SCIM API: Sync Users and Groups from Your IdP - OneCLI

SCIM 2.0 lets your identity provider keep the OneCLI directory in sync. When you add, change, or deactivate someone in Okta, Entra ID, or another provider, the change flows to OneCLI automatically. Your provider authenticates with a SCIM token. You rarely call these endpoints by hand. For setup, see User provisioning.

Endpoints

Endpoint	Method and path	What it does
List users	`GET /Users`	List SCIM users with filtering by userName and paging.
Create a user	`POST /Users`	Create a member through SCIM when your identity provider assigns someone to OneCLI.
Get a user	`GET /Users/{id}`	Get one SCIM user by ID.
Replace a user	`PUT /Users/{id}`	Replace a SCIM user’s full record.
Patch a user	`PATCH /Users/{id}`	Patch a SCIM user with an RFC 7644 PatchOp.
Delete a user	`DELETE /Users/{id}`	Delete a SCIM user with reversible offboarding.
List groups	`GET /Groups`	List SCIM groups with filtering by displayName or externalId and paging, so your identity provider can match its groups to OneCLI.
Create a group	`POST /Groups`	Create a SCIM-sourced directory group when your identity provider pushes a group, ready to map to a role in OneCLI.
Get a group	`GET /Groups/{id}`	Get one SCIM group by ID, including its members, so your identity provider can reconcile group membership with OneCLI.
Replace a group	`PUT /Groups/{id}`	Replace a SCIM group’s name and its full member set in one call.
Patch a group	`PATCH /Groups/{id}`	Patch a SCIM group with an RFC 7644 PatchOp.
Delete a group	`DELETE /Groups/{id}`	Delete a SCIM group when your identity provider removes it.
Service provider configuration	`GET /ServiceProviderConfig`	Discover which SCIM features OneCLI supports, such as patch, filter, and bulk.

Next steps

API overview: base URLs, authentication, and pagination
Errors: status codes and the error format
Editions: which endpoints each edition serves