Home PageCloudSSOUser GuideExternal Identity IntegrationSCIM synchronizationSCIM 2.0 operations that are supported by CloudSSO
Search for Help Content

SCIM 2.0 operations that are supported by CloudSSO

Updated at: 2024-04-10 08:08
Community

This topic describes System for Cross-domain Identity Management (SCIM) 2.0 operations that are supported by CloudSSO. This topic also describes the scope and limits of SCIM 2.0 operations. If you want to synchronize users or user groups from a self-managed identity provider (IdP) to CloudSSO by using SCIM, you can follow the operations that are described in this topic. If you want to synchronize users or user groups from IdPs that support SCIM, such as Okta and Azure AD, you can skip this topic.

Usage notes

SCIM 2.0 operations are implemented based on RFC 7644. For more information about how to call an SCIM 2.0 operation, see RFC document. For more information about the supported schemas, see the /Schemas section of this topic.

Endpoint and region

Endpoint of SCIM: https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/.

ID of the region in which CloudSSO is deployed: region ID listed in Endpoints.

List of SCIM 2.0 operations

The following table describes the SCIM 2.0 operations. When you call an SCIM 2.0 operation, replace <regionId> with the ID of the region in which your CloudSSO directory resides and replace <your scim credential> with your SCIM credential.

Category

SCIM 2.0 operation

Supported

Description

Category

SCIM 2.0 operation

Supported

Description

Discovery Endpoint

/ServiceProviderConfig

Yes

Obtains the features that are supported by CloudSSO.

/ResourceTypes

Yes

Obtains the resource types that are supported by CloudSSO. The details of users and user groups are returned.

/Schemas

Yes

Obtains the schemas that are supported by CloudSSO. The schemas of users and user groups are returned.

/Users

POST /Users

Yes

Synchronizes users.

GET /Users/{id}

Yes

Queries a user.

GET /Users

Yes

Queries the information about specific users or queries all users.

If you do not specify the filter parameter, all users are queried. A maximum of 100 entries can be returned. Pagination is supported.

PUT /Users/{id}

Yes

Replaces the information about a user.

PATCH /Users/{id}

Yes

Updates the information about a user.

DELETE /Users/{id}

Yes

Deletes a user.

/Groups

POST /Groups

Yes

Synchronizes a user group.

GET /Groups/{id}

Yes

Queries a user group and the user information about the user group.

GET /Groups

Yes

Queries the information about specific user groups or queries all user groups.

If you do not specify the filter parameter, all user groups are queried. The user information about the user groups is not returned. A maximum of 100 entries can be returned. Pagination is supported.

PUT /Groups/{id}

Yes

Replaces the information about a user group.

PATCH /Groups/{id}

Yes

Updates the information about a user group.

DELETE /Groups/{id}

Yes

Deletes a user group.

/Me

N/A

No

N/A

/Bulk

N/A

No

N/A

/.Search

N/A

No

N/A

Discovery Endpoint

/ServiceProviderConfig

Description

Obtains the features that are supported by CloudSSO.

Limits

No authentication is required.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/ServiceProviderConfig -H "Content-type:application/json"

Sample response

{
  "authenticationSchemes": [
    {
      "description": "Authentication scheme using the OAuth Bearer Token Standard",
      "name": "OAuth Bearer Token",
      "primary": true,
      "type": "oauthbearertoken"
    }
  ],
  "bulk": {
    "maxOperations": 0,
    "maxPayloadSize": 0,
    "supported": false
  },
  "changePassword": {
    "supported": false
  },
  "etag": {
    "supported": false
  },
  "filter": {
    "maxResults": 1000,
    "supported": false
  },
  "patch": {
    "supported": true
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
  ],
  "sort": {
    "supported": false
  }
}

The response shows the following information:

  • The following feature is supported: patch.

  • The following features are not supported: bulk, changePassword, sort, etag, and filter.

/ResourceTypes

Description

Obtains the resource types that are supported by CloudSSO. The details of users and user groups are returned.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/ResourceTypes --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json"

Sample response

{
  "Resources": [
    {
      "description": "Group",
      "endpoint": "/Groups",
      "id": "Group",
      "meta": {
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/ResourceTypes/Group",
        "resourceType": "ResourceType"
      },
      "name": "Group",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:Group",
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
      ]
    },
    {
      "description": "User Account",
      "endpoint": "/Users",
      "id": "User",
      "meta": {
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/ResourceTypes/User",
        "resourceType": "ResourceType"
      },
      "name": "User",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
      "schemaExtensions": [
        {
          "required": false,
          "schema": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
        }
      ],
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
      ]
    }
  ],
  "itemsPerPage": 10,
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "startIndex": 1,
  "totalResults": 2
}

/Schemas

Description

Obtains the schemas that are supported by CloudSSO. The schemas of users and user groups are returned.

