This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.
Using the SCIM 2.0 REST APIs
- Former user (Deleted)
- Gomathy Kumarakuruparan (Unlicensed)
- Former user (Deleted)
Tip: Prior to IS 5.4.0, SCIM 2.0 was supported as an external connector that could be plugged in to WSO2 Identity Server. From 5.4.0 onwards, SCIM 2.0 is supported OOTB with WSO2 IS.
This REST API implements the SCIM 2.0 Protocol according to the SCIM 2.0 specification.The following endpoints are supported with WSO2 Identity Server.
Users endpoint
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
This endpoint is used to create and manage users and their profile attributes.
From WSO2 5.8.0 onwards, new configurations have been added to support filtering users and groups only from the PRIMARY domain. If these properties are enabled, the responses recieved for the users endpoint and groups endpoint will change. For more information, see /wiki/spaces/IS580/pages/41127141 topic.
GET/ Get User by ID
GET https://localhost/t/{tenant-domain}/scim2/Users/{id}
This API is used to retrieve users by their user ID. It returns an HTTP 200 response if the user is not found.
Request curl -v -k --user [username]:[password] https://localhost:9443/scim2/Users/[user ID] |
Sample cURL curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd' |
Response {"emails":[{"type":"work","value":"kim_j@wso2.com"},{"type":"home","value":"kim.jackson@gmail.com"}],"meta":{"created":"2018-08-15T14:55:23Z","location":"https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd","lastModified":"2018-08-15T14:55:23Z","resourceType":"User"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"roles":[{"type":"default","value":"Internal/everyone"}],"name":{"givenName":"kim","familyName":"jackson"},"id":"c8c821ba-1200-495e-a775-79b260e717bd","userName":"kim"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd' | String | - |
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd?attributes=userName,name.familyName’ | String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd?excludedAttributes=userName,name.familyName’ | String | - |
Responses
- HTTP 200 - Valid user is found
- HTTP 401 - Unauthorized
- HTTP 404 - Valid user is not found
POST/ Create User
POST https://localhost/t/{tenant-domain}/scim2/Users
This API creates a user and returns the user details along with the user's unique ID. It returns HTTP 201 if the user is successfully created.
Request curl -v -k --user [username]:[password] --data '{"schemas":[],"name":{"familyName":[last name],"givenName":[name]},"userName":[username],"password":[password],"emails":[{"primary":[true/false],"value":[email address],"type":[home/work]},{"value":[email address 2],"type":[home/work]}]}--header "Content-Type:application/json" https://localhost:9443/scim2/Users
|
Sample cURL curl -v -k --user admin:admin --data '{"schemas":[],"name":{"familyName":"jackson","givenName":"kim"},"userName":"kim","password":"kimwso2","emails":[{"primary":true,"value":"kim.jackson@gmail.com","type":"home"},{"value":"kim_j@wso2.com","type":"work"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users
|
Response {"emails":[{"type":"home","value":"kim.jackson@gmail.com","primary":true},{"type":"work","value":"kim_j@wso2.com"}],"meta":{"created":"2018-08-15T14:55:23Z","location":"https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd","lastModified":"2018-08-15T14:55:23Z","resourceType":"User"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"name":{"familyName":"jackson","givenName":"kim"},"id":"c8c821ba-1200-495e-a775-79b260e717bd","userName":"kim"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin --data '{"schemas":[],"name":{"familyName":"jackson","givenName":"kim"},"userName":"kim","password":"kimwso2","emails":[{"primary":true,"value":"kim.jackson@gmail.com","type":"home"},{"value":"kim_j@wso2.com","type":"work"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users?attributes=userName,name.familyName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin --data '{"schemas":[],"name":{"familyName":"jackson","givenName":"kim"},"userName":"kim","password":"kimwso2","emails":[{"primary":true,"value":"kim.jackson@gmail.com","type":"home"},{"value":"kim_j@wso2.com","type":"work"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users?excludedAttributes=userName,name.familyName
| String | - |
| Body | body (optional) | A JSON object that contains relevant values for creating a user. Sample Request curl -v -k --user admin:admin --data '{"schemas":[],"name":{"familyName":"jackson","givenName":"kim"},"userName":"kim","password":"kimwso2","emails":[{"primary":true,"value":"kim.jackson@gmail.com","type":"home"},{"value":"kim_j@wso2.com","type":"work"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users
| String | - |
Responses
- HTTP 201 - Valid user is created
- HTTP 401 - Unauthorized
- HTTP 404 - Invalid user
Tip: To create a user in a particular user store, add the {domainName}/ prefix in front of the user name.
curl -v -k --user admin:admin --data '{"schemas":[],"name":{"familyName":"jackson","givenName":"kim"},"userName":"WSO2/kim","password":"kimwso2","emails":[{"primary":true,"value":"kim.jackson@gmail.com","type":"home"},{"value":"kim_j@wso2.com","type":"work"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users
DELETE/ Delete User by ID
DELETE https://localhost/t/{tenant-domain}/scim2/Users/{id}
This API deletes a user using the user's unique ID. It returns HTTP 204 if the user is successfully deleted.
Request curl -v -k --user [username]:[password] -X DELETE https://localhost:9443/scim2/Users/[user ID] -H "Accept: application/scim+json" |
Sample cURL curl -v -k --user admin:admin -X DELETE https://localhost:9443/scim2/Users/b228b59d-db19-4064-b637-d33c31209fae -H "Accept: application/scim+json" |
Response HTTP/1.1 204 No Content |
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. | String | - |
Responses
- HTTP 204 - User has been succesfully deleted
- HTTP 401 - Unauthorized
- HTTP 404 - Valid user is not found
GET/ Get Users (User Listing/Filtering)
GET https://localhost/t/{tenant-domain}/scim2/Users
This API returns users according to the filter, sort and pagination parameters. It returns an HTTP 404 response if the users are not found. Pagination is not supported across user stores and LDAP multi-attribute group filtering. However, filtering is supported across multiple user stores.
