SCIM 2.0 Provisioning

Cognethics supports SCIM 2.0 (RFC 7644) user and group provisioning. Your identity provider (Okta, Azure AD, OneLogin, etc.) can automatically create, update, and delete users in Cognethics via the SCIM v2 API. Groups can be automatically assigned to roles or organizations within Cognethics.

Quick Reference

Endpoints

Service Provider Configuration

Get SCIM capability advertisement:

GET /scim/v2/ServiceProviderConfig

Response includes:

• Supported filter operators (eq, co, sw)
• Supported sort operations
• PATCH, BULK, FILTER, SORT support flags
• Change password support
• ETag support

Resource Types

Get list of resource types (User, Group):

GET /scim/v2/ResourceTypes

Schemas

Get User and Group schema definitions:

GET /scim/v2/Schemas

User Management

List Users

GET /scim/v2/Users?filter=...&sortBy=userName&sortOrder=ascending&startIndex=1&count=100

Supported filters:

• filter=userName eq "[email protected]"
• filter=emails co "@acme.com"
• filter=active eq true

Response includes paginated list of users with full attributes.

Get Single User

GET /scim/v2/Users/{id}

Create User

POST /scim/v2/Users
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "[email protected]",
  "name": {
    "familyName": "Smith",
    "givenName": "Jane"
  },
  "emails": [
    {
      "value": "[email protected]",
      "type": "work",
      "primary": true
    }
  ],
  "active": true
}

Update User

PUT /scim/v2/Users/{id}
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "[email protected]",
  "name": {
    "familyName": "Smith",
    "givenName": "Jane"
  },
  "active": true
}

Partial Update (PATCH)

PATCH /scim/v2/Users/{id}
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:patch:2.0:PatchOp"],
  "Operations": [
    {
      "op": "replace",
      "path": "name.givenName",
      "value": "Janet"
    },
    {
      "op": "add",
      "path": "emails",
      "value": [
        {
          "value": "[email protected]",
          "type": "work"
        }
      ]
    }
  ]
}

Delete User

DELETE /scim/v2/Users/{id}

Group Management

List Groups

GET /scim/v2/Groups?filter=...

Create Group

POST /scim/v2/Groups
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "displayName": "Engineering Team",
  "members": [
    {
      "value": "{user-id}",
      "display": "[email protected]"
    }
  ]
}

Update Group

PUT /scim/v2/Groups/{id}

Delete Group

DELETE /scim/v2/Groups/{id}

Bulk Operations

POST /scim/v2/Bulk
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:BulkRequest"],
  "Operations": [
    {
      "method": "POST",
      "path": "/Users",
      "bulkId": "user1",
      "data": { }
    },
    {
      "method": "PUT",
      "path": "/Groups/group1",
      "bulkId": "group1",
      "data": { }
    }
  ]
}

Attribute Mapping

Configure which IdP user/group attributes map to Cognethics fields:

Groups:

Bearer Token Authentication

SCIM v2 endpoints are protected by bearer token authentication:

curl -H "Authorization: Bearer {token}" \
  https://{tenant}.cognethics.com/scim/v2/Users

Your bearer token is generated once and shown plaintext. Save it securely — it cannot be retrieved again. If lost, Cognethics can generate a new token (the old token is invalidated).

Never commit tokens to version control or share them publicly.

Filtering & Sorting

Supported SCIM filter operators:

Sorting:

?sortBy=userName&sortOrder=ascending

Pagination:

?startIndex=1&count=100

Error Responses

SCIM errors are returned in standard SCIM format:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": 400,
  "scimType": "invalidValue",
  "detail": "Duplicate user: [email protected] already exists"
}

Error types:

• invalidSyntax — malformed SCIM request
• invalidFilter — invalid filter expression
• noTarget — resource not found
• mutability — attempt to modify read-only field
• tooMany — too many matches for filter
• uniqueness — duplicate value (email, userName, etc.)
• badValue — invalid attribute value

Audit Logging

All provisioning operations are logged:

Access logs from the Cognethics platform admin console.

