SCIM2 Users

SCIM 2.0 compliant endpoints for user provisioning and management. These endpoints follow the System for Cross-domain Identity Management (SCIM) 2.0 specification.

Learn more about SCIM 2.0

List all users

get

Retrieves a list of users in SCIM 2.0 format with support for filtering and pagination.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for listing resources.

Supported Filters

userName eq "[email protected]" - Filter by username/email
emails[type eq "work"].value eq "[email protected]" - Filter by work email
active eq true - Filter by active status

Important Notes!
Only active users are returned in the list
Pagination uses 1-based indexing per SCIM specification
The filter parameter supports SCIM filter syntax

Authorizations

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Query parameters

filterstringOptional

SCIM filter expression

Example: userName eq "[email protected]"

startIndexinteger · min: 1Optional

1-based index of the first result

Default: 1

countinteger · min: 1Optional

Number of results per page

Default: 100

Responses

200

Successfully retrieved users list

application/scim+json

schemasstring[]OptionalExample: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"]

totalResultsintegerOptional

Total number of results

startIndexintegerOptional

Starting index of results

itemsPerPageintegerOptional

Number of items per page

Resourcesobject[]Optional

400

Invalid filter syntax

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

500

Internal server error

application/scim+json

get

/api/v2/scim/v2/Users

GET /api/v2/scim/v2/Users HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 2,
  "startIndex": 1,
  "itemsPerPage": 100,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "id": "64d7c869b5760b001e46c1a2",
      "userName": "[email protected]",
      "name": {
        "givenName": "John",
        "familyName": "Doe"
      },
      "emails": [
        {
          "value": "[email protected]",
          "type": "work",
          "primary": true
        }
      ],
      "active": true,
      "roles": [
        {
          "value": "user",
          "primary": true
        }
      ]
    }
  ]
}

Create a new user

post

Creates a new user in the system using SCIM 2.0 format.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for creating resources.

Required Fields

schemas - Must include "urn:ietf:params:scim:schemas:core:2.0:User"
name.givenName - User's first name
name.familyName - User's last name
emails - At least one email with primary set to true

Supported Roles

administrator - Full admin access
powerUser - Power user access
user - Standard user access (default)
auditor - Auditor access
securityManager - Security manager access
guest - Guest access

Important Notes!
If the user already exists, the endpoint will return the existing user (200 status)
If no role is provided, the user will be assigned the "user" role by default
The userName is set to the user's email address

Authorizations

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Body

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:User"]

idstringOptional

Unique identifier for the user

externalIdstringOptional

External identifier

userNamestringRequired

User email address

displayNamestringOptional

Display name

activebooleanOptional

User active status

Responses

200

User already exists, returning existing user

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:User"]

idstringOptional

Unique identifier for the user

externalIdstringOptional

External identifier

userNamestringRequired

User email address

displayNamestringOptional

Display name

activebooleanOptional

User active status

201

User created successfully

application/scim+json

400

Invalid request - Missing required fields or invalid schema

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

500

Internal server error

application/scim+json

post

/api/v2/scim/v2/Users

POST /api/v2/scim/v2/Users HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/scim+json
Accept: */*
Content-Length: 251

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "name": {
    "givenName": "John",
    "familyName": "Doe"
  },
  "emails": [
    {
      "value": "[email protected]",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "roles": [
    {
      "value": "user",
      "primary": true,
      "type": "Primary"
    }
  ]
}

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "text",
  "externalId": "text",
  "userName": "text",
  "name": {
    "givenName": "text",
    "familyName": "text"
  },
  "displayName": "text",
  "emails": [
    {
      "value": "text",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "roles": [
    {
      "value": "text",
      "primary": true,
      "type": "text"
    }
  ]
}

Get a user by ID

get

Retrieves a specific user by their unique identifier in SCIM 2.0 format.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for retrieving a single resource.