Request curl -v -k --user [username]:[password] 'https://localhost:9443/scim2/Users?startIndex=[value]&count=[value]&domain=[value]&filter=[query]&attributes=[attribute names]' |
Sample cURL curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users?startIndex=1&count=10&domain=PRIMARY&filter=userName+sw+ki+and+name.familyName+co+ack&attributes=userName,name.familyName' |
Response {"totalResults":1,"startIndex":1,"itemsPerPage":1,"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],"Resources":[{"emails":[{"type":"work","value":"kim_j@wso2.com"},{"type":"home","value":"kim.jackson@gmail.com"}],"meta":{"created":"2018-08-15T14:55:23Z","location":"https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd","lastModified":"2018-08-15T14:55:23Z","resourceType":"User"},"roles":[{"type":"default","value":"Internal/everyone"}],"name":{"givenName":"kim","familyName":"jackson"},"id":"c8c821ba-1200-495e-a775-79b260e717bd","userName":"kim"}]}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users?startIndex=1&count=10&domain=PRIMARY&attributes=userName,name.familyName' curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users?startIndex=1&count=10&domain=PRIMARY&filter=userName+sw+ki+and+name.familyName+co+ack&attributes=userName,name.familyName' | String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users?startIndex=1&count=10&domain=PRIMARY&excludedAttributes=userName,name.familyName' curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users?startIndex=1&count=10&domain=PRIMARY&filter=userName+sw+ki+and+name.familyName+co+ack&excludedAttributes=userName,name.familyName' | String | - |
| Query | filter (optional) | A filter expression used to filter users. Supported filter operators are ‘ Note that operators are case-insensitive. | String | - |
| Query | startIndex (optional) | The query results are listed from the position specified by the number given as the startIndex parameter value. For example, if there are 10 query results and the startIndex value is 5, the query results will be listed starting from the 5th query result onwards. | Integer | 1 |
| Query | count (optional) | Specifies the desired maximum number of query results per page. This parameter is optional but it is recommended to include it in the request. When this parameter is not included in the request, the response returns all users from a given domain or across all user stores. When this parameter is set to 0 (zero) or is a negative value, no users are retrieved. | Integer | - |
| Query | sortBy (optional) | Specifies the attribute whose value can be used to order the returned responses. This parameter is not supported for this version. | String | - |
| Query | sortOrder (optional) | The order in which the "sortBy" parameter is applied. (e.g., ascending order) This parameter is not supported for this version. | String | - |
| Query | domain (optional) | The name of the user store to which filtering needs to be applied. | String | - |
Responses
- HTTP 200 - Valid users are found
- HTTP 401 - Unauthorized
- HTTP 404 - Valid users are not found
There are two ways to retrieve users from a particular user store:
Using the
domainquery parameter
Filter or list users from a particular domain by setting the domain query parameter as shown in the example below.Sample Requestcurl -v -k --user admin:admin 'https://localhost:9443/scim2/Users?startIndex=1&count=10&domain=WSO2
Adding the “
{domain}/” prefix in front of the filter value
Filter or list users from a particular domain by specifying the domain in front of the filter value as shown in the example below.
Note that this feature can only be used with “userName” and “groups” attributes.
If the domain name is specified in both the query parameter and the filter value, an ERROR is thrown if the two values are not equal.curl -v -k --user admin:admin 'https://localhost:9443/scim2/Users?startIndex=1&count=10&filter=userName+sw+WSO2/ki'
POST/ Search Users
POST https://localhost/t/{tenant-domain}/scim2/Users/.search
This API returns users according to the filter, sort and pagination parameters. It returns an HTTP 404 response if the users are not found.
Request curl -v -k --user [username]:[password] --data '{"schemas": ["urn:ietf:params:scim:api:messages:2.0:SearchRequest"],"attributes": [attribute names],"filter": [filter query],"domain": [domain name],"startIndex": [value],"count": [value]}' --header "Content-Type:application/scim+json" 'https://localhost:9443/scim2/Users/.search'
|
Sample cURL curl -v -k --user admin:admin --data '{"schemas": ["urn:ietf:params:scim:api:messages:2.0:SearchRequest"],"attributes": ["name.familyName", "userName"],"filter":"userName sw ki and name.familyName co ack","domain":"PRIMARY","startIndex": 1,"count": 10}' --header "Content-Type:application/scim+json" 'https://localhost:9443/scim2/Users/.search'
|
Response {"totalResults":1,"startIndex":1,"itemsPerPage":1,"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],"Resources":[{"name":{"familyName":"jackson"},"id":"c8c821ba-1200-495e-a775-79b260e717bd","userName":"kim"}]}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Body | body (optional) | This is a JSON object that contains relevant values used to search for a user. | String | - |
Responses
- HTTP 200 - Valid users are found
- HTTP 401 - Unauthorized
- HTTP 404 - Valid users are not found
PATCH/ Update User
PATCH https://localhost/t/{tenant-domain}/scim2/Users/{id}
This API updates user details and returns the updated user details using a PATCH operation. It returns an HTTP 404 response if the user is not found.
