FusionAuth developer image
FusionAuth developer logo
  • Back to site
  • Expert Advice
  • Blog
  • Developers
  • Downloads
  • Account
  • Contact sales
Navigate to...
  • Welcome
  • Getting Started
  • 5-Minute Setup Guide
  • Release Notes
  • Core Concepts
    • Overview
    • Users
    • Roles
    • Groups
    • Entity Management
    • Registrations
    • Applications
    • Tenants
    • Identity Providers
    • Key Master
    • SCIM
    • Search
    • Authentication and Authorization
    • Integration Points
    • Localization and Internationalization
    • Editions and Features
    • Roadmap
  • Installation Guide
    • Overview
    • System Requirements
    • Server Layout
    • Cloud
    • Cluster
    • Docker
    • Fast Path
    • Kubernetes
      • Overview
      • Deployment Guide
      • Minikube Setup
      • Amazon EKS Setup
      • Google GKE Setup
      • Microsoft AKS Setup
    • Kickstart™
    • Homebrew
    • Packages
    • Database
    • FusionAuth App
    • FusionAuth Search
    • Common Configuration
  • Admin Guide
    • Overview
    • Account Portal
    • Config Management
    • Licensing
    • Monitoring
    • Proxy Setup
    • Securing
    • Technical Support
    • Troubleshooting
    • Upgrading
  • Migration Guide
    • Overview
    • General
    • Auth0
    • Keycloak
    • Amazon Cognito
    • Firebase
    • Tutorial
  • APIs
    • Overview
    • Authentication
    • Errors
    • Actioning Users
    • API Keys
    • Applications
    • Audit Logs
    • Connectors
      • Overview
      • Generic
      • LDAP
    • Consents
    • Emails
    • Entity Management
      • Overview
      • Entities
      • Entity Types
      • Grants
    • Event Logs
    • Families
    • Forms
    • Form Fields
    • Groups
    • Identity Providers
      • Overview
      • Links
      • Apple
      • External JWT
      • Epic Games
      • Facebook
      • Google
      • HYPR
      • LinkedIn
      • Nintendo
      • OpenID Connect
      • SAML v2
      • SAML v2 IdP Initiated
      • Sony PlayStation Network
      • Steam
      • Twitch
      • Twitter
      • Xbox
    • Integrations
    • IP Access Control Lists
    • JWT
    • Keys
    • Lambdas
    • Login
    • Message Templates
    • Messengers
      • Overview
      • Generic
      • Kafka
      • Twilio
    • Multi-Factor/Two Factor
    • Passwordless
    • Reactor
    • Registrations
    • Reports
    • SCIM
      • Overview
      • SCIM EnterpriseUser
      • SCIM Group
      • SCIM Service Provider Config.
      • SCIM User
    • System
    • Tenants
    • Themes
    • Users
    • User Actions
    • User Action Reasons
    • User Comments
    • Webhooks
  • Client Libraries
    • Overview
    • Dart
    • Go
    • Java
    • JavaScript
    • .NET Core
    • Node
    • OpenAPI
    • PHP
    • Python
    • Ruby
    • Typescript
  • Themes
    • Overview
    • Examples
    • Helpers
    • Localization
    • Template Variables
  • Email & Templates
    • Overview
    • Configure Email
    • Email Templates
    • Email Variables
    • Message Templates
  • Events & Webhooks
    • Overview
    • Writing a Webhook
    • Securing Webhooks
    • Events
      • Overview
      • Audit Log Create
      • Event Log Create
      • JWT Public Key Update
      • JWT Refresh
      • JWT Refresh Token Revoke
      • Kickstart Success
      • User Action
      • User Bulk Create
      • User Create
      • User Create Complete
      • User Deactivate
      • User Delete
      • User Delete Complete
      • User Email Update
