SCIM
The standard that lets company IT automatically add, update, group, and disable users in your app from its directory.
What it is
SCIM is the standard API a company directory uses to create, update, disable, and group users in another app. Okta or Microsoft Entra ID calls your `/Users` and `/Groups` endpoints, speaking a predictable JSON format defined by RFC 7643 and RFC 7644. The important user fields are `id`, `externalId`, `userName`, and `active`.
Reach for it after enterprise SSO. SSO controls who may log in; SCIM makes sure the right account already exists and turns it off when the employee leaves. That closes the awkward gap where a fired employee still has a valid app account because nobody remembered to remove it.
The gotcha is that directory sync is not ordinary CRUD. PATCH may carry several operations, filters and pagination follow SCIM syntax, retries must not create duplicates, and deprovisioning normally means setting `active` to false rather than deleting history. Give each resource an immutable `id`, store `externalId` when the directory sends one, keep `userName` unique within that customer, and return SCIM error bodies instead of generic HTML errors.
Ask AI for it
Build an RFC 7644 SCIM 2.0 server for enterprise provisioning. Expose `/scim/v2/Users` and `/scim/v2/Groups`, authenticate each tenant with a revocable bearer token, and return resources with the RFC 7643 core schema URNs. Implement GET by ID, filtered list, POST, PUT, PATCH, and DELETE, including `startIndex`, `count`, `totalResults`, and SCIM ListResponse envelopes. Return a server-generated immutable `id`, store `externalId` when supplied so directory retries can be correlated, enforce tenant-scoped uniqueness for `userName`, implement PATCH Operations in order, and deprovision by setting `active: false` while revoking that user's sessions. Return `application/scim+json` and RFC 7644 error objects with the correct HTTP status.