Authorizations

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Path parameters

userIdstringRequired

The unique identifier of the user

Example: 64d7c869b5760b001e46c1a2

Responses

200

Successfully retrieved user

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:User"]

idstringOptional

Unique identifier for the user

externalIdstringOptional

External identifier

userNamestringRequired

User email address

displayNamestringOptional

Display name

activebooleanOptional

User active status

401

Unauthorized - Authentication failed

application/scim+json

404

User not found

application/scim+json

500

Internal server error

application/scim+json

get

/api/v2/scim/v2/Users/{userId}

GET /api/v2/scim/v2/Users/{userId} HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "64d7c869b5760b001e46c1a2",
  "userName": "[email protected]",
  "name": {
    "givenName": "John",
    "familyName": "Doe"
  },
  "emails": [
    {
      "value": "[email protected]",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "roles": [
    {
      "value": "user",
      "primary": true
    }
  ]
}

Replace a user

put

Replaces all attributes of a user with the provided values using SCIM 2.0 format.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for replacing a resource.

Supported Updates

active - Activate or deactivate the user
roles - Update user roles

Important Notes!
Email and username cannot be changed
The _id and email fields from the existing user are preserved
Setting active to false will deactivate the user

Authorizations

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Path parameters

userIdstringRequired

The unique identifier of the user to update

Example: 64d7c869b5760b001e46c1a2

Body

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:User"]

idstringOptional

Unique identifier for the user

externalIdstringOptional

External identifier

userNamestringRequired

User email address

displayNamestringOptional

Display name

activebooleanOptional

User active status

Responses

200

User updated successfully

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:User"]

idstringOptional

Unique identifier for the user

externalIdstringOptional

External identifier

userNamestringRequired

User email address

displayNamestringOptional

Display name

activebooleanOptional

User active status

400

Invalid request - Missing required schema

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

404

User not found

application/scim+json

500

Internal server error

application/scim+json

put

/api/v2/scim/v2/Users/{userId}

PUT /api/v2/scim/v2/Users/{userId} HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/scim+json
Accept: */*
Content-Length: 239

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "name": {
    "givenName": "John",
    "familyName": "Doe"
  },
  "emails": [
    {
      "value": "[email protected]",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "roles": [
    {
      "value": "powerUser",
      "primary": true
    }
  ]
}

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "text",
  "externalId": "text",
  "userName": "text",
  "name": {
    "givenName": "text",
    "familyName": "text"
  },
  "displayName": "text",
  "emails": [
    {
      "value": "text",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "roles": [
    {
      "value": "text",
      "primary": true,
      "type": "text"
    }
  ]
}

Delete (deactivate) a user

delete

Deactivates a user in the system. In Opsera, users are soft-deleted (deactivated) rather than permanently removed.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for deleting resources.

Important Notes!
Users are deactivated, not permanently deleted
Deactivated users can be reactivated via PATCH or POST operations
Returns 204 No Content on successful deletion

Authorizations

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Path parameters

userIdstringRequired

The unique identifier of the user to delete

Example: 64d7c869b5760b001e46c1a2

Responses

204

User deleted (deactivated) successfully

401

Unauthorized - Authentication failed

application/scim+json

404

User not found

application/scim+json

500

Internal server error

application/scim+json

delete

/api/v2/scim/v2/Users/{userId}

DELETE /api/v2/scim/v2/Users/{userId} HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Partially update a user

patch

Partially updates a user using SCIM 2.0 PATCH operations.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for patching resources.

Supported Operations

add - Add a value to an attribute
replace - Replace the value of an attribute
remove - Remove a value from an attribute

Supported Paths

active - Update user active status (activate/deactivate)
roles - Update user roles
roles[primary eq "true"].value - Update primary role

Important Notes!
Email and username cannot be changed via PATCH
Setting active to false will deactivate the user
Setting active to true will reactivate a deactivated user

Authorizations

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Path parameters

userIdstringRequired

The unique identifier of the user

Example: 64d7c869b5760b001e46c1a2

Body

schemasstring[]RequiredExample: ["urn:ietf:params:scim:api:messages:2.0:PatchOp"]

