SCIM API
SCIM is the standard REST protocol for provisioning and reading identities, users, groups and entitlements, in SailPoint.
SCIM (System for Cross-domain Identity Management) is an open REST standard for managing identities. IdentityIQ implements SCIM 2.0 so external systems can create and read users, groups and access using a consistent schema, instead of a bespoke integration per tool.
- SCIM is an open REST standard for identity management
- IdentityIQ implements SCIM 2.0
- Standard resources: Users, Groups, Entitlements
- Consistent schema across vendors
- Ideal for portals and ITSM integrations
SCIM (System for Cross-domain Identity Management) is an open standard for provisioning and managing identities across systems over REST/JSON. SailPoint both consumes and exposes SCIM, letting it integrate with the growing number of applications that speak this common protocol without a bespoke connector for each.
What SCIM standardises
SCIM defines a standard schema for users and groups and standard REST operations (create, read, update, delete, search) over them. Because many SaaS applications implement SCIM, a single, well-understood protocol can provision dozens of them, reducing the per-application integration effort dramatically.
How SailPoint uses SCIM
- As a client: SailPoint can provision to SCIM-enabled applications through a SCIM connector, creating and updating users and group memberships via the standard endpoints.
- As a provider: SailPoint exposes SCIM endpoints so other systems can query and manage identities it governs.
SCIM, federation and the bigger picture
SCIM is the provisioning counterpart to federation’s authentication. A typical modern SaaS integration pairs SAML or OIDC for login with SCIM for account lifecycle, federation gets the user in, SCIM makes sure the account and its access exist and are removed on time. SailPoint governs the SCIM side so provisioning stays policy-controlled and auditable.
Filtering and schema
SCIM’s filter syntax (eq, sw, co, and/or) is the model SailPoint’s own API filtering resembles. Understanding SCIM schema and filters therefore transfers directly to working with the broader API.
Common pitfalls
- Assuming all “SCIM” implementations are identical, vendors vary in coverage and quirks.
- Schema mismatches between SailPoint and the target’s SCIM attributes.
- Ignoring SCIM for login, it provisions accounts; authentication still needs federation.
Authoritative sources
- RFC 7644 - SCIM Protocol - The SCIM 2.0 protocol specification
- RFC 7643 - SCIM Core Schema - User, Group and resource schema