SCIM directory (inbound)

Atlas is a SCIM 2.0 Service Provider: an enterprise customer's IdP (Okta, Entra ID, etc.) provisions and deprovisions users and groups into one organization's directory. Authentication is a per-organization SCIM bearer token.

Mint a SCIM token (BAPI)

const t = await atlas.scimTokens.create({ organization_id: 'org_9f', name: 'Okta' });
console.log(t.secret); // shown once — paste into the IdP's SCIM config

SCIM 2.0 endpoints

Called by the IdP with Authorization: Bearer <scim token>:

GET    /scim/v2/Users            → list (filter by userName eq; index-paginated)
POST   /scim/v2/Users            → provision a user + seat them in the token's org directory
GET    /scim/v2/Users/:id        → fetch (non-members are 404)
PUT    /scim/v2/Users/:id        → replace (including the active/deprovision state)
PATCH  /scim/v2/Users/:id        → PatchOp; active:false deprovisions and revokes every session
DELETE /scim/v2/Users/:id        → deprovision: revoke sessions + remove the directory membership

GET    /scim/v2/Groups           → list (filter by displayName eq; index-paginated)
POST   /scim/v2/Groups           → create a group with an optional initial member set
GET    /scim/v2/Groups/:id       → fetch with member references
PUT    /scim/v2/Groups/:id       → replace displayName + full membership
PATCH  /scim/v2/Groups/:id       → add/remove members or rename
DELETE /scim/v2/Groups/:id       → delete (membership rows cascade)

Discovery

GET /scim/v2/ServiceProviderConfig   → supported features + auth scheme
GET /scim/v2/ResourceTypes           → User and Group resource types
GET /scim/v2/Schemas                 → core User and Group schemas

Groups drive roles

A SCIM group can be granted an org role (see Organizations → group role grants), so your customer's directory groups map onto Atlas roles automatically.

Outbound provisioning

To push users from Atlas to a downstream SCIM endpoint (the reverse direction), see Outbound SCIM provisioning.