      • User Email Verified
      • User IdP Link
      • User IdP Unlink
      • User Login Failed
      • User Login Id Duplicate Create
      • User Login Id Duplicate Update
      • User Login New Device
      • User Login Success
      • User Login Suspicious
      • User Password Breach
      • User Password Reset Send
      • User Password Reset Start
      • User Password Reset Success
      • User Password Update
      • User Reactivate
      • User Registration Create
      • User Registration Create Complete
      • User Registration Delete
      • User Registration Delete Complete
      • User Registration Update
      • User Registration Update Complete
      • User Registration Verified
      • User Two Factor Method Add
      • User Two Factor Method Remove
      • User Update
      • User Update Complete
  • Example Apps
    • Overview
    • Dart
    • Go
    • Java
    • JavaScript
    • .NET Core
    • PHP
    • Python
    • Ruby
  • Lambdas
    • Overview
    • Apple Reconcile
    • Client Cred. JWT Populate
    • Epic Games Reconcile
    • External JWT Reconcile
    • Facebook Reconcile
    • Google Reconcile
    • HYPR Reconcile
    • JWT Populate
    • LDAP Connector Reconcile
    • LinkedIn Reconcile
    • Nintendo Reconcile
    • OpenID Connect Reconcile
    • SAML v2 Populate
    • SAML v2 Reconcile
    • SCIM Group Req. Converter
    • SCIM Group Resp. Converter
    • SCIM User Req. Converter
    • SCIM User Resp. Converter
    • Sony PSN Reconcile
    • Steam Reconcile
    • Twitch Reconcile
    • Twitter Reconcile
    • Xbox Reconcile
  • Identity Providers
    • Overview
    • Apple
    • Epic Games
    • External JWT
      • Overview
      • Example
    • Facebook
    • Google
    • HYPR
    • LinkedIn
    • Nintendo
    • OpenID Connect
      • Overview
      • Azure AD
      • Discord
      • Github
    • Sony PlayStation Network
    • Steam
    • Twitch
    • Twitter
    • SAML v2
      • Overview
      • ADFS
    • SAML v2 IdP Initiated
      • Overview
      • Okta
    • Xbox
  • Messengers
    • Overview
    • Generic Messenger
    • Kafka Messenger
    • Twilio Messenger
  • Connectors
    • Overview
    • Generic Connector
    • LDAP Connector
    • FusionAuth Connector
  • Self Service Account Mgmt
    • Overview
    • Updating User Data & Password
    • Add Two-Factor Authenticator
    • Add Two-Factor Email
    • Add Two-Factor SMS
    • Customizing
    • Troubleshooting
  • Advanced Threat Detection
    • Overview
  • Integrations
    • Overview
    • CleanSpeak
    • Kafka
    • Twilio
  • OpenID Connect & OAuth 2.0
    • Overview
    • Endpoints
    • Tokens
  • SAML v2 IdP
    • Overview
    • Google
    • Zendesk
  • Plugins
    • Plugins
    • Writing a Plugin
    • Custom Password Hashing
  • Guides
    • Overview
    • Advanced Registration Forms
    • Breached Password Detection
    • Multi-Factor Authentication
    • Multi-Tenant
    • Passwordless
    • Securing Your APIs
    • Silent Mode
    • Single Sign-on
  • Tutorials
    • Overview
    • User Control & Gating
      • Gate Unverified Users
      • Gate Unverified Registrations
      • User Account Lockout
    • Setup Wizard & First Login
    • Register/Login a User
    • Start and Stop FusionAuth
    • Authentication Tokens
    • Key Rotation
    • JSON Web Tokens
    • Prometheus Setup
    • Switch Search Engines
    • Two Factor (pre 1.26)
  • Reference
    • CORS
    • Configuration
    • Data Types
    • Known Limitations
    • Password Hashes

