SCIM
Base path: /scim/v2/{orgSlug}. Standard SCIM 2.0 for IdP provisioning (Okta/Entra). Responses use application/scim+json.
Authentication
Section titled “Authentication”Authorization: Bearer <SCIM token>The token belongs to one organization and only works under that organization’s {orgSlug}. A missing, inactive, expired or mismatched token gets 401. SCIM provisioning requires the Business plan; below it every call answers 403 with a SCIM error body.
Discovery
Section titled “Discovery”GET /ServiceProviderConfig, /Schemas, /Schemas/{id}, /ResourceTypes. These four need no token.
| Feature | Supported |
|---|---|
| PATCH | Yes |
| Filter | Yes — at most 100 results per page |
| Bulk | No |
| Change password · Sort · ETag | No |
| Method · Route | Behaviour |
|---|---|
GET /Users | List members. filter accepts userName eq "…" and externalId eq "…"; startIndex is 1-based; count is capped at 100 |
GET /Users/{id} | One member |
POST /Users | Create a member. Returns 201. A user that already exists (matched by externalId, then by userName) is returned with 200 instead of duplicated |
PUT /Users/{id} | Replace attributes |
PATCH /Users/{id} | Operations on active, displayName, userName, emails (also emails[type eq "work"].value), name.givenName, name.familyName, externalId; an operation without path takes an object of these |
DELETE /Users/{id} | Deactivate and remove the member. Returns 204 |
User attributes: userName (required, normally the email), displayName, name.givenName, name.familyName, emails, active, externalId.
Only identities linked to a user account are SCIM users; service accounts and your applications’ end users are not. The organization’s Owner and its Representative Director cannot be deactivated or deleted through SCIM (403).
Groups (= Roles)
Section titled “Groups (= Roles)”| Method · Route | Behaviour |
|---|---|
GET /Groups · GET /Groups/{id} | Lists the organization’s roles; members are the members who currently hold the role. filter accepts displayName eq "…" |
POST /Groups | Creates a role and assigns the listed members. An existing role with the same displayName is reused |
PUT /Groups/{id} | Rename the role and reconcile its membership (assign and revoke) |
PATCH /Groups/{id} | add / remove members, or replace with path members. Returns the updated group |
DELETE /Groups/{id} | Revoke the role from its members and deactivate it. Returns 204 |
Group attributes: displayName (required), members, externalId. The Owner role’s group and the fixed Roost roles’ groups are read-only: PUT, PATCH and DELETE answer 403. Transfer ownership, and manage the Roost roles, in the console.
A SCIM group is an Axowl role, so directory groups and role assignments are one and the same — see Roles & permissions.