally facing identity-management surface under `/scim/v2`. Configure it through your identity provider and StackAI's SCIM settings. Use the dedicated SCIM bearer token and `application/scim+json` payloads for provisioning; normal workflow API keys are not interchangeable. See the existing [StackAI SCIM setup guide](https://docs.stackai.com/welcome-to-stackai/security-and-governance/security-in-stackai/system-for-cross-domain-identity-management-scim).

Use the discovery endpoints below to read the SCIM capabilities and schemas available in your deployment. SCIM responses follow their own protocol rather than the REST v2 envelope.

| Method | Path                                        | Usage                                                                           |
| ------ | ------------------------------------------- | ------------------------------------------------------------------------------- |
| GET    | `/scim/v2/ServiceProviderConfig`            | Discover supported provisioning capabilities before configuring the IdP         |
| GET    | `/scim/v2/ResourceTypes`                    | Discover Users and Groups resource types                                        |
| GET    | `/scim/v2/ResourceTypes/{resource_type_id}` | Read one resource-type descriptor                                               |
| GET    | `/scim/v2/Schemas`                          | Discover schema attributes and extensions                                       |
| GET    | `/scim/v2/Schemas/{schema_id}`              | Read a specific schema URI                                                      |
| GET    | `/scim/v2/Users`                            | List/filter users with `startIndex` and `count`                                 |
| POST   | `/scim/v2/Users`                            | Provision a user from a SCIM user body; retain returned ID                      |
| GET    | `/scim/v2/Users/{user_id}`                  | Read the provisioned user by SCIM ID                                            |
| PUT    | `/scim/v2/Users/{user_id}`                  | Replace the user's supported attributes using a complete desired representation |
| PATCH  | `/scim/v2/Users/{user_id}`                  | Apply SCIM PatchOp operations, such as updating active state                    |
| DELETE | `/scim/v2/Users/{user_id}`                  | Deprovision the user; treat this as an access-changing action                   |
| GET    | `/scim/v2/Groups`                           | List/filter groups; use the returned SCIM IDs                                   |
| POST   | `/scim/v2/Groups`                           | Create a group and supported membership representation                          |
| GET    | `/scim/v2/Groups/{group_id}`                | Read a group and its members                                                    |
| PUT    | `/scim/v2/Groups/{group_id}`                | Replace the supported group representation                                      |
| PATCH  | `/scim/v2/Groups/{group_id}`                | Add/remove members with SCIM PatchOp semantics                                  |
| DELETE | `/scim/v2/Groups/{group_id}`                | Delete the group; review membership/access effects first                        |

Read discovery → match existing users by a supported filter → create or update → reconcile group membership → verify by GET → deprovision when the IdP revokes access. User filters include `userName eq "person@example.com"`, `externalId eq "idp-id"`, and supported email filters. URL-encode the filter. Pagination is 1-based; `count=0` requests totals without Resources. A SCIM ID, an external IdP ID, and a StackAI project/user identifier should not be guessed interchangeable.

```bash
curl --fail-with-body -sS --get "$STACKAI_BASE_URL/scim/v2/Users" \
  -H "Authorization: Bearer $STACKAI_SCIM_TOKEN" \
  -H 'Accept: application/scim+json' \
  --data-urlencode 'filter=userName eq "person@example.com"' \
  --data-urlencode 'startIndex=1' --data-urlencode 'count=100'
```

SCIM error responses and `Resources`/`totalResults` pagination follow the provisioning protocol, not the v2 REST `data` envelope. Do not use the generic REST client's parsing rules without a SCIM adapter.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stackai.com/stackai-api/stackai-api-developer-guide/scim-2.0-provisioning.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.