Request curl -v -k --user [username]:[password] -X PATCH -d '{"schemas":[],"Operations":[{"op":[operation],"value":{[attributeName]:[attribute value]}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users/[user ID]
|
Sample cURL curl -v -k --user admin:admin -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"nickName":"shaggy"}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd
|
Response {"emails":[{"type":"work","value":"kim_j@wso2.com"},{"type":"home","value":"kim.jack@gmail.com"}],"meta":{"created":"2018-08-15T14:55:23Z","location":"https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd","lastModified":"2018-08-16T14:46:07Z","resourceType":"User"},"nickName":"shaggy","schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"roles":[{"type":"default","value":"Internal/everyone"}],"name":{"givenName":"kim","familyName":"jackson"},"id":"c8c821ba-1200-495e-a775-79b260e717bd","userName":"kim"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. | String | - |
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"nickName":"shaggy"}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd?attributes=userName,name.familyName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excludedattributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"nickName":"shaggy"}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd?excludedAttributes=userName,name.familyName
| String | - |
| Body | body (optional) | This is a JSON object that contains relevant values used to search for a user. |
Responses
- HTTP 200 - User has been successfully updated
- HTTP 401 - Unauthorized
- HTTP 404 - Valid user is not found
PUT/ Update User
PUT https://localhost/t/{tenant-domain}/scim2/Users/{id}
This API updates user details and returns the updated user details using a PUT operation. It returns an HTTP 404 response if the user is not found.
Request curl -v -k --user [username]:[password] -X PUT -d '{"schemas":[],"name":{"familyName":[last name],"givenName":[name]},"userName":[username],"emails":[{"value":[email address],"type":[home/work]},{"value":[email address 2],"type":[home/work]}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users/[user ID]
|
Sample cURL curl -v -k --user admin:admin -X PUT -d '{"schemas":[],"name":{"familyName":"jackson","givenName":"kim"},"userName":"kim","emails":[{"value":"kim_j@wso2.com","type":"work"},{"value":"kim.jack@gmail.com","type":"home"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd
|
Response {"emails":[{"type":"work","value":"kim_j@wso2.com"},{"type":"home","value":"kim.jack@gmail.com"}],"meta":{"created":"2018-08-15T14:55:23Z","location":"https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd","lastModified":"2018-08-16T14:24:00Z","resourceType":"User"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"roles":[{"type":"default","value":"Internal/everyone"}],"name":{"givenName":"kim","familyName":"jackson"},"id":"c8c821ba-1200-495e-a775-79b260e717bd","userName":"kim"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. | String | - |
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"nickName":"shaggy"}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd?attributes=userName,name.familyName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"nickName":"shaggy"}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Users/c8c821ba-1200-495e-a775-79b260e717bd?excludedAttributes=userName,name.familyName
| String | - |
| Body | body (optional) | This is a JSON object that contains relevant values used to search for a user. | String | - |
Responses
- HTTP 200 - User has been successfully updated
- HTTP 401 - Unauthorized
- HTTP 404 - Valid users are not found
Groups endpoint
This endpoint is used to create and manage groups and group members.
From WSO2 5.8.0 onwards, new configurations have been added to support filtering users and groups only from the PRIMARY domain. If these properties are enabled, the responses recieved for the users endpoint and groups endpoint will change. For more information, see /wiki/spaces/IS580/pages/41127141 topic.
GET/ Group by ID
GET https://localhost/t/{tenant-domain}/scim2/Groups/{id}
This API returns the group details of a particular group using its unique ID. It returns an HTTP 200 response if the group is found.
Request curl -v -k --user [username]:[password] https://localhost:9443/scim2/Groups/[group ID] |
Sample cURL curl -v -k --user admin:admin https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36 |
Response {"displayName":"manager","meta":{"created":"2018-08-16T15:27:42Z","location":"https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36","lastModified":"2018-08-16T15:27:42Z"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"id":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. | String | - |
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36?attributes=displayName’ | String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be exclused from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36?excludedAttributes=displayName’ | String | - |
Responses
- HTTP 200 - Valid group is found
- HTTP 401 - Unauthorized
- HTTP 404 - Valid group is not found
POST/ Create Group
POST https://localhost/t/{tenant-domain}/scim2/Groups
This API creates a group and returns the details of the created group including its unique ID. It returns an HTTP 201 response if the group is successfully created.
Request curl -v -k --user [username]:[password] --data '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"displayName": [group name], "members": [{"value": [user ID],"$ref":[ref url],"display": [user name] }]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups
|
Sample cURL curl -v -k --user admin:admin --data '{"displayName":"manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups
|
Response {"displayName":"PRIMARY/manager","meta":{"created":"2018-08-16T15:27:42Z","location":"https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36","lastModified":"2018-08-16T15:27:42Z","resourceType":"Group"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"id":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin --data '{"displayName":"manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups?attributes=displayName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be exclused from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin --data '{"displayName":"manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups?excludedAttributes=displayName
| String | - |
| Body | body (optional) | This is a JSON object that contains relevant values used to create a group. Sample Request curl -v -k --user admin:admin --data '{"displayName":"manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups
| String | - |
Responses
- HTTP 201 - Valid group is created
- HTTP 401 - Unauthorized
- HTTP 404 - Group is not found
POST/ Create Group
POST https://localhost/t/{tenant-domain}/scim2/Groups
This API creates a group and returns the details of the created group including its unique ID. It returns an HTTP 201 response if the group is successfully created.
