SCIM provisioning

Provision and deprovision enterprise members from your identity provider. SCIM 2.0 (RFC 7643/7644), served over REST rather than GraphQL.

The base URL carries no enterprise id. The tenant comes from your token, so a connector is configured with this URL exactly as written.

Point your IdP's SCIM connector at that base and give it an OAuth 2.0 bearer token. Everything below describes what the connector will find.

Credentials

client_credentials only. Mint a token at the enterprise token endpoint:

The request body is JSON and the grant field is spelled grant_type — verified against the deployed endpoint as of 2026-09-01. See OAuth 2.0 for the full exchange.

Two scopes gate the surface:

Okta and Entra ID

Okta supports OAuth 2.0 client credentials for SCIM, so its provisioning connector authenticates against this API directly: give it the token endpoint above, your client id and secret, and the two scopes.

Authentication and authorisation failures

The checks run in a fixed order and the first one to fail is the one you see, so the response tells you which switch is off.

Insufficient scope is 403, not 401. A 401 means the bearer token itself is missing, malformed, expired or revoked, and those responses carry WWW-Authenticate: Bearer realm="scim". A token that has been revoked but has not yet expired fails check 1 rather than a later one — the check is a liveness lookup, not a signature test.

None of the 403s carry a scimType field. It is omitted, not null.

A client_credentials token skips check 5 entirely: it carries user_id: 0 and no account, so there is no permission for it to hold. enterprise.scim.manage constrains only tokens minted for a signed-in account.

The tenant switch in check 3 is the scimEnabled field in Settings, writable with enterprise:settings:write. It is read per request, so turning SCIM off takes effect immediately rather than when tokens expire.

SCIM is one of two ways to provision members automatically. The other is SFTP data automation, which takes CSV files from an HR system instead. An enterprise runs one or neither, never both: a settings write that would leave scimEnabled and sftpEnabled both on is rejected, so turn SFTP off in the same write that turns SCIM on.

One failure happens before SCIM is reached at all. If enterprise:scim:read or enterprise:scim:write is not on your client's registration, the token endpoint refuses to issue and you never get as far as a 403:

Endpoints

Responses are always application/scim+json. Request bodies are parsed regardless of the content type you send.

Discovery

/ServiceProviderConfig reports the subset of SCIM this server implements:

documentationUri points at this page, https://developers.kesk.app/enterprise/scim.

/Schemas advertises exactly two schemas:

system is a top-level, non-standard attribute. It is declared in /Schemas rather than hidden under a vendor URN, so a connector that reads schemas will see it.

/ResourceTypes lists two: User, at /Users, described as Enterprise member; and Group, at /Groups, described as Enterprise role.

Also ignored rather than rejected: attributes and excludedAttributes, any other unrecognised query parameter, and unknown body fields.

Users

A User is an enterprise member. The resource id is the member's id within your tenant, rendered as a string. externalId is stored and echoed back but is never used as the id.

Listing

Deactivated members stay in the list. That is deliberate: a connector that stopped seeing them would re-create everyone it had just deprovisioned.

Filters

Only attribute eq "value" parses, and only on two attributes:

Anything else — another attribute, another operator (co, sw, pr, ne), an unquoted value, or an and/or compound — returns 400 with scimType: "invalidFilter" rather than quietly returning the whole directory.

A userName filter that matches nobody returns an empty page with totalResults: 0, not a 404.

Creating

Returns 201 with a Location header. userName is the only required field; active defaults to true when absent. If emails is supplied, the primary entry is used as the address and userName is not; otherwise userName is the address.

A create for an address that is already a live member returns 409 with scimType: "uniqueness". Identity providers rely on that to switch from create to update, so it is the correct answer rather than an error to design around. If the address belongs to a member you previously deleted, the create revives that member and returns their original id.

A new member who lands in no group gets the Enterprise Member role. If the address has no Kesk account yet, one is created and a verification email is sent; the password is the platform's and cannot be set through SCIM.

Updating

PATCH is the safer verb. It honours these paths:

Any other path returns 400 invalidPath.

Deprovisioning

Returns 200 with the full resource. The member is retained, not deleted: they stop being active, they stay in the directory, and the same call with true reactivates them.

op is accepted in any casing (replace, Replace, REPLACE), and value accepts the strings "true" and "false" as well as JSON booleans, because provisioning agents send all of these.

DELETE /Users/{id} returns 204 with no body. It is a soft delete — the member stops appearing, and a later create for the same address revives them.

Groups

A Group is an enterprise role. Creating a group creates a role; assigning members assigns that role.

Returns 201 with a Location header. A duplicate displayName returns 409 uniqueness.

A group created through SCIM carries no platform permissions. Granting any would let an identity provider mint authority by choosing a group name. What a role grants is set by an administrator, not through this API and not through SCIM — so a group your IdP creates is a container for membership until someone gives the matching role its permissions.

Platform-provisioned groups

Groups the platform created carry system: true. Members can be assigned to them, but they cannot be renamed or deleted — both return 400 with scimType: "mutability".

There are three of them, and /Groups returns them under these exact displayName values:

A user created through SCIM who is assigned to no group defaults to Enterprise Member.

Filters

displayName eq "Engineering" only. Any other attribute returns 400 invalidFilter.

PATCH

Response shapes

A list:

Resources has a capital R. itemsPerPage is the real length of the page returned, not the count you asked for, so a short page is how you recognise the last one.

An error:

status is a string, per RFC 7644 §3.12, and always matches the HTTP status. scimType is omitted when there isn't one. The values this server emits are invalidFilter, invalidPath, invalidSyntax, invalidValue, mutability and uniqueness.

An unknown path under /scim/v2 returns a SCIM 404 rather than the platform's own error shape, and an unsupported method returns a SCIM 405.

Reference

Generated reference — every type, field and argument of the Enterprise GraphQL API, built from the live schema. SCIM is a separate REST surface and is documented in full on this page.