    SCIM Service Provider API Overview

    Overview

    This API is used to retrieve information about the configuration of the FusionAuth SCIM Service Provider as specified in the RFC.

    • Retrieve Resource Types

    • Retrieve Schemas

    • Retrieve Service Provider Configuration

    Retrieve Resource Types

    Request

    Retrieve All Resource Types

    URI

    GET /api/scim/resource/v2/ResourceTypes

    Response

    The response for this API contains the ResourceTypes in standard SCIM schema.

    Table 1. Response Codes
    Code Description

    200

    The request was successful. The response will contain a JSON body.

    400

    The request was invalid and/or malformed. The response will contain a SCIM Error JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.

    500

    There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

    For FusionAuth SCIM endpoints, any error responses will be returned in standard SCIM schema. See more details in the SCIM API Overview.

    Where my field definitions at!?!

    Because the SCIM specification allows for customization of the schemas using extensions, there is no way to accurately document all the JSON structure possibilities.

    The following is the default response body. However, you can customize the schemas portion of the response by modifying the schemas setting.

    This is taken from the SCIM RFC describing a SCIM ResourceTypes schema. For the full specification you can find the RFC.

    Default Response Body

    Default Response JSON
    {
      "itemsPerPage": 10,
      "Resources": [
        {
          "description": "User Account",
          "endpoint": "/Users",
          "id": "User",
          "meta": {
            "location": "https://piedpiper.com/api/scim/v2/ResourceTypes/User",
            "resourceType": "ResourceType"
          },
          "name": "User",
          "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
          "schemaExtensions": [
            {
              "required": true,
              "schema": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
            }
          ],
          "schemas": [
            "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
          ]
        },
        {
          "description": "Group",
          "endpoint": "/Groups",
          "id": "Group",
          "meta": {
            "location": "https://piedpiper.com/api/scim/v2/ResourceTypes/Group",
            "resourceType": "ResourceType"
          },
          "name": "Group",
          "schema": "urn:ietf:params:scim:schemas:core:2.0:Group",
          "schemas": [
            "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
          ]
        }
      ],
      "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
      ],
      "startIndex": 1,
      "totalResults": 2
    }

    Retrieve Schemas

    Request

    Retrieve All Schemas

    URI

    GET /api/scim/resource/v2/Schemas

    Retrieve a Schema by Id

    URI

    GET /api/scim/resource/v2/Schemas/{schemaId}

    Request Parameters

    schemaId [String] Optional

    The unique Schema Id, such as urn:ietf:params:scim:schemas:core:2.0:User.

    Response

    The response for this API contains the Schema definition(s) in standard SCIM schema.

    Table 2. Response Codes
    Code Description

    200

    The request was successful. The response will contain a JSON body.

    400

    The request was invalid and/or malformed. The response will contain a SCIM Error JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.

    404

    The object doesn’t exist. The response will be empty.

    500

    There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

    For FusionAuth SCIM endpoints, any error responses will be returned in standard SCIM schema. See more details in the SCIM API Overview.

    Where my field definitions at!?!

    Because the SCIM specification allows for customization of the schemas using extensions, there is no way to accurately document all the JSON structure possibilities.

    The following is the default response body. However, you can customize this response by modifying the Tenant’s schemas setting.

    This is taken from the SCIM RFC describing a SCIM Schemas schema. For the full specification, consult the RFC.