Request curl -v -k --user [username]:[password] --data '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"displayName": [group name], "members": [{"value": [user ID],"$ref":[ref url],"display": [user name] }]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups
|
Sample cURL curl -v -k --user admin:admin --data '{"displayName":"manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups
|
Response {"displayName":"PRIMARY/manager","meta":{"created":"2018-08-16T15:27:42Z","location":"https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36","lastModified":"2018-08-16T15:27:42Z","resourceType":"Group"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"id":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response.When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin --data '{"displayName":"manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups?attributes=displayName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin --data '{"displayName":"manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups?excludedAttributes=displayName
| String | - |
| Body | body (optional) | This is a JSON object that contains relevant values used to create a group. Sample Request curl -v -k --user admin:admin --data '{"displayName":"manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups
| String | - |
Responses
- HTTP 201 - Valid group is created
- HTTP 401 - Unauthorized
- HTTP 404 - Invalid group
Tip: To create a user in a particular user store, add the {domainName}/ prefix in front of the user name as shown in the example below.
curl -v -k --user admin:admin --data '{"displayName":"WSO2DOMAIN/manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups
DELETE/ Delete Group By ID
DELETE https://localhost/t/{tenant-domain}/scim2/Groups/{id}
This API deletes a particular group using its unique ID. It returns an HTTP 204 reponse if the group is successfully deleted.
Request curl -v -k --user [username]:[password] -X DELETE https://localhost:9443/scim2/Groups/[group ID] -H "Accept: application/json" |
Sample cURL curl -v -k --user admin:admin -X DELETE https://localhost:9443/scim2/Groups/0d32c19e-7a74-4c22-b1ad-1d21317d5b04 -H "Accept:application/json" |
Response HTTP/1.1 204 No Content |
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. | String | - |
Responses
- HTTP 204 - Valid group has been successfully deleted.
- HTTP 401 - Unauthorized
- HTTP 404 - Invalid group
GET/ Filter Groups
GET https://localhost/t/{tenant-domain}/scim2/Groups
This API returns groups according to the specified filter, sort and pagination parameters. It returns HTTP 404 if the groups are not found.
Request curl -v -k --user [username]:[password] 'https://localhost:9443/scim2/Groups?startIndex=[value]&count=[value]&filter=[query]&attributes=[attribute names]' |
Sample cURL curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups?filter=displayName+eq+manager' |
Response {"totalResults":1,"startIndex":1,"itemsPerPage":1,"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],"Resources":[{"displayName":"PRIMARY/manager","meta":{"created":"2018-08-16T15:27:42Z","location":"https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36","lastModified":"2018-08-16T15:27:42Z"},"members":[{"display":"kim","value":"b3c07363-f0ed-4798-97f9-0cb26d9d79c0"},{"display":"Kris","value":"81cbba1b-c259-485d-8ba4-79afb03e5bd1"}],"id":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}]}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups?filter=displayName+eq+manager&attributes=displayName' | String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be exclused from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups?filter=displayName+eq+manager&excludedAttributes=displayName' | String | - |
| Query | filter (optional) | A filter expression used to filter users. Supported filter operators are ‘ Note that operators are case-insensitive. | String | - |
| Query | startIndex (optional) | The query results are listed from the position specified by the number given as the Pagination is not supported. | Integer | 1 |
| Query | count (optional) | Specifies the desired maximum number of query results per page. Pagination is not supported. Note: When this parameter is not included in the request, the response returns all groups from the given domain or across all user stores. When the count is zero or any value less than zero, no groups are returned. | Integer | - |
| Query | sortBy (optional) | Specifies the attribute whose value can be used to order the returned responses. This parameter is not supported for this version. | String | - |
| Query | sortOrder (optional) | The order in which the "sortBy" parameter is applied. (e.g., ascending order) This parameter is not supported for this version. | String | - |
| Query | domain (optional) | The name of the user store to which filtering needs to be applied. | String | - |
Responses
- HTTP 200 - Valid groups have been successfully returned.
- HTTP 401 - Unauthorized
- HTTP 404 - Invalid group
There are two ways to retrieve users from a particular user store:
Using the
domainquery parameter
Setting the domain parameter enables both filtering and listing groups in a specified user store.Sample Requestcurl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups?startIndex=3&count=20&domain=WSO2’
Adding the “
{domain}/” prefix in front of the filter value
Filter or list users from a particular domain by specifying the domain in front of the filter value as shown in the example below.
Note that this feature can only be used with "displayName", "members.display" and "members.value" attributes.
If the domain name is specified in both the query parameter and the filter value, an ERROR is thrown if the two values are not equal.curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups?startIndex=2&count=20&filter=displayName+eq+WSO2/manager'
Optionally, you can also retrieve Internal/Application domain roles with the "Groups" endpoint using the "list" and "filter" operations.
Note that this is only applicable for the Groups endpoint.
Note that this feature is available from WSO2 IS 5.8.0 5062 WUM update. You can apply the WUM update using the WSO2 Update Manager (WUM). To deploy a WUM update into production, you need to have a paid subscription. If you do not have a paid subscription, you can use this feature with the next version of WSO2 Identity Server when it is released. For more information on updating WSO2 Identity Server using WUM, see Getting Started with WUM in the WSO2 Administration Guide.
curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups?domain=Application'
curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups?filter=displayName+eq+myapp&domain=Application'
curl -v -k --user admin:admin 'https://localhost:9443/scim2/Groups?filter=displayName+sw+Application/my'
POST/ Search Groups
POST https://localhost/t/{tenant-domain}/scim2/Groups/.search
This API returns groups according to the specified filter, sort and pagination parameters. It returns an HTTP 404 response if the groups are not found.
