larsggu.me › Reference › SCIM provisioning
SCIM provisioning
POST/PATCH/DELETE /scim/v2/Users and /scim/v2/Groups
A published HTTP schema, RFC 7644, by which an identity provider creates, updates, deactivates and groups accounts in an application without anyone administering them by hand.
Description
Single sign-on answers who somebody is at the moment they arrive. It says nothing about whether an account exists for them, what it can do, or whether it should still exist. Provisioning is the separate mechanism that keeps the application's account list agreeing with the directory, and SCIM is the published form of it.
The schema is deliberately small. Users and groups are resources with a defined set of attributes, an external identifier supplied by the directory, and an active flag. The directory pushes changes as they occur, and the application applies them. Group membership carries role assignment, so a change of team in the directory becomes a change of permission in the application without a second administrative step.
Deactivation is the part that matters most and is implemented worst. The correct behaviour for a departure is to set the active flag false, which ends sessions and refuses new ones while leaving the record intact so that history remains attributable. Deleting the record instead detaches every past action from the person who took it.
The external identifier is the join key, and it must be the directory's immutable value rather than an address. Email addresses change on marriage, on rebranding and on a correction of a typo, and an integration keyed to them creates a second account each time.
Fields
| Field | Form | Meaning |
|---|---|---|
| externalId | immutable string | The directory's own identifier. The join key; never an email address. |
| userName | string | The login identifier within the application. |
| active | boolean | False on departure. Ends access without destroying the record. |
| name | structured | Given and family names as separate fields. |
| groups | array of references | Membership, from which roles are ordinarily derived. |
| meta.lastModified | RFC 3339 instant | Used to reconcile after an interruption. |
Example
A departure
PATCH /scim/v2/Users/2819c223 HTTP/1.1
Content-Type: application/scim+json
{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations":[{"op":"replace","path":"active","value":false}]}
HTTP/1.1 200 OK
{"id":"2819c223","externalId":"d41-771","active":false,
"meta":{"lastModified":"2026-09-06T09:20:11Z"}}Access ends immediately; the record and everything attributed to it remain.
Failure modes
- Joining on email address, which forks the account whenever an address changes.
- Deleting on departure rather than deactivating, which orphans the history.
- Applying group membership but not removing it, so permissions only ever accumulate.
- Treating a provisioning failure as a warning, which lets the two systems drift apart unnoticed until an audit finds it.
Related entries
Topic: Identity. Last modified 2026-09-06.