Outbound SCIM provisioning

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 11, 2026

Outbound SCIM provisioning

The reverse of inbound SCIM: Atlas is the SCIM client, pushing users and organizations to downstream SCIM 2.0 endpoints (a customer's app, a directory). The downstream bearer is write-only; the cursor starts at the current event so only new users forward — use sync_user to backfill.

Endpoints

Method & path	Scope	Notes
`GET /v1/scim_provisioning_targets`	`scim_provisioning:read`	List targets (reports `has_bearer_token`, never the value)
`POST /v1/scim_provisioning_targets`	`scim_provisioning:write`	Create (`base_url` must be https; bearer write-only). idempotent
`GET /v1/scim_provisioning_targets/:id`	`scim_provisioning:read`	Sync status, cursor, last error
`PATCH /v1/scim_provisioning_targets/:id`	`scim_provisioning:write`	Update mapping, deprovision action, status
`DELETE /v1/scim_provisioning_targets/:id`	`scim_provisioning:write`	Delete; pushing stops immediately
`POST /v1/scim_provisioning_targets/:id/test`	`scim_provisioning:write`	Verify connectivity/auth (GET ServiceProviderConfig) with the real bearer
`POST /v1/scim_provisioning_targets/:id/sync_user`	`scim_provisioning:write`	Force one user's sync (first = POST, re-sync = PUT)
`POST /v1/scim_provisioning_targets/:id/sync_group`	`scim_provisioning:write`	Force one org's sync to `/Groups` (only already-provisioned members)

Downstream failures are reported, never thrown — a flaky target never breaks an Atlas operation.

Example

const target = await atlas.scimProvisioning.create({
  name: 'Customer App',
  base_url: 'https://app.customer.com/scim/v2',
  bearer_token: '…', // write-only
} as any);

await atlas.scimProvisioning.test(target.id);      // check connectivity/auth
await atlas.scimProvisioning.syncUser(target.id, 'user_2a'); // backfill one user

Was this page helpful?