Request curl -v -k --user [username]:[password] --data '{"schemas": [],"startIndex": [value], "filter": [query]}' --header "Content-Type:application/scim+json" https://localhost:9443/scim2/Groups/.search
|
Sample cURL curl -v -k --user admin:admin --data '{"schemas": ["urn:ietf:params:scim:api:messages:2.0:SearchRequest"],"startIndex": 1, "filter": "displayName eq manager"}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/.search
|
Response {"totalResults":1,"startIndex":1,"itemsPerPage":1,"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],"Resources":[{"displayName":"PRIMARY/manager","meta":{"created":"2018-08-16T15:27:42Z","location":"https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36","lastModified":"2018-08-16T15:27:42Z"},"members":[{"display":"kim","value":"b3c07363-f0ed-4798-97f9-0cb26d9d79c0"},{"display":"Kris","value":"81cbba1b-c259-485d-8ba4-79afb03e5bd1"}],"id":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}]}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Body | body (optional) | This is a JSON object that contains relevant values used to search for a group. | String | - |
Responses
- HTTP 200 - Valid groups are found
- HTTP 401 - Unauthorized
- HTTP 404 - Groups are not found
PATCH/ Update User
PATCH https://localhost/t/{tenant-domain}/scim2/Groups/{id}
This API updates the group details and returns the updated group details using a PATCH operation. It returns an HTTP 404 response if the group is not found.
Request curl -v -k --user [username]:[password] -X PATCH -d '{"schemas":[],"Operations":[{"op": [operation],"value":{"members":[{"display": [name],"$ref": [ref],"value": [member user ID] }] } }]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/[group ID]
|
Sample cURL curl -v -k --user admin:admin -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"members":[{"display": "Kris","$ref":"https://localhost:9443/scim2/Users/81cbba1b-c259-485d-8ba4-79afb03e5bd1","value": "81cbba1b-c259-485d-8ba4-79afb03e5bd1"}]}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36
|
Response {"displayName":"PRIMARY/manager","meta":{"created":"2018-08-16T15:27:42Z","location":"https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36","lastModified":"2018-08-16T15:51:45Z"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"members":[{"display":"kim","value":"b3c07363-f0ed-4798-97f9-0cb26d9d79c0"},{"display":"Kris","value":"81cbba1b-c259-485d-8ba4-79afb03e5bd1","$ref":"https://localhost:9443/scim2/Users/81cbba1b-c259-485d-8ba4-79afb03e5bd1"}],"id":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. | String | - |
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"members":[{"display": "Kris","$ref":"https://localhost:9443/scim2/Users/81cbba1b-c259-485d-8ba4-79afb03e5bd1","value": "81cbba1b-c259-485d-8ba4-79afb03e5bd1"}]}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36?attributes=displayName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be exclused from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"members":[{"display": "Kris","$ref":"https://localhost:9443/scim2/Users/81cbba1b-c259-485d-8ba4-79afb03e5bd1","value": "81cbba1b-c259-485d-8ba4-79afb03e5bd1"}]}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36?excludedAttributes=displayName
| String | - |
| Body | body (optional) | This is a JSON object that contains relevant values used to search for a user. | String | - |
Responses
- HTTP 200 - Group has been successfully updated
- HTTP 401 - Unauthorized
- HTTP 404 - Valid group is not found
PUT/ Update User
PUT https://localhost/t/{tenant-domain}/scim2/Groups/{id}
This API updates the group details and returns the updated group details using a PUT operation. It returns an HTTP 404 reponse if the group is not found.
Request curl -v -k --user[username]:[password] -X PUT -d '{"displayName":[group name],"members":[{"value":[user ID],"display":[user's name]}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/[group ID]
|
Sample cURL curl -v -k --user admin:admin -X PUT -d '{"displayName":"manager","members":[{"value":"b3c07363-f0ed-4798-97f9-0cb26d9d79c0","display":"kim"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36
|
Response {"displayName":"PRIMARY/manager","meta":{"created":"2018-08-16T15:27:42Z","location":"https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36","lastModified":"2018-08-16T15:42:56Z"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:Group"],"members":[{"display":"kim","value":"b3c07363-f0ed-4798-97f9-0cb26d9d79c0"}],"id":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. | String | - |
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin -X PUT -d '{"displayName":"manager","members":[{"value":"b3c07363-f0ed-4798-97f9-0cb26d9d79c0","display":"kim"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36?attributes=displayName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be exclused from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user admin:admin -X PUT -d '{"displayName":"manager","members":[{"value":"b3c07363-f0ed-4798-97f9-0cb26d9d79c0","display":"kim"}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Groups/a43fe003-d90d-43ca-ae38-d2332ecc0f36?excludedAttributes=displayName
| String | - |
| Body | body (optional) | This is a JSON object that contains relevant values used to search for a user. | String | - |
Responses
- HTTP 200 - Group has been successfully updated
- HTTP 401 - Unauthorized
- HTTP 404 - Valid group is not found
Me Endpoint
This endpoint is used to create and manage the currently authenticated user.
POST/ Create Me
POST https://localhost/t/{tenant-domain}/scim2/Me
This API is used to register a user anonymously. It returns an HTTP 201 response if the user is successfully created. These endpoints are secured by default. Therefore, to invoke this API anonymously, set the secured property for the SCIM2 resource in the identity.xml file to false. For more information, see Authenticating and Authorizing REST APIs.
