SCIM2 Groups

SCIM 2.0 compliant endpoints for group provisioning and management. These endpoints follow the System for Cross-domain Identity Management (SCIM) 2.0 specification.

Learn more about SCIM 2.0

List all groups

get

Retrieves a list of groups in SCIM 2.0 format with support for filtering, sorting, and pagination.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for listing resources.

Supported Filters

• displayName eq "group-name" - Filter by group name

---

Important Notes!

• Group members are included in the response

• Pagination uses 1-based indexing per SCIM specification

Authorizations

bearerAuth

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Query parameters

filterstringOptional

SCIM filter expression

Example: displayName eq "developers"

sortBystringOptional

Attribute to sort by

Example: displayName

sortOrderstring · enumOptional

Sort order

Example: ascendingPossible values:

startIndexinteger · min: 1Optional

1-based index of the first result

Default: 1

countinteger · min: 1Optional

Number of results per page

Default: 100

Responses

200

Successfully retrieved groups list

application/scim+json

schemasstring[]OptionalExample: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"]

totalResultsintegerOptional

Total number of results

startIndexintegerOptional

Starting index of results

itemsPerPageintegerOptional

Number of items per page

Resourcesobject[]Optional

401

Unauthorized - Authentication failed

application/scim+json

500

Internal server error

application/scim+json

get

/api/v2/scim/v2/Groups

HTTPcURLJavaScriptPython

GET /api/v2/scim/v2/Groups HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 2,
  "startIndex": 1,
  "itemsPerPage": 100,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "id": "developers",
      "displayName": "developers",
      "members": [
        {
          "value": "64d7c869b5760b001e46c1a2",
          "display": "John Doe",
          "$ref": "/Users/64d7c869b5760b001e46c1a2"
        }
      ]
    }
  ]
}

Create a new group

post

Creates a new group in the system using SCIM 2.0 format.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for creating resources.

Required Fields

• schemas - Must include "urn:ietf:params:scim:schemas:core:2.0:Group"

• displayName - Group name (will be converted to lowercase)

Optional Fields

• members - Array of member objects with value (user ID)

---

Important Notes!

• Group names are converted to lowercase

• Group names must be unique within the organization

• Members can be added during creation or via PATCH/PUT

Authorizations

bearerAuth

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Body

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:Group"]

idstringOptional

Unique identifier for the group (group name)

displayNamestringRequired

Group display name

Responses

201

Group created successfully

application/scim+json

400

Invalid request - Missing required fields or invalid schema

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

409

Conflict - Group already exists

application/scim+json

500

Internal server error

application/scim+json

post

/api/v2/scim/v2/Groups

HTTPcURLJavaScriptPython

POST /api/v2/scim/v2/Groups HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/scim+json
Accept: */*
Content-Length: 135

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "displayName": "developers",
  "members": [
    {
      "value": "64d7c869b5760b001e46c1a2"
    }
  ]
}

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "id": "text",
  "displayName": "text",
  "members": [
    {
      "value": "text",
      "display": "text",
      "$ref": "text"
    }
  ]
}

Get a group by ID

get

Retrieves a specific group by its unique identifier (group name) in SCIM 2.0 format.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for retrieving a single resource.

---

Important Notes!

• The group ID is the group name (lowercase)

• Group members are included in the response

Authorizations

bearerAuth

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Path parameters

groupIdstringRequired

The unique identifier of the group (group name)

Example: developers

Responses

200

Successfully retrieved group

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:Group"]

idstringOptional

Unique identifier for the group (group name)

displayNamestringRequired

Group display name

401

Unauthorized - Authentication failed

application/scim+json

404

Group not found

application/scim+json

500

Internal server error

application/scim+json

get

/api/v2/scim/v2/Groups/{groupId}

HTTPcURLJavaScriptPython

GET /api/v2/scim/v2/Groups/{groupId} HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "id": "developers",
  "displayName": "developers",
  "members": [
    {
      "value": "64d7c869b5760b001e46c1a2",
      "display": "John Doe",
      "$ref": "/Users/64d7c869b5760b001e46c1a2"
    }
  ]
}

Replace a group

put

Replaces all attributes of a group with the provided values using SCIM 2.0 format.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for replacing a resource.

Member Management

• Members not in the new list will be removed from the group

• New members will be added to the group

---

Important Notes!