    Default Response Body

    Default Response JSON
    {
      "itemsPerPage": 4,
      "Resources": [
        {
          "attributes": [],
          "description": "Enterprise User",
          "id": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
          "meta": {
            "location": "https://piedpiper.com/api/scim/resource/v2/Schemas/v2/Schemas/urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
            "resourceType": "Schema"
          },
          "name": "EnterpriseUser"
        },
        {
          "attributes": [
            {
              "caseExact": false,
              "description": "A human-readable name for the Group. REQUIRED.",
              "multiValued": false,
              "mutability": "readWrite",
              "name": "displayName",
              "required": false,
              "returned": "default",
              "type": "string",
              "uniqueness": "none"
            },
            {
              "description": "A list of members of the Group.",
              "multiValued": true,
              "mutability": "readWrite",
              "name": "members",
              "required": false,
              "returned": "default",
              "subAttributes": [
                {
                  "caseExact": false,
                  "description": "Identifier of the member of this Group.",
                  "multiValued": false,
                  "mutability": "immutable",
                  "name": "value",
                  "required": false,
                  "returned": "default",
                  "type": "string",
                  "uniqueness": "none"
                },
                {
                  "caseExact": false,
                  "description": "The URI corresponding to a SCIM resource that is a member of this Group.",
                  "multiValued": false,
                  "mutability": "immutable",
                  "name": "$ref",
                  "referenceTypes": [
                    "Group",
                    "User"
                  ],
                  "required": false,
                  "returned": "default",
                  "type": "reference",
                  "uniqueness": "none"
                }
              ],
              "type": "complex"
            }
          ],
          "description": "Group",
          "id": "urn:ietf:params:scim:schemas:core:2.0:Group",
          "meta": {
            "location": "https://piedpiper.com/api/scim/resource/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group",
            "resourceType": "Schema"
          },
          "name": "Group"
        },
        {
          "attributes": [
            {
              "caseExact": false,
              "description": "Unique identifier for the User, typically used by the user to directly authenticate to the service provider. Each User MUST include a non-empty userName value. REQUIRED.",
              "multiValued": false,
              "mutability": "readWrite",
              "name": "userName",
              "required": true,
              "returned": "default",
              "type": "string",
              "uniqueness": "server"
            },
            {
              "description": "A Boolean value indicating the User's administrative status.",
              "multiValued": false,
              "mutability": "readWrite",
              "name": "active",
              "required": false,
              "returned": "default",
              "type": "boolean"
            }
          ],
          "description": "User Account",
          "id": "urn:ietf:params:scim:schemas:core:2.0:User",
          "meta": {
            "location": "https://piedpiper.com/api/scim/resource/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User",
            "resourceType": "Schema"
          },
          "name": "User"
        },
        {
          "attributes": [
            {
              "description": "A list of field errors.",
              "multiValued": true,
              "mutability": "immutable",
              "name": "fieldErrors",
              "required": false,
              "returned": "default",
              "subAttributes": [
                {
                  "attributes": [
                    {
                      "caseExact": false,
                      "description": "The Fusion Auth error code",
                      "multiValued": false,
                      "mutability": "immutable",
                      "name": "code",
                      "required": false,
                      "returned": "default",
                      "type": "string",
                      "uniqueness": "none"
                    },
                    {
                      "caseExact": false,
                      "description": "The Fusion Auth error message",
                      "multiValued": false,
                      "mutability": "immutable",
                      "name": "message",
                      "required": false,
                      "returned": "default",
                      "type": "string",
                      "uniqueness": "none"
                    }
                  ],
                  "description": "A list of field errors.",
                  "multiValued": true,
                  "mutability": "immutable",
                  "name": "object.fieldName",
                  "required": false,
                  "returned": "default"
                }
              ],
              "type": "complex"
            },
            {
              "description": "A list of general errors.",
              "multiValued": true,
              "mutability": "immutable",
              "name": "generalErrors",
              "required": false,
              "returned": "default",
              "subAttributes": [
                {
                  "caseExact": false,
                  "description": "The Fusion Auth error code",
                  "multiValued": false,
                  "mutability": "immutable",
                  "name": "code",
                  "required": false,
                  "returned": "default",
                  "type": "string",
                  "uniqueness": "none"
                },
                {
                  "caseExact": false,
                  "description": "The Fusion Auth error data",
                  "multiValued": true,
                  "mutability": "immutable",
                  "name": "data",
                  "required": false,
                  "returned": "default",
                  "type": "complex",
                  "uniqueness": "none"
                },
                {
                  "caseExact": false,
                  "description": "The Fusion Auth error message",
                  "multiValued": false,
                  "mutability": "immutable",
                  "name": "message",
                  "required": false,
                  "returned": "default",
                  "type": "string",
                  "uniqueness": "none"
                }
              ],
              "type": "complex"
            }
          ],
          "description": "FusionAuth Errors",
          "id": "urn:ietf:params:scim:schemas:extension:fusionauth:2.0:Error",
          "meta": {
            "location": "https://piedpiper.com/api/scim/resource/v2/Schemas/urn:ietf:params:scim:schemas:extension:fusionauth:2.0:Error",
            "resourceType": "Schema"
          },
          "name": "FusionAuthError"
        }
      ],
      "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
      ],
      "startIndex": 1,
      "totalResults": 4
    }

    Retrieve Service Provider Configuration

    Request

    Retrieve Service Provider Configuration

    URI

    GET /api/scim/resource/v2/ServiceProviderConfig

    Response

    The response for this API contains the Service Provider Configuration in standard SCIM schema.

    Table 3. Response Codes
    Code Description

    200

    The request was successful. The response will contain a JSON body.

    400

    The request was invalid and/or malformed. The response will contain a SCIM Error JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present.

    500

    There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.

    For FusionAuth SCIM endpoints, any error responses will be returned in standard SCIM schema. See more details in the SCIM API Overview.

    Where my field definitions at!?!

    Because the SCIM specification allows for customization of the schemas using extensions, there is no way to accurately document all the JSON structure possibilities.

    The following response body is taken from the SCIM RFC describing a SCIM Service Provider Configuration schema. For the full specification you can find the RFC.

    Response Body

    Response JSON
    {
      "authenticationSchemes": [
        {
          "description": "Authentication scheme using the OAuth Bearer Token Standard",
          "name": "OAuth2 Bearer Token",
          "primary": true,
          "specUri": "http://www.rfc-editor.org/info/rfc6750",
          "type": "oauthbearertoken"
        }
      ],
      "bulk": {
        "supported": false
      },
      "changePassword": {
        "supported": true
      },
      "etag": {
        "supported": false
      },
      "filter": {
        "maxResults": 500,
        "supported": false
      },
      "meta": {
        "location": "https://piedpiper.com/api/scim/resource/v2/ServiceProviderConfig",
        "resourceType": "ServiceProviderConfig"
      },
      "patch": {
        "supported": false
      },
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
      ],
      "sort": {
        "supported": false
      }
    }

    Feedback

    How helpful was this page?

    See a problem?

    File an issue in our docs repo

    © 2021 FusionAuth
    Subscribe for developer updates