GET /v1/scim_provisioning_targets

scim_provisioning:read

List outbound SCIM provisioning targets (downstream SCIM 2.0 endpoints Atlas pushes users to). The downstream bearer is never returned, only has_bearer_token.

POST /v1/scim_provisioning_targets

scim_provisioning:write

✓

Create an outbound SCIM provisioning target. base_url must be https; the downstream bearer_token is write-only; the cursor starts at the current event so only new users forward (use sync_user to backfill).

GET /v1/scim_provisioning_targets/:id

scim_provisioning:read

Read one outbound SCIM provisioning target, including its sync status, cursor and last error. Reports has_bearer_token only, never the bearer value.

PATCH /v1/scim_provisioning_targets/:id

scim_provisioning:write

Update a target's name, base_url (https), attribute_mapping, deprovision_action, enabled flag, or status (active/paused). A bearer_token left out is preserved.

DELETE /v1/scim_provisioning_targets/:id

scim_provisioning:write

Delete an outbound SCIM provisioning target. Pushing stops immediately; no further users are sent downstream.

POST /v1/scim_provisioning_targets/:id/test

scim_provisioning:write

Verify connectivity and auth to the downstream (GET ServiceProviderConfig) with the target's real bearer, and return the result. Writes no data.

POST /v1/scim_provisioning_targets/:id/sync_user

scim_provisioning:write

Force a single user's outbound sync now (backfill / re-push). A first sync POSTs and stores the remote id; a re-sync PUTs the same id. A downstream failure is reported, never thrown.

POST /v1/scim_provisioning_targets/:id/sync_group

scim_provisioning:write

Force a single group's (organization's) outbound sync now to the downstream /Groups. Members are the org's memberships, but only users already provisioned to this target (unprovisioned members are skipped). A first sync POSTs and stores the remote id; a re-sync PUTs the same id. A downstream failure is reported, never thrown.