> For the complete documentation index, see [llms.txt](https://fusionauth.io/docs/llms.txt)

# SCIM APIs

Learn about the APIs for provisioning SCIM Resources in FusionAuth using a SCIM Client.

# SCIM APIs

This feature is only available in the Enterprise plan. To learn more, see [our pricing page](https://fusionauth.io/pricing.md).

version

This API has been available since `1.36.0`

This page contains all of the APIs for managing Users and Groups using SCIM requests. See our [overview](https://fusionauth.io/docs/lifecycle/migrate-users/scim.md) of FusionAuth's support for the SCIM specification for more details.

FusionAuth supported SCIM Resource API endpoints

*   [SCIM User](https://fusionauth.io/docs/apis/scim/scim-user.md)
*   [SCIM EnterpriseUser](https://fusionauth.io/docs/apis/scim/scim-enterprise-user.md)
*   [SCIM Group](https://fusionauth.io/docs/apis/scim/scim-group.md)

FusionAuth supported [Service Provider Configuration](https://fusionauth.io/docs/apis/scim/scim-service-provider.md) endpoints:

*   [SCIM ResourceTypes](https://fusionauth.io/docs/apis/scim/scim-service-provider.md#retrieve-resource-types)
*   [SCIM Schemas](https://fusionauth.io/docs/apis/scim/scim-service-provider.md#retrieve-schemas)
*   [SCIM Service Provider Configuration](https://fusionauth.io/docs/apis/scim/scim-service-provider.md#retrieve-service-provider-configuration)

## Authentication

In order to use the authenticated FusionAuth SCIM API endpoints, you must create a SCIM client entity and execute the [Client Credentials](https://fusionauth.io/docs/apis/authentication.md#client-credentials) authorization workflow. [Default Entity Types](https://fusionauth.io/docs/get-started/core-concepts/entity-management.md#scim-configuration) are provided for you with permission configurations for each individual endpoint. A SCIM Client must use credentials for a SCIM Client Entity and that Entity must have the corresponding permission for that endpoint enabled.

## SCIM Error Responses

All error responses from FusionAuth SCIM API endpoints will be returned using the SCIM `urn:ietf:params:scim:api:messages:2.0:Error` schema as defined by [RFC 7644 Section 3.12](https://datatracker.ietf.org/doc/html/rfc7644#section-3.12).

*Example SCIM error response*

```json
{
  "detail": "[UnauthorizedException] Your supplied token is not authorized to make this SCIM request.",
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "401"
}
```

When applicable, additional error details will be provided using the `urn:ietf:params:scim:schemas:extension:fusionauth:2.0:Error` SCIM schema extension.

*Example SCIM Error Response with FusionAuth custom extension schema*

```json
{
  "detail": "Request failed, see errors for additional details.",
  "schemas": [
    "urn:ietf:params:scim:schemas:extension:fusionauth:2.0:Error",
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "urn:ietf:params:scim:schemas:extension:fusionauth:2.0:Error": {
    "fieldErrors": {
      "user.username": [
        {
          "code": "[duplicate]user.username",
          "message": "A User with username = [johnny123] already exists."
        }
      ]
    },
    "generalErrors": [
      {
        "code": "[invalid]",
        "message": "Your JSON was invalid"
      }
    ]
  }
}
```