ObjectStackObjectStack

Scim

Scim protocol schemas

SCIM 2.0 Protocol Implementation

System for Cross-domain Identity Management (SCIM) 2.0 specification

implementation for ObjectStack.

Overview

SCIM 2.0 is an HTTP-based protocol for managing user and group identities

across domains. It provides a standardized REST API for user provisioning,

de-provisioning, and synchronization.

Use Cases

  1. Enterprise SSO Integration

  • Integrate with Okta, Azure AD, OneLogin

  • Automatic user provisioning from corporate directory

  • Just-in-Time (JIT) user creation on first login

  1. User Lifecycle Management

  • Automatically create users when they join organization

  • Update user attributes when they change roles

  • Deactivate users when they leave organization

  1. Group/Department Synchronization

  • Sync organizational structure from AD/LDAP

  • Maintain group memberships automatically

  • Map corporate roles to application permissions

  1. Compliance & Audit

  • Maintain accurate user directory

  • Track all identity changes

  • Meet SOX/HIPAA requirements for user management

Specification References

  • RFC 7643: SCIM Core Schema

  • RFC 7644: SCIM Protocol

  • RFC 7642: SCIM Requirements

Industry Implementations

  • Okta: Leading SCIM provider

  • Azure AD: Microsoft's identity platform

  • OneLogin: Enterprise SSO provider

  • Google Workspace: Google's identity management

@see https://datatracker.ietf.org/doc/html/rfc7643

@see https://datatracker.ietf.org/doc/html/rfc7644

Source: packages/spec/src/identity/scim.zod.ts

TypeScript Usage

import { SCIMAddress, SCIMBulkOperation, SCIMBulkRequest, SCIMBulkResponse, SCIMBulkResponseOperation, SCIMEmail, SCIMEnterpriseUser, SCIMError, SCIMGroup, SCIMGroupReference, SCIMListResponse, SCIMMemberReference, SCIMMeta, SCIMName, SCIMPatchOperation, SCIMPatchRequest, SCIMPhoneNumber, SCIMUser } from '@objectstack/spec/identity';
import type { SCIMAddress, SCIMBulkOperation, SCIMBulkRequest, SCIMBulkResponse, SCIMBulkResponseOperation, SCIMEmail, SCIMEnterpriseUser, SCIMError, SCIMGroup, SCIMGroupReference, SCIMListResponse, SCIMMemberReference, SCIMMeta, SCIMName, SCIMPatchOperation, SCIMPatchRequest, SCIMPhoneNumber, SCIMUser } from '@objectstack/spec/identity';

// Validate data
const result = SCIMAddress.parse(data);

SCIMAddress

Properties

PropertyTypeRequiredDescription
formattedstringoptionalFormatted address
streetAddressstringoptionalStreet address
localitystringoptionalCity/Locality
regionstringoptionalState/Region
postalCodestringoptionalPostal code
countrystringoptionalCountry
typeEnum<'work' | 'home' | 'other'>optionalAddress type
primaryboolean✅Primary address indicator

SCIMBulkOperation

Properties

PropertyTypeRequiredDescription
methodEnum<'POST' | 'PUT' | 'PATCH' | 'DELETE'>✅HTTP method for the bulk operation
pathstring✅Resource endpoint path (e.g. /Users, /Groups/{id})
bulkIdstringoptionalClient-assigned ID for cross-referencing between operations
dataRecord<string, any>optionalRequest body for POST/PUT/PATCH operations
versionstringoptionalETag for optimistic concurrency control

SCIMBulkRequest

Properties

PropertyTypeRequiredDescription
schemasstring[]✅SCIM schema URIs (BulkRequest)
operationsObject[]✅Bulk operations to execute (minimum 1)
failOnErrorsintegeroptionalStop processing after this many errors

SCIMBulkResponse

Properties

PropertyTypeRequiredDescription
schemasstring[]✅SCIM schema URIs (BulkResponse)
operationsObject[]✅Results for each bulk operation

SCIMBulkResponseOperation

Properties

PropertyTypeRequiredDescription
methodEnum<'POST' | 'PUT' | 'PATCH' | 'DELETE'>✅HTTP method that was executed
bulkIdstringoptionalClient-assigned bulk operation ID
locationstringoptionalURL of the created or modified resource
statusstring✅HTTP status code as string (e.g. "201", "400")
responseanyoptionalResponse body (typically present for errors)

SCIMEmail

Properties

PropertyTypeRequiredDescription
valuestring✅Email address
typeEnum<'work' | 'home' | 'other'>optionalEmail type
displaystringoptionalDisplay label
primaryboolean✅Primary email indicator

SCIMEnterpriseUser

Properties

PropertyTypeRequiredDescription
employeeNumberstringoptionalEmployee number
costCenterstringoptionalCost center
organizationstringoptionalOrganization
divisionstringoptionalDivision
departmentstringoptionalDepartment
managerObjectoptionalManager reference

