Provision employees with SCIM 2.0.

Overview

SCIM uses the standard User resource and application/scim+json media type. The base URL is:

https://api.crewqi.com/v1/organizations/{organizationId}/scim/v2

Supported endpoints are ServiceProviderConfig, ResourceTypes, Schemas, and Users. Groups and role provisioning are not advertised.

A SCIM key needs scim:read for discovery, list, and read operations, and scim:write for provisioning, updates, and deactivation.

Create an employee

externalId is unique per organization. Reusing the same Idempotency-Key returns the original create result, which makes directory retries safe.

curl --fail-with-body --request POST \
  --header 'Authorization: Bearer cqi_test_<key-id>.<secret>' \
  --header 'Content-Type: application/scim+json' \
  --header 'Accept: application/scim+json' \
  --header 'Idempotency-Key: hr-1042-v1' \
  --data '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "externalId": "hr-1042",
    "userName": "sam.taylor@example.com",
    "displayName": "Sam Taylor",
    "active": true,
    "emails": [{"value": "sam.taylor@example.com", "primary": true, "type": "work"}]
  }' \
  'https://api-test.crewqi.com/v1/organizations/ORG_UUID/scim/v2/Users'

Manage the user lifecycle

• Use active: false to deactivate organization access.
• DELETE also deactivates access; it does not globally delete an Auth user who may belong to another organization.
• Use the returned weak ETag in If-Match for updates.
• Unsupported roles values are rejected so a directory cannot create an organization admin.

Start with discovery

Have the directory read ServiceProviderConfig, ResourceTypes, and Schemas before provisioning. This lets a standard SCIM client discover the supported behavior and media types.

For exact request and response schemas, open the versioned API reference and filter for the SCIM operations.