Limits

  • Query by resource type is supported.

  • Field names and values that are prescribed in SCIM 2.0 are not case-sensitive.

  • Only the fields described in the following sample response are supported.

Sample request

The schema to request all resources.
    curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json"
The schema to request users.
    curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json"
The schema to request user groups.
    curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json"

Sample response

Schema to request users

{
  "attributes": [
    {
      "caseExact": true,
      "description": "A Boolean value indicating the User's administrative status.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "active",
      "required": false,
      "returned": "default",
      "type": "boolean",
      "uniqueness": "none"
    },
    {
      "caseExact": false,
      "description": "The name of the User, suitable for display to end-users. The name SHOULD be the full name of the User being described if known.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "displayName",
      "required": false,
      "returned": "default",
      "type": "string",
      "uniqueness": "none"
    },
    {
      "caseExact": true,
      "description": "E-mail addresses for the user. The value SHOULD be canonicalized by the Service Provider, e.g., bjensen@example.com instead of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and other.",
      "multiValued": true,
      "mutability": "readWrite",
      "name": "emails",
      "required": false,
      "returned": "default",
      "subAttributes": [
        {
          "caseExact": false,
          "description": "A human readable name, primarily used for display purposes.",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "display",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": true,
          "description": "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g., the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "primary",
          "required": false,
          "returned": "default",
          "type": "boolean",
          "uniqueness": "none"
        },
        {
          "canonicalValues": [
            "other",
            "work",
            "home"
          ],
          "caseExact": false,
          "description": "A label indicating the attribute's function; e.g., 'work' or 'home'.",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "type",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": false,
          "description": "E-mail addresses for the user. The value\nSHOULD be canonicalized by the Service Provider, e.g.\nbjensen@example.com instead of bjensen@EXAMPLE.COM. Canonical Type\nvalues of work, home, and other.",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "value",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        }
      ],
      "type": "complex",
      "uniqueness": "none"
    },
    {
      "caseExact": true,
      "description": "The components of the user's real name.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "name",
      "required": false,
      "returned": "default",
      "subAttributes": [
        {
          "caseExact": false,
          "description": "The family name of the User, or Last Name in most Western languages (for example, Jensen given the full name Ms. Barbara J Jensen, III.).",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "familyName",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": false,
          "description": "The given name of the User, or First Name in most Western languages (for example, Barbara given the full name Ms. Barbara J Jensen, III.).",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "givenName",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": false,
          "description": "The middle name(s) of the User (for example, Robert given the full name Ms. Barbara J Jensen, III.).",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "middleName",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        }
      ],
      "type": "complex",
      "uniqueness": "none"
    },
    {
      "caseExact": false,
      "description": "Unique identifier for the User typically used by the user to directly authenticate to the service provider.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "userName",
      "required": true,
      "returned": "default",
      "type": "string",
      "uniqueness": "server"
    }
  ],
  "description": "User Account",
  "endpoint": "/Users",
  "extensionSchemas": [
    {
      "required": false,
      "schema": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
    }
  ],
  "id": "urn:ietf:params:scim:schemas:core:2.0:User",
  "meta": {
    "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User",
    "resourceType": "Schema"
  },
  "name": "User",
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Schema"
  ]
}

Schema to request user groups

{
  "attributes": [
    {
      "caseExact": false,
      "description": "A human-readable name for the Group.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "displayName",
      "required": true,
      "returned": "default",
      "type": "string",
      "uniqueness": "server"
    },
    {
      "caseExact": true,
      "description": "A list of members of the Group.",
      "multiValued": true,
      "mutability": "readWrite",
      "name": "members",
      "required": false,
      "returned": "default",
      "subAttributes": [
        {
          "caseExact": false,
          "description": "A human readable name, primarily used for display purposes.",
          "multiValued": false,
          "mutability": "immutable",
          "name": "display",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": true,
          "description": "The URI of the member resource.",
          "multiValued": false,
          "mutability": "immutable",
          "name": "ref",
          "referenceTypes": [
            "User"
          ],
          "required": true,
          "returned": "default",
          "type": "reference",
          "uniqueness": "none"
        },
        {
          "caseExact": false,
          "description": "The identifier of a group member.",
          "multiValued": false,
          "mutability": "immutable",
          "name": "value",
          "required": true,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        }
      ],
      "type": "complex",
      "uniqueness": "none"
    }
  ],
  "description": "Group",
  "endpoint": "/Groups",
  "id": "urn:ietf:params:scim:schemas:core:2.0:Group",
  "meta": {
    "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group",
    "resourceType": "Schema"
  },
  "name": "Group",
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Schema"
  ]
}