SCIMError

Properties

PropertyTypeRequiredDescription
schemasstring[]✅SCIM schema URIs
statusinteger✅HTTP status code
scimTypeEnum<'invalidFilter' | 'tooMany' | 'uniqueness' | 'mutability' | 'invalidSyntax' | 'invalidPath' | 'noTarget' | 'invalidValue' | 'invalidVers' | 'sensitive'>optionalSCIM error type
detailstringoptionalError detail message

SCIMGroup

Properties

PropertyTypeRequiredDescription
schemasstring[]✅SCIM schema URIs (must include Group schema)
idstringoptionalUnique resource identifier
externalIdstringoptionalExternal identifier from client system
displayNamestring✅Group display name (REQUIRED)
membersObject[]optionalGroup members
metaObjectoptionalResource metadata

SCIMGroupReference

Properties

PropertyTypeRequiredDescription
valuestring✅Group ID
$refstringoptionalURI reference to the group
displaystringoptionalGroup display name
typeEnum<'direct' | 'indirect'>optionalMembership type

SCIMListResponse

Properties

PropertyTypeRequiredDescription
schemasstring[]✅SCIM schema URIs
totalResultsinteger✅Total results count
ResourcesObject | Object | Record<string, any>[]✅Resources array (Users, Groups, or custom resources)
startIndexintegeroptionalStart index (1-based)
itemsPerPageintegeroptionalItems per page

SCIMMemberReference

Properties

PropertyTypeRequiredDescription
valuestring✅Member ID
$refstringoptionalURI reference to the member
typeEnum<'User' | 'Group'>optionalMember type
displaystringoptionalMember display name

SCIMMeta

Properties

PropertyTypeRequiredDescription
resourceTypestringoptionalResource type
createdstringoptionalCreation timestamp
lastModifiedstringoptionalLast modification timestamp
locationstringoptionalResource location URI
versionstringoptionalEntity tag (ETag) for concurrency control

SCIMName

Properties

PropertyTypeRequiredDescription
formattedstringoptionalFormatted full name
familyNamestringoptionalFamily name (last name)
givenNamestringoptionalGiven name (first name)
middleNamestringoptionalMiddle name
honorificPrefixstringoptionalHonorific prefix (Mr., Ms., Dr.)
honorificSuffixstringoptionalHonorific suffix (Jr., Sr.)

SCIMPatchOperation

Properties

PropertyTypeRequiredDescription
opEnum<'add' | 'remove' | 'replace'>✅Operation type
pathstringoptionalAttribute path (optional for add)
valueanyoptionalValue to set

SCIMPatchRequest

Properties

PropertyTypeRequiredDescription
schemasstring[]✅SCIM schema URIs
OperationsObject[]✅Patch operations

SCIMPhoneNumber

Properties

PropertyTypeRequiredDescription
valuestring✅Phone number
typeEnum<'work' | 'home' | 'mobile' | 'fax' | 'pager' | 'other'>optionalPhone number type
displaystringoptionalDisplay label
primaryboolean✅Primary phone indicator

SCIMUser

Properties

PropertyTypeRequiredDescription
schemasstring[]✅SCIM schema URIs (must include User schema)
idstringoptionalUnique resource identifier
externalIdstringoptionalExternal identifier from client system
userNamestring✅Unique username (REQUIRED)
nameObjectoptionalStructured name components
displayNamestringoptionalDisplay name for UI
nickNamestringoptionalNickname
profileUrlstringoptionalProfile page URL
titlestringoptionalJob title
userTypestringoptionalUser type (employee, contractor)
preferredLanguagestringoptionalPreferred language (ISO 639-1)
localestringoptionalLocale (e.g., en-US)
timezonestringoptionalTimezone
activeboolean✅Account active status
passwordstringoptionalPassword (write-only)
emailsObject[]optionalEmail addresses
phoneNumbersObject[]optionalPhone numbers
imsObject[]optionalIM addresses
photosObject[]optionalPhoto URLs
addressesObject[]optionalPhysical addresses
groupsObject[]optionalGroup memberships
entitlementsObject[]optionalEntitlements
rolesObject[]optionalRoles
x509CertificatesObject[]optionalX509 certificates
metaObjectoptionalResource metadata
urn:ietf:params:scim:schemas:extension:enterprise:2.0:UserObjectoptionalEnterprise user attributes

On this page

SCIM 2.0 Protocol ImplementationOverviewUse CasesSpecification ReferencesIndustry ImplementationsTypeScript UsageSCIMAddressPropertiesSCIMBulkOperationPropertiesSCIMBulkRequestPropertiesSCIMBulkResponsePropertiesSCIMBulkResponseOperationPropertiesSCIMEmailPropertiesSCIMEnterpriseUserPropertiesSCIMErrorPropertiesSCIMGroupPropertiesSCIMGroupReferencePropertiesSCIMListResponsePropertiesSCIMMemberReferencePropertiesSCIMMetaPropertiesSCIMNamePropertiesSCIMPatchOperationPropertiesSCIMPatchRequestPropertiesSCIMPhoneNumberPropertiesSCIMUserProperties