Responses

200

User updated successfully

application/scim+json

schemasstring[]RequiredExample: ["urn:ietf:params:scim:schemas:core:2.0:User"]

idstringOptional

Unique identifier for the user

externalIdstringOptional

External identifier

userNamestringRequired

User email address

displayNamestringOptional

Display name

activebooleanOptional

User active status

400

Invalid request - Missing Operations array

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

404

User not found

application/scim+json

500

Internal server error

application/scim+json

patch

/api/v2/scim/v2/Users/{userId}

PATCH /api/v2/scim/v2/Users/{userId} HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/scim+json
Accept: */*
Content-Length: 125

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "active",
      "value": "false"
    }
  ]
}

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "text",
  "externalId": "text",
  "userName": "text",
  "name": {
    "givenName": "text",
    "familyName": "text"
  },
  "displayName": "text",
  "emails": [
    {
      "value": "text",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "roles": [
    {
      "value": "text",
      "primary": true,
      "type": "text"
    }
  ]
}

Search users

post

Searches for users using SCIM 2.0 POST-based search with filter support.

SCIM 2.0 Compliance

This endpoint follows the SCIM 2.0 specification for searching resources via POST.

Supported Filters

userName eq "[email protected]" - Filter by username/email
emails[type eq "work"].value eq "[email protected]" - Filter by work email
active eq true - Filter by active status

Important Notes!
Request body cannot be empty
Use this endpoint for complex searches that may exceed URL length limits
Pagination uses 1-based indexing per SCIM specification

Authorizations

AuthorizationstringRequired

API authentication using Bearer tokens. Include your API token in the Authorization header: Authorization: Bearer <your-api-token>

Tokens can be obtained from the Opsera platform's API token management interface.

Body

filterstringOptional

SCIM filter expression

Example: userName eq "[email protected]"

startIndexinteger · min: 1Optional

1-based index of the first result

Default: 1

countinteger · min: 1Optional

Number of results per page

Default: 100

Responses

200

Successfully retrieved search results

application/scim+json

schemasstring[]OptionalExample: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"]

totalResultsintegerOptional

Total number of results

startIndexintegerOptional

Starting index of results

itemsPerPageintegerOptional

Number of items per page

Resourcesobject[]Optional

400

Invalid request - Empty body or invalid filter

application/scim+json

401

Unauthorized - Authentication failed

application/scim+json

500

Internal server error

application/scim+json

post

/api/v2/scim/v2/Users/.search

POST /api/v2/scim/v2/Users/.search HTTP/1.1
Host: api.[organization].opsera.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/scim+json
Accept: */*
Content-Length: 76

{
  "filter": "userName eq \"[email protected]\"",
  "startIndex": 1,
  "count": 100
}

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 1,
  "startIndex": 1,
  "itemsPerPage": 1,
  "Resources": [
    {}
  ]
}

PreviousLineaje NextSCIM2 Groups

Last updated 3 days ago

Good afternoon

hashtagList all users

hashtagSCIM 2.0 Compliance

hashtagSupported Filters

hashtagImportant Notes!

hashtagCreate a new user

hashtagSCIM 2.0 Compliance

hashtagRequired Fields

hashtagSupported Roles

hashtagImportant Notes!

hashtagGet a user by ID

hashtagSCIM 2.0 Compliance

hashtagReplace a user

hashtagSCIM 2.0 Compliance

hashtagSupported Updates

hashtagImportant Notes!

hashtagDelete (deactivate) a user

hashtagSCIM 2.0 Compliance

hashtagImportant Notes!

hashtagPartially update a user

hashtagSCIM 2.0 Compliance

hashtagSupported Operations

hashtagSupported Paths

hashtagImportant Notes!

hashtagSearch users

hashtagSCIM 2.0 Compliance

hashtagSupported Filters

hashtagImportant Notes!

List all users

SCIM 2.0 Compliance

Supported Filters

Important Notes!

Create a new user

SCIM 2.0 Compliance

Required Fields

Supported Roles

Important Notes!

Get a user by ID

SCIM 2.0 Compliance

Replace a user

SCIM 2.0 Compliance

Supported Updates

Important Notes!

Delete (deactivate) a user

SCIM 2.0 Compliance

Important Notes!

Partially update a user

SCIM 2.0 Compliance

Supported Operations

Supported Paths

Important Notes!

Search users

SCIM 2.0 Compliance

Supported Filters

Important Notes!