/Users

POST /Users

Description

Synchronizes users.

Limits

  • You can use only the fields that are defined in the "/Schemas" section of this topic.

  • If a manually created user with the same username as a user in your IdP exists in CloudSSO, the user in CloudSSO is replaced by the user that is synchronized by using SCIM.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X POST -d '<data>'

The following sample code provides an example of the data field:

{
    "displayName": "<user display name>",
    "emails": [
        {
            "primary": true,
            "type": "work",
            "value": "<user email>"
        }
    ],
    "externalId": "<external Id>",
    "name": {
        "familyName": "<user family name>",
        "givenName": "<user given name>"
    },
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
    "userName": "<user name>"
}

Sample response

{
    "active": true,
    "displayName": "<user display name>",
    "emails":
    [
        {
            "primary": true,
            "type": "work",
            "value": "<user email>"
        }
    ],
    "externalId": "<external Id>",
    "id": "u-00vrs1l19d6gbsi5****",
    "meta":
    {
        "created": "2023-08-01T13:16:30.000Z",
        "lastModified": "2023-08-01T13:16:30.000Z",
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/u-00vrs1l19d6gbsi5****",
        "resourceType": "User"
    },
    "name":
    {
        "familyName": "<user family name>",
        "givenName": "<user given name>"
    },
    "schemas":
    [
        "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
    "userName": "<user name>"
}

GET /Users/{id} and GET /Users

Description

  • GET /Users/{id}: queries a user.

  • GET /Users: queries the information about specific users or queries all users.

Limits

  • If you specify the id parameter in the request, the user with the specified ID is returned. If the value of the id parameter is not the ID of an existing user, the request is rejected.

  • If you do not specify the id parameter and you specify the filter parameter, the user that meets the conditions in the filter parameter is returned. The filter parameter supports only the externalId and userName fields, and the eq and and operators.

  • If you do not specify the id or filter parameter, all users are queried. The standard pagination method of SCIM 2.0 is supported. A maximum of 100 entries can be returned per page. If the number of entries exceeds 100, only 100 entries are returned.

  • You can query only synchronized users.

Example 1: Query a user

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X GET

Sample response

{
    "active": true,
    "displayName": "<user display name>",
    "emails":
    [
        {
            "primary": true,
            "type": "work",
            "value": "<user email>"
        }
    ],
    "externalId": "<external Id>",
    "id": "u-00vrs1l19d6gbsi5****",
    "meta":
    {
        "created": "2023-08-01T13:16:30.000Z",
        "lastModified": "2023-08-01T13:16:30.000Z",
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/u-00vrs1l19d6gbsi5****",
        "resourceType": "User"
    },
    "name":
    {
        "familyName": "<user family name>",
        "givenName": "<user given name>"
    },
    "schemas":
    [
        "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
    "userName": "<user name>"
}

Example 2: Query the information about specific users or query all users

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users<?parameters> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X GET

The following table describes the supported parameters.

Parameter

Description

Example

Parameter

Description

Example

filter

Only the eq expressions of userName, externalId, and id are supported.

  • filter=userName+eq+%22demoUserName%22

  • filter=externalId+eq+%22demoExternalId%22

  • filter=id+eq+%22demoId%22

startIndex

The page number. This parameter is optional. Default value: 1.

startIndex=1

count

The number of users per page. This parameter is optional. Default value: 10.

