> ## Documentation Index
> Fetch the complete documentation index at: https://docs.emailbison.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Provisioning

To request access to SCIM, you must be on an enterprise plan. Please contact us via your dedicated slack channel

## What is SCIM?

SCIM (System for Cross-domain Identity Management) is an open standard (RFC 7643/7644) that lets your identity provider (IdP) (such as Okta, Microsoft Entra ID, or OneLogin) automatically manage user accounts in EmailBison.

Instead of creating, updating, and removing accounts by hand, your IdP keeps them in sync for you. It handles:

* **Provisioning** - when you assign a person to the app in your IdP, an account is created here automatically
* **Updates** - profile changes (name, email) made in your IdP flow through to their account
* **Group sync** - groups in your IdP are mirrored as teams, and membership stays in sync
* **Deprovisioning** - when someone leaves your organization or is unassigned, their account is deactivated automatically, closing access immediately

SCIM works alongside SSO: SSO handles *authentication* (signing in), while SCIM handles the *lifecycle* of the account itself.

## Base URL

`https://your-app.example.com/api/scim/v2`

## Authentication

All requests must include a bearer token in the `Authorization` header.
Authorization: `Bearer <YOUR-SCIM-TOKEN>`

You can generate a SCIM token from your account settings. Treat it like a password - it grants full provisioning access.

## Supported endpoints

### Users

| Method | Endpoint      | Description                                           |
| ------ | ------------- | ----------------------------------------------------- |
| GET    | `/Users`      | List users. Supports *filter*, *startIndex*, *count*. |
| POST   | `/Users`      | Create a user.                                        |
| GET    | `/Users/{id}` | Retrieve a single user.                               |
| PUT    | `/Users/{id}` | Replace a user's attributes.                          |
| PATCH  | `/Users/{id}` | Partially update a user (e.g. deactivate).            |
| DELETE | `/Users/{id}` | Delete a user.                                        |

### Groups

| Method | Endpoint       | Description                                            |
| ------ | -------------- | ------------------------------------------------------ |
| GET    | `/Groups`      | List groups. Supports *filter*, *startIndex*, *count*. |
| POST   | `/Groups`      | Create a group.                                        |
| GET    | `/Groups/{id}` | Retrieve a single group.                               |
| PUT    | `/Groups/{id}` | Replace a group, including its full member list.       |
| PATCH  | `/Groups/{id}` | Partially update a group (add/remove members, rename). |
| DELETE | `/Groups/{id}` | Delete a group.                                        |

### Discovery

| Method | Endpoint                 | Description                                       |
| ------ | ------------------------ | ------------------------------------------------- |
| GET    | `/ServiceProviderConfig` | Describes supported SCIM features.                |
| GET    | `/ResourceTypes`         | Lists available resource types (*User*, *Group*). |
| GET    | `/Schemas`               | Lists supported SCIM schemas.                     |

## Notes

* Groups in your IdP map to teams in the application.
* Filtering supports the equality form, e.g. `filter=userName eq "jane@example.com"`.
* Deactivating a user (`active: false`) immediately blocks access; the account and its data are retained until deleted.
* Requests and responses use the `application/scim+json` content type.