Request curl -v -k --data '{"schemas":[],"name:{"familyName":[last name],"givenName":[name]},"userName":[username],"password":[password],"emails":[{"primary":[true/false],"value":[email address],"type":[home/work]},{"value":[email address 2],"type":[home/work]}],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"employeeNumber":[employee ID],"manager":{"value":[manager's name]}}}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me
|
Sample cURL curl -v -k --data '{"schemas":[],"name":{"familyName":"Johnson","givenName":"Alex"},"userName":"alex","password":"alexwso2","emails":[{"primary":true,"value":"alex.j@gmail.com","type":"home"},{"value":"alex_j@wso2.com","type":"work"}],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"employeeNumber":"123A","manager":{"value":"Taylor"}}}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me
|
Response {"emails":[{"type":"home","value":"alex.j@gmail.com","primary":true},{"type":"work","value":"alex_j@wso2.com"}],"meta":{"created":"2018-08-17T10:34:29Z","location":"https://localhost:9443/scim2/Users/008bba85-451d-414b-87de-c03b5a1f4217","lastModified":"2018-08-17T10:34:29Z","resourceType":"User"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"manager":{"value":"Taylor"},"employeeNumber":"123A"},"name":{"familyName":"Johnson","givenName":"Alex"},"id":"008bba85-451d-414b-87de-c03b5a1f4217","userName":"alex"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --data '{"schemas":[],"name":{"familyName":"Johnson","givenName":"Alex"},"userName":"alex","password":"alexwso2","emails":[{"primary":true,"value":"alex.j@gmail.com","type":"home"},{"value":"alex_j@wso2.com","type":"work"}],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"employeeNumber":"123A","manager":{"value":"Taylor"}}}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me?attributes=userName,name.familyName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --data '{"schemas":[],"name":{"familyName":"Johnson","givenName":"Alex"},"userName":"alex","password":"alexwso2","emails":[{"primary":true,"value":"alex.j@gmail.com","type":"home"},{"value":"alex_j@wso2.com","type":"work"}],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"employeeNumber":"123A","manager":{"value":"Taylor"}}}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me?excludedAttributes=userName,name.familyName
| String | - |
| Body | body (optional) | A JSON object that contains relevant values for creating a user. | String | - |
Responses
- HTTP 201 - Valid user is created
- HTTP 401 - Unauthorized
- HTTP 404 - Invalid user
DELETE/ Delete Me
DELETE https://localhost/t/{tenant-domain}/scim2/Me
This API is used to delete the currently authenticated user. It returns HTTP 204 if the user is successfully deleted.
Request curl -v -k --user [username]:[password] -X DELETE https://localhost:9443/scim2/Me |
Sample cURL curl -v -k --user alex:alexwso2 -X DELETE https://localhost:9443/scim2/Me |
Response HTTP/1.1 204 NOT IMPLEMENTED |
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Path | id (required) | Unique ID of the resource type. | String | - |
Responses
- HTTP 204 - User has been succesfully deleted
- HTTP 401 - Unauthorized
- HTTP 404 - Valid user is not found
GET/ Get Me
GET https://localhost/t/{tenant-domain}/scim2/Me
This API returns the user details of the currently authenticated user. These endpoints are secured by default. Therefore, to invoke this API anonymously, set the secured property for the SCIM2 resource in the identity.xml file to false. For more information, see Authenticating and Authorizing REST APIs.
Request curl -v -k --user [username]:[password] https://localhost:9443/scim2/Me |
Sample cURL curl -v -k --user kim:kimwso2 https://localhost:9443/scim2/Me |
Response {"emails":[{"type":"work","value":"kim_j@wso2.com"},{"type":"home","value":"kim.jackson@gmail.com"}],"meta":{"created":"2018-08-16T17:19:43Z","location":"https://localhost:9443/scim2/Users/f60e6ddd-8d04-411f-92b9-c7ba95fb0fa9","lastModified":"2018-08-16T17:19:43Z","resourceType":"User"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"roles":[{"type":"default","value":"manager,Internal/everyone,admin"}],"name":{"givenName":"kim","familyName":"jackson"},"groups":[{"display":"manager","value":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}],"id":"f60e6ddd-8d04-411f-92b9-c7ba95fb0fa9","userName":"kim"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user alex:alexwso2 https://localhost:9443/scim2/Me?attributes=userName,name.familyName’ | String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user alex:alexwso2 https://localhost:9443/scim2/Me?excludedAttributes=userName,name.familyName’ | String | - |
Responses
- HTTP 200 - Valid user is found
- HTTP 401 - Unauthorized
- HTTP 404 - Valid user is not found
PATCH/ Update Me
PATCH https://localhost/t/{tenant-domain}/scim2/Me
This API uses a PATCH operation to update user details Returns HTTP 404 if the user is not found.
Request curl -v -k --user [username]:[password] -X PATCH -d '{"schemas":[],"Operations":[{"op":[operation],"value":{[attributeName]:[attribute value]}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me
|
Sample cURL curl -v -k --user kim:kimwso2 -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"nickName":"shaggy"}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me
|
Response {"emails":[{"type":"work","value":"jackson_k@wso2.com"},{"type":"home","value":"jacksonk@gmail.com"}],"meta":{"created":"2018-08-16T17:19:43Z","location":"https://localhost:9443/scim2/Users/f60e6ddd-8d04-411f-92b9-c7ba95fb0fa9","lastModified":"2018-08-17T11:43:34Z","resourceType":"User"},"nickName":"shaggy","schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"manager":{"value":"Taylor"},"employeeNumber":"123A"},"roles":[{"type":"default","value":"manager,Internal/everyone,admin"}],"name":{"givenName":"Kim","familyName":"JacksonJohn"},"groups":[{"display":"manager","value":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}],"id":"f60e6ddd-8d04-411f-92b9-c7ba95fb0fa9","userName":"kim"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user kim:kimwso2 -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"nickName":"shaggy"}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me?attributes=userName,name.familyName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excludedattributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user kim:kimwso2 -X PATCH -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","value":{"nickName":"shaggy"}}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me?excludedAttributes=userName,name.familyName
| String | - |
| Body | body (optional) | This is a JSON object that contains relevant values used to search for a user. |
Responses
- HTTP 200 - User has been successfully updated
- HTTP 401 - Unauthorized
- HTTP 404 - Valid user is not found
PUT/ Update User
PUT https://localhost/t/{tenant-domain}/scim2/Me
This API uses a PUT operation to update user details. It returns HTTP 404 if the user is not found.