count=10

Sample response

{
    "Resources":
    [
        {
            "active": true,
            "displayName": "<user display name>",
            "emails":
            [
                {
                    "primary": true,
                    "type": "work",
                    "value": "<user email>"
                }
            ],
            "externalId": "external****",
            "id": "u-0015b4962vrywtzb****",
            "meta":
            {
                "created": "2023-07-07T17:21:07.000Z",
                "lastModified": "2023-07-07T17:21:07.000Z",
                "resourceType": "User"
            },
            "name":
            {
                "familyName": "<user family name>",
                "givenName": "<user given name>"
            },
            "schemas":
            [
                "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName": "<user name>"
        },
        {
            "active": true,
            "displayName": "<user display name>",
            "emails":
            [
                {
                    "primary": true,
                    "type": "work",
                    "value": "<user email>"
                }
            ],
            "externalId": "<external Id>",
            "id": "u-00vrs1l19d6gbsi5****",
            "meta":
            {
                "created": "2023-08-01T13:16:30.000Z",
                "lastModified": "2023-08-01T13:16:30.000Z",
                "resourceType": "User"
            },
            "name":
            {
                "familyName": "<user family name>",
                "givenName": "<user given name>"
            },
            "schemas":
            [
                "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName": "<user name>"
        }
    ],
    "itemsPerPage": 10,
    "schemas":
    [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "startIndex": 1,
    "totalResults": 2
}

PUT /Users/{id} and PATCH /Users/{id}

Description

  • PUT /Users/{id}: replaces the information about a user.

  • PATCH /Users/{id}: updates the information about a user.

Limits

  • The id parameter is required. You can modify only the fields that are defined in the "/Schemas" section of this topic.

  • A PUT request is used to overwrite the original attributes.

  • A PATCH request is used for Add, Replace, and Remove operations.

  • You can modify only the information about synchronized users.

Sample request

Replace the information about a user (PUT)

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X PUT -d '<data>'

The following sample code provides an example of the data field:

{
    "active": false,
    "externalId": "<external Id>",
    "id": "<user id>",
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
    "userName": "<user name>"
}

Update the information about a user (PATCH)

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X PATCH -d '<data>'

The following sample code provides an example of the data field:

// The Remove operation.
{
    "Operations": [
        {
            "op": "remove",
            "path": "displayName"
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}
// The Replace operation.
{
    "Operations": [
        {
            "op": "replace",
            "path": "",
            "value": {
                "active": false,
                "displayName": "displayName",
                "name": {
                    "familyName": "familyName",
                    "givenName": "givenName"
                }
            }
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}
// The Add operation.
{
    "Operations": [
        {
            "op": "add",
            "path": "",
            "value": {
                "displayName": "displayName",
                "name": {
                    "familyName": "familyName",
                    "givenName": "givenName"
                }
            }
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}

DELETE /Users/{id}

Description

Deletes a user.

Limits

  • The id parameter is required.

  • You can delete only synchronized users.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X DELETE

/Group

POST /Groups

Description

Synchronizes a user group.

Limits

  • For more information about the limits on fields, see the "/Schemas" section of this topic.

  • If a manually created user group with the same name as a user group in your IdP exists in CloudSSO, the user group in CloudSSO is replaced by the user group that is synchronized by using SCIM.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X POST -d '<data>'

The following sample code provides an example of the data field:

{
    "displayName": "<group name>",
    "externalId": "<external Id>",
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}

Sample response

{
    "displayName": "<group name>",
    "externalId": "<external Id>",
    "id": "g-00nqnd7hoevd1unv****",
    "members":
    [],
    "meta":
    {
        "created": "2023-08-01T13:30:23.000Z",
        "lastModified": "2023-08-01T13:30:23.000Z",
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/g-00nqnd7hoevd1unv****",
        "resourceType": "Group"
    },
    "schemas":
    [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}

GET /Groups/{id} and GET /Groups

Description

  • GET /Groups/{id}: queries a user group.

  • GET /Groups: queries the information about specific user groups or queries all user groups.

Limits

  • You can specify the id or filter parameter for query.

  • The filter parameter supports only the externalId and displayName fields, and the eq and and operators.

  • If you specify the id parameter in the request, the user group with the specified ID is returned. The users in the user group are also returned. If the value of the id parameter is not the ID of an existing user group, the request is rejected.

  • If you do not specify the id or filter parameter, all user groups are returned. The users in the user groups are not returned. The standard pagination method of SCIM 2.0 is supported. A maximum of 100 entries can be returned. If the number of entries exceeds 100 (count > 100), only 100 entries are returned.

  • You can query only synchronized user groups.

