SCIM provisioning
What SCIM does here
Citadel implements SCIM 2.0 (RFC 7643/7644) for automated user and group provisioning. When your identity provider (IdP) adds, updates, or removes a user or group, the SCIM endpoint keeps Citadel in sync — no manual account management required.
Connecting your IdP
SCIM provisioning is scoped per org. Configure your IdP with:
- Base URL. Your org's SCIM endpoint at /scim/v2/ under your Citadel host.
- Bearer token. A SCIM-scoped agent token from Settings → Access → New token.
All SCIM requests are authenticated; unauthenticated requests are rejected with 401.
User provisioning
The /scim/v2/Users endpoint supports:
- List / filter. GET with optional filter=userName eq "...", paginated via startIndex and count (max 200 per page).
- Create. POST with userName (required), externalId, name attributes, and active flag.
- Read. GET by ID.
- Replace. PUT replaces all attributes in a single call.
- Update. PATCH applies targeted attribute changes (RFC 7644 § 3.5.2).
- Deprovision. DELETE marks the user inactive (active=false) rather than hard-deleting — the SCIM user record is retained for audit continuity.
Group provisioning
The /scim/v2/Groups endpoint supports list, create, read, replace, patch, and delete. Group membership is managed via the members array (user IDs). Replace and PATCH operations sync membership atomically: the full member set is replaced on PUT; targeted member additions/removals are applied on PATCH.
Group membership is scoped to the org's namespace. References to users outside the org are silently ignored.
Audit events
Every SCIM write operation (user created, updated, deleted; group created, updated, deleted) emits an audit log entry scoped to the org, readable from the audit log.