Skip to content
Vectis
Book a demo

SCIM provisioning

Create, update and deactivate Vectis users automatically from your identity provider with SCIM 2.0.

Vectis supports SCIM 2.0 (System for Cross-domain Identity Management) for automated user lifecycle management. Your identity provider can create, update and deactivate users in Vectis automatically.

Getting a SCIM token

Vectis support generates your SCIM token and gives you your SCIM base URL, which ends in /scim/v2. Ask them for both when you're ready to connect your identity provider. Store the token safely: it's shown only once.

Endpoints

All paths are relative to your SCIM base URL.

MethodEndpointDescription
GET/UsersList users, with filtering and pagination
GET/Users/{id}Get a single user
POST/UsersCreate a user
PUT/Users/{id}Replace (update) a user
DELETE/Users/{id}Deactivate a user
GET/ServiceProviderConfigSCIM service provider configuration
GET/ResourceTypesSupported SCIM resource types
GET/SchemasSCIM schemas

Authentication

Every SCIM request needs the bearer token in the Authorization header:

Authorization: Bearer <scim-token>

User schema

Create a user (POST /Users)

json
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "[email protected]",
  "name": {
    "givenName": "Jane",
    "familyName": "Smith"
  },
  "emails": [
    {
      "value": "[email protected]",
      "type": "work",
      "primary": true
    }
  ],
  "externalId": "ext-12345",
  "active": true
}

Response

json
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "externalId": "ext-12345",
  "userName": "[email protected]",
  "name": {
    "givenName": "Jane",
    "familyName": "Smith",
    "formatted": "Jane Smith"
  },
  "displayName": "Jane Smith",
  "emails": [
    {
      "value": "[email protected]",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "meta": {
    "resourceType": "User",
    "created": "2026-03-21T10:00:00Z",
    "lastModified": "2026-03-21T10:00:00Z"
  }
}

Deactivate a user (PUT /Users/{id})

Set active to false:

json
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "active": false
}

Filter users

The supported filter is userName eq "[email protected]":

GET /scim/v2/Users?filter=userName eq "[email protected]"

Pagination

GET /scim/v2/Users?startIndex=1&count=10

Error responses

json
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "detail": "User not found.",
  "status": 404
}
StatusDescription
400Bad request or validation error
401Invalid or missing SCIM bearer token
404Resource not found
409Conflict, for example the user already exists

Attribute mapping

SCIM attributeVectis field
userNameEmail
name.givenNameFirst name
name.familyNameLast name
externalIdExternal ID
activeActive or deactivated
emails[primary].valueEmail

Behaviour

  • Deactivation: DELETE and setting active: false both deactivate the user. No data is permanently removed.
  • Reactivation: a PUT with active: true for a deactivated user reactivates their account.
  • Duplicates: creating a user with an email that already exists returns 409 Conflict.
  • Default role: SCIM-provisioned users get the default role set on your SSO configuration, if there is one. Ask Vectis support to set or change it.