Group-to-Role Mapping

Groups provisioned via SCIM can be automatically mapped to Cognethics roles or organizations:

Custom mappings are configured per tenant from Admin → Enterprise SSO → SCIM Attribute Mapping in the Cognethics console.

Configuration

A tenant administrator configures SCIM directly from the Cognethics console at Admin → Enterprise SSO → SCIM Provisioning:

1. Mint a bearer token. Cognethics shows the plaintext token exactly once — copy it immediately into a secrets manager. The token is hashed at rest and cannot be retrieved later; if lost, rotate to mint a new one.
2. Enable SCIM. This unlocks the SCIM v2 endpoint at https://{tenant}.cognethics.com/scim/v2/ for your IdP to call.
3. Configure attribute mapping (optional) — the defaults follow SCIM Core Schema (RFC 7643); add overrides at Admin → Enterprise SSO → SCIM Attribute Mapping.
4. Configure your IdP with the SCIM base URL and the bearer token (see the IdP-specific recipes below).
5. Monitor provisioning activity at Admin → Enterprise SSO → SCIM Activity Log.

Common IdP Configurations

Okta SCIM 2.0

1. In Okta Admin: Applications → Create App Integration → SAML + SCIM
2. On the Provisioning tab:
   • SCIM base URL: https://{tenant}.cognethics.com/scim/v2/
   • OAuth Token: paste the bearer token minted in the Cognethics console
3. Enable:
   • Create users
   • Update user attributes
   • Deactivate users
   • Sync groups
4. Attribute mappings: Email, First name, Last name, (any custom attributes)
5. Okta begins provisioning users and groups to Cognethics

Azure AD / Microsoft Entra SCIM

1. In Azure AD: Enterprise applications → Provisioning
2. Set Provisioning Mode to Automatic
3. Configure:
   • Tenant URL: https://{tenant}.cognethics.com/scim/v2/
   • Secret Token: paste the bearer token minted in the Cognethics console
4. Attribute mappings: Mail (email), givenName, surname
5. Azure AD begins provisioning

OneLogin SCIM 2.0

1. In OneLogin Admin: Applications → SCIM (or Provisioning tab)
2. Configure:
   • SCIM endpoint: https://{tenant}.cognethics.com/scim/v2/
   • Bearer token: paste the bearer token minted in the Cognethics console
3. Enable user provisioning rules
4. OneLogin begins syncing users

Performance & Rate Limiting

• Bulk operations: Up to 100 operations per request
• Rate limiting: 1,000 requests/hour per tenant
• Pagination: Default 100 users/groups per page; max 500
• Incremental sync: Cognethics tracks sync state per IdP for efficient delta syncs

Compliance & Standards

• RFC 7644 compliance — Full SCIM 2.0 standard implementation
• Bearer token auth — OAuth 2.0 bearer tokens per RFC 6750
• Encryption in transit — TLS 1.2+
• Audit logging — All operations logged for compliance/audit

Troubleshooting

"Unauthorized" or "Invalid token":

• Verify the bearer token in your IdP matches the value you minted in the Cognethics console
• If the token may have been rotated, mint a new one in Admin → Enterprise SSO → SCIM Provisioning and update your IdP

"Duplicate user" error:

• Check if user already exists in Cognethics under different email/userName
• Verify attribute mapping — is userName unique?

Users created but not assigned to roles:

• Verify group→role mapping is configured in Cognethics
• Ensure IdP is provisioning groups (not just users)

Changes not syncing to Cognethics:

• Check that the SCIM endpoint is reachable from IdP
• Verify bearer token is correct
• Check Cognethics audit logs for sync errors

Support

For SCIM provisioning help, see the in-product help linked from Admin → Enterprise SSO, or reach our support team through the form below. Useful information to include in any request:

• IdP type (Okta, Azure AD, etc.)
• Desired attribute mappings
• Group→role mapping requirements
• Any integration or compliance requirements

Back to Enterprise Authentication · See also SAML 2.0 Single Sign-On