Example 1: Query a user group

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/<groupId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X GET

Sample response

{
    "displayName": "<group name>",
    "externalId": "<external Id>",
    "id": "g-00nqnd7hoevd1unv****",
    "members":
    [
        {
            "$ref": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/u-00vrs1l19d6gbsi5****",
            "display": "",
            "value": "u-00vrs1l19d6gbsi5****"
        }
    ],
    "meta":
    {
        "created": "2023-08-01T13:30:23.000Z",
        "lastModified": "2023-08-01T13:30:23.000Z",
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/g-00nqnd7hoevd1unv****",
        "resourceType": "Group"
    },
    "schemas":
    [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}

Example 2: Query the information about specific user groups or query all user groups

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups<?parameters> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X GET

The following table describes the supported parameters.

Parameter

Description

Example

Parameter

Description

Example

filter

Only the eq expressions of displayName, externalId, and id are supported.

  • filter=displayName+eq+%22demoDisplayName%22

  • filter=externalId+eq+%22demoExternalId%22

  • filter=id+eq+%22demoId%22

startIndex

The page number. This parameter is optional. Default value: 1.

startIndex=1

count

The number of user groups per page. This parameter is optional. Default value: 10.

count=10

Sample response

{
    "Resources":
    [
        {
            "displayName": "<group name>",
            "externalId": "<external Id>",
            "id": "g-00nqnd7hoevd1unv****",
            "members":
            [],
            "meta":
            {
                "created": "2023-08-01T13:30:23.000Z",
                "lastModified": "2023-08-01T13:30:23.000Z",
                "resourceType": "Group"
            },
            "schemas":
            [
                "urn:ietf:params:scim:schemas:core:2.0:Group"
            ]
        }
    ],
    "itemsPerPage": 10,
    "schemas":
    [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "startIndex": 1,
    "totalResults": 1
}

PUT /Groups/{id} and PATCH /Groups/{id}

Description

  • PUT /Groups/{id}: replaces the information about a user group.

  • PATCH /Groups/{id}: updates the information about a user group.

Limits

  • The id parameter is required. You can modify only the fields that are defined in the "/Schemas" section of this topic.

  • A PUT request is used to overwrite the original attributes. The users in the user groups can be replaced.

  • A PATCH request is used for Add, Replace, and Remove operations.

  • You can modify only the information about the synchronized user groups.

Sample request

Replace the information about a user group (PUT)

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/<groupId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X PUT -d '<data>'

The following sample code provides an example of the data field:

{
    "displayName": "<group name>",
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}

Update the information about a user group (PATCH)

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/<groupId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X PATCH -d '<data>'

The following sample code provides an example of the data field:

// Remove the specified user <userId> from the user group <groupId>.
{
    "Operations": [
        {
            "op": "remove",
            "path": "members",
            "value": [
                {
                    "value": "<userId>"
                }
            ]
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}
// Remove all users from the user group <groupId>.
{
    "Operations": [
        {
            "op": "remove",
            "path": "members"
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}
// Add three users to the user group <groupId>.
{
    "Operations": [
        {
            "op": "add",
            "path": "members",
            "value": [
                {
                    "$ref": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId1>",
                    "display": "<userName1>",
                    "value": "<userId1>"
                },
                {
                    "$ref": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId2>",
                    "display": "<userName2>",
                    "value": "<userId2>"
                },
                {
                    "$ref": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId3>",
                    "display": "<userName3>",
                    "value": "<userId3>"
                }
            ]
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}

DELETE /Groups/{id}

Description

Deletes a user group.

Limits

  • The id parameter is required.

  • If a user is added to the user group, the user is removed from the user group when you delete the user group.

  • You can delete only synchronized user groups.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/<groupId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X DELETE
Previous: Synchronize accounts to CloudSSO by using SCIM in IDaaSNext: SSO logon
  • On this page （1, O）
  • Usage notes
  • Endpoint and region
  • List of SCIM 2.0 operations
  • Discovery Endpoint
  • /ServiceProviderConfig
  • /ResourceTypes
  • /Schemas
  • /Users
  • POST /Users
  • GET /Users/{id} and GET /Users
  • PUT /Users/{id} and PATCH /Users/{id}
  • DELETE /Users/{id}
  • /Group
  • POST /Groups
  • GET /Groups/{id} and GET /Groups
  • PUT /Groups/{id} and PATCH /Groups/{id}
  • DELETE /Groups/{id}
Feedback
phone Contact Us

Chat now with Alibaba Cloud Customer Service to assist you in finding the right products and services to meet your needs.

alicare alicarealicarealicare