• The entire members list is replaced with the provided members

• To add/remove specific members, use PATCH instead

Authorizations

bearerAuth

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Path parameters

groupIdstringRequired

The unique identifier of the group (group name)

Example: developers

Body

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:Group"]

idstringOptional

Unique identifier for the group (group name)

displayNamestringRequired

Group display name

Responses

200

Group updated successfully

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:Group"]

idstringOptional

Unique identifier for the group (group name)

displayNamestringRequired

Group display name

400

Invalid request - Missing required schema

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

404

Group not found

application/scim+json

500

Internal server error

application/scim+json

put

/api/v2/scim/v2/Groups/{groupId}

HTTPcURLJavaScriptPython

PUT /api/v2/scim/v2/Groups/{groupId} HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/scim+json
Accept: */*
Content-Length: 172

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "displayName": "developers",
  "members": [
    {
      "value": "64d7c869b5760b001e46c1a2"
    },
    {
      "value": "64d7c869b5760b001e46c1a3"
    }
  ]
}

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "id": "text",
  "displayName": "text",
  "members": [
    {
      "value": "text",
      "display": "text",
      "$ref": "text"
    }
  ]
}

Delete a group

delete

Deletes a group from the system.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for deleting resources.

---

Important Notes!

• Deleting a group removes all member associations

• Returns 204 No Content on successful deletion

Authorizations

bearerAuth

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Path parameters

groupIdstringRequired

The unique identifier of the group (group name)

Example: developers

Responses

204

Group deleted successfully

401

Unauthorized - Authentication failed

application/scim+json

404

Group not found

application/scim+json

500

Internal server error

application/scim+json

delete

/api/v2/scim/v2/Groups/{groupId}

HTTPcURLJavaScriptPython

DELETE /api/v2/scim/v2/Groups/{groupId} HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Partially update a group

patch

Partially updates a group using SCIM 2.0 PATCH operations.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for patching resources.

Supported Operations

• add - Add members to the group

• replace - Replace members or displayName

• remove - Remove members from the group

Supported Paths

• displayName - Update group display name

• members - Manage group members

---

Important Notes!

• Schema must be "urn:ietf:params:scim:api:messages:2.0:PatchOp"

• Member values should be user IDs

Authorizations

bearerAuth

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Path parameters

groupIdstringRequired

The unique identifier of the group (group name)

Example: developers

Body

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:api:messages:2.0:PatchOp"]

Responses

200

Group updated successfully

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:Group"]

idstringOptional

Unique identifier for the group (group name)

displayNamestringRequired

Group display name

400

Invalid request - Missing Operations array or invalid schema

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

404

Group not found

application/scim+json

500

Internal server error

application/scim+json

patch

/api/v2/scim/v2/Groups/{groupId}

HTTPcURLJavaScriptPython

PATCH /api/v2/scim/v2/Groups/{groupId} HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/scim+json
Accept: */*
Content-Length: 153

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "add",
      "path": "members",
      "value": [
        {
          "value": "64d7c869b5760b001e46c1a2"
        }
      ]
    }
  ]
}

Add members to groupRemove members from groupReplace all membersUpdate display name

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "id": "text",
  "displayName": "text",
  "members": [
    {
      "value": "text",
      "display": "text",
      "$ref": "text"
    }
  ]
}

Search groups

post

Searches for groups using SCIM 2.0 POST-based search with filter support.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for searching resources via POST.

Supported Filters

• displayName eq "group-name" - Filter by group name

---

Important Notes!

• Request body cannot be empty

• Use this endpoint for complex searches that may exceed URL length limits

• Pagination uses 1-based indexing per SCIM specification

Authorizations

bearerAuth

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Body

application/scim+json

filterstringOptional

SCIM filter expression

Example: displayName eq "developers"

startIndexinteger · min: 1Optional

1-based index of the first result

Default: 1

countinteger · min: 1Optional

Number of results per page

Default: 100

Responses

200

Successfully retrieved search results

application/scim+json

schemasstring[]OptionalExample: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"]

totalResultsintegerOptional

Total number of results

startIndexintegerOptional

Starting index of results

itemsPerPageintegerOptional

Number of items per page

Resourcesobject[]Optional

400

Invalid request - Empty body or invalid filter

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

500

Internal server error

application/scim+json

post

/api/v2/scim/v2/Groups/.search

HTTPcURLJavaScriptPython

POST /api/v2/scim/v2/Groups/.search HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/scim+json
Accept: */*
Content-Length: 69

{
  "filter": "displayName eq \"developers\"",
  "startIndex": 1,
  "count": 100
}

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 1,
  "startIndex": 1,
  "itemsPerPage": 1,
  "Resources": [
    {}
  ]
}