Request curl -v -k --user [username]:[password] -X PUT -d '{"schemas":[],"name":{"familyName":[last name],"givenName":[name]},"emails":[{"primary":[true/false],"value":[email address],"type":[home/work]},{"value":[email address 2],"type":[home/work]}]}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me
|
Sample cURL curl -v -k --user kim:kimwso2 -X PUT -d '{"schemas":[],"name":{"familyName":"JacksonJohn","givenName":"Kim"},"userName":"kim","emails":[{"primary":true,"value":"jacksonk@gmail.com","type":"home"},{"value":"jackson_k@wso2.com","type":"work"}],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"employeeNumber":"123A","manager":{"value":"Taylor"}}}' --header "Content-Type:application/json" https://localhost:9443/scim2/Me
|
Response {"emails":[{"type":"work","value":"jackson_k@wso2.com"},{"type":"home","value":"jacksonk@gmail.com"}],"meta":{"created":"2018-08-16T17:19:43Z","location":"https://localhost:9443/scim2/Users/f60e6ddd-8d04-411f-92b9-c7ba95fb0fa9","lastModified":"2018-08-16T17:43:17Z","resourceType":"User"},"schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"manager":{"value":"Taylor"},"employeeNumber":"123A"},"roles":[{"type":"default","value":"manager,Internal/everyone,admin"}],"name":{"givenName":"Kim","familyName":"JacksonJohn"},"groups":[{"display":"manager","value":"a43fe003-d90d-43ca-ae38-d2332ecc0f36"}],"id":"f60e6ddd-8d04-411f-92b9-c7ba95fb0fa9","userName":"kim"}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Query | attributes (optional) | Attribute names of attributes that are to be included in the response. When this parameter is included in the request, the response returns only the attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user kim:kimwso2 -X PUT -d '{"schemas":[],"name":{"familyName":"JacksonJohn","givenName":"Kim"},"userName":"kim","emails":[{"primary":true,"value":"jacksonk@gmail.com","type":"home"},{"value":"jackson_k@wso2.com","type":"work"}],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"employeeNumber":"123A","manager":{"value":"Taylor"}}}' --header "Content-Type:application/json" https://localhost:9443/scim2/Meattributes=userName,name.familyName
| String | - |
| Query | excludedAttributes (optional) | Attribute names of attributes that are to be excluded from the response. When this parameter is included in the request, the response returns all attributes except the excluded attributes that are specified in the request. All the attributes of the users dialect and meta dialect are supported. For more information about this parameter, see the SCIM 2.0 specification. Sample Request curl -v -k --user kim:kimwso2 -X PUT -d '{"schemas":[],"name":{"familyName":"JacksonJohn","givenName":"Kim"},"userName":"kim","emails":[{"primary":true,"value":"jacksonk@gmail.com","type":"home"},{"value":"jackson_k@wso2.com","type":"work"}],"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"employeeNumber":"123A","manager":{"value":"Taylor"}}}' --header "Content-Type:application/json" https://localhost:9443/scim2/MeexcludedAttributes=userName,name.familyName
| String | - |
| Body | body (optional) | This is a JSON object that contains relevant values used to search for a user. | String | - |
Responses
- HTTP 200 - User has been successfully updated
- HTTP 401 - Unauthorized
- HTTP 404 - Valid users are not found
Bulk Endpoint
This endpoint is used for bulk operations.
POST/ Create Users in Bulk
POST https://localhost/t/{tenant-domain}/scim2/Bulk
This API is used to create multiple users at once. It returns an HTTP 201 response if the users are successfully created.
Request curl -v -k --user [username]:[password] --data '{"failOnErrors": [value],"schemas":[],"Operations":[{"method": [request type],"path": [end point],"bulkId": [bulk id] ,"data": [input user details] }] }' --header "Content-Type:application/scim+json" https://localhost:9443/scim2/Bulk
|
Sample cURL curl -v -k --user admin:admin --data '{"failOnErrors":1,"schemas":["urn:ietf:params:scim:api:messages:2.0:BulkRequest"],"Operations":[{"method": "POST","path": "/Users","bulkId": "qwerty","data":{"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"userName": "Kris","password":"krispass"}},{"method": "POST","path": "/Users","bulkId":"ytrewq","data":{"schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"userName":"Jesse","password":"jessepass","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"employeeNumber": "11250","manager": {"value": "bulkId:qwerty"}}}}]}' --header "Content-Type:application/scim+json" https://localhost:9443/scim2/Bulk
|
Response {"schemas":["urn:ietf:params:scim:api:messages:2.0:BulkResponse"],"Operations":[{"bulkId":"qwerty","method":"POST","location":"https://localhost:9443/scim2/Users/81cbba1b-c259-485d-8ba4-79afb03e5bd1","status":{"code":201}},{"bulkId":"ytrewq","method":"POST","location":"https://localhost:9443/scim2/Users/b489dacc-fc89-449c-89f6-7acc37422031","status":{"code":201}}]}
|
Parameters
| Type | Name | Description | Schema | Default Value |
|---|---|---|---|---|
| Body | body (optional) | This is a JSON object that contains relevant values used to create the users. | String | - |
Responses
- HTTP 200 - Valid users are created
- HTTP 401 - Unauthorized
- HTTP 404 - Invalid users
ResourceType Endpoint
This endpoint is used to retrieve meta data about the resource types.
GET/ Get Resource Types
GET https://localhost/t/{tenant-domain}/scim2/ResourceType
This API lists and returns metadata about resource types. It returns an HTTP 200 response if the schema is found.
Request curl -v -k --user [username]:[password] https://localhost:9443/scim2/ResourceType |
Sample cURL curl -v -k --user admin:admin https://localhost:9443/scim2/ResourceType |
Response {"schemas":["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],"resourceType":[{"schema":"urn:ietf:params:scim:schemas:core:2.0:User","endpoint":"/Users","meta":{"location":"https://localhost:9443/scim2/ResourceType/User","resourceType":"ResourceType"},"name":"User","description":"User Account","schemaExtensions":{"schema":"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User","required":false},"id":"User"},{"schema":"urn:ietf:params:scim:schemas:core:2.0:Group","endpoint":"/Groups","meta":{"location":"https://localhost:9443/scim2/ResourceType/Group","resourceType":"ResourceType"},"name":"Group","description":"Group","id":"Group"}]}
|
Parameters
None
Responses
- HTTP 200 - Schema is found
- HTTP 401 - Unauthorized
- HTTP 404 - Schema is not found
ServiceProviderConfig Endpoint
This endpoint is used to retrieve the service provider's configuration details.
GET/ Get Service Provider Config
GET https://localhost/t/{tenant-domain}/scim2/ServiceProviderConfig
This API is used to create multiple users at once. It returns an HTTP 201 response if the users are successfully created.
Request curl -v -k --user [username]:[password] https://localhost:9443/scim2/ServiceProviderConfig |
Sample cURL curl -v -k --user admin:admin https://localhost:9443/scim2/ServiceProviderConfig |
Response {"patch":{"supported":true},"filter":{"maxResults":200,"supported":true},"documentationUri":"http://example.com/help/scim.html","authenticationSchemes":[{"name":"OAuth Bearer Token","description":"Authentication scheme using the OAuth Bearer Token Standard","specUri":"http://www.rfc-editor.org/info/rfc6750","type":"oauthbearertoken","primary":true},{"name":"HTTP Basic","description":"Authentication scheme using the HTTP Basic Standard","specUri":"http://www.rfc-editor.org/info/rfc2617","type":"httpbasic","primary":false}],"schemas":["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],"etag":{"supported":false},"sort":{"supported":false},"bulk":{"maxPayloadSize":1048576,"maxOperations":1000,"supported":true},"changePassword":{"supported":false}}
|
Parameters
None
Responses
- HTTP 200 - Schema is found
- HTTP 401 - Unauthorized
- HTTP 404 - Schema is not found
Required permissions for SCIM 2.0 APIs
The default permissions required to access each resource in SCIM 2.0 are given below.
| Endpoint | HTTP Method | Permission |
|---|---|---|
| /scim2/Users | POST
| /permission/admin/manage/identity/usermgt/create
|
/scim2/Users
| GET
| /permission/admin/manage/identity/usermgt/list
|
/scim2/Groups
| POST
| /permission/admin/manage/identity/rolemgt/create
|
/scim2/Groups
| GET
| /permission/admin/manage/identity/rolemgt/view
|
/scim2/Users/(.*)
| GET
| /permission/admin/manage/identity/usermgt/view
|
/scim2/Users/(.*)
| PUT | /permission/admin/manage/identity/usermgt/update
|
/scim2/Users/(.*)
| PATCH | /permission/admin/manage/identity/usermgt/update
|
/scim2/Users/(.*)
| DELETE | /permission/admin/manage/identity/usermgt/delete
|
/scim2/Groups/(.*)
| GET
| /permission/admin/manage/identity/rolemgt/view
|
/scim2/Groups/(.*)
| PUT | /permission/admin/manage/identity/rolemgt/update
|
/scim2/Groups/(.*)
| PATCH | /permission/admin/manage/identity/rolemgt/update
|
/scim2/Groups/(.*)
| DELETE | /permission/admin/manage/identity/rolemgt/delete
|
/scim2/Me
| GET | /permission/admin/login
|
/scim2/Me
| DELETE | /permission/admin/login
|
/scim2/Me
| PUT | /permission/admin/login
|
/scim2/Me
| PATCH | /permission/admin/login
|
/scim2/Me
| POST | /permission/admin/manage/identity/usermgt/create
|
/scim2/ServiceProviderConfig
| all | - |
/scim2/ResourceType
| all | - |
/scim2/Bulk
| all | /permission/admin/manage/identity/usermgt
|
If the OverrideUsernameClaimFromInternalUsername property in user-mgt.xml in <IS_HOME>/repository/conf/identity
is enabled, the Username claim is populated even when SCIM is not enabled.
<OverrideUsernameClaimFromInternalUsername>true</OverrideUsernameClaimFromInternalUsername>
More information about how to secure the REST APIs and configure authorization level can be found from Authenticating and Authorizing REST APIs