# User provisioning API reference

> Canonical HTML: https://screenrig.ai/docs/api/scim
> Source SHA-256: e0c997a2ab813502f0d99a41d2ed1d3d6b26dbaf1a3d7e514c1cce0278ff8422

User provisioning: SCIM 2.0, tokens and group bindings. This group has 24 operations, each with its authentication, parameters, request body fields, request template and responses. The [API overview](https://screenrig.ai/docs/api.md) covers services, authentication, requests and retries, problem codes and versioning.

Replace uppercase placeholders. Save a schema-valid JSON body in request.json when required. Cookie examples use a local cookie jar from an authenticated session.

## User provisioning: SCIM 2.0, tokens and group bindings

### GET /api/organizations/{org_id}/scim

**Dashboard Organizations Get SCIM**

A designated admin reads the organization's SCIM provisioning settings: whether it is enabled, the base URL to enter at the identity provider (on the API origin), the live provisioning tokens without their secrets, and the counts of provisioned users and groups. People only; agents and bearer credentials have no route.


Operation: dashboardOrganizationsGetSCIM.

- Authentication: dashboardSession
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| org_id | path | required |  |

#### Request template

~~~sh
curl --request GET --cookie cookies.txt --cookie-jar cookies.txt 'https://screenrig.ai/api/organizations/ORG_ID/scim'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The organization's SCIM settings. | SCIMSettings (application/json); headers: Cache-Control |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 403 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### PUT /api/organizations/{org_id}/scim

**Dashboard Organizations Set SCIM**

A designated admin enables or disables SCIM provisioning after fresh proof: a passkey or password proof bound to a reauthentication of kind scim_change with the organization id as subject_id, or {type: sso} from a session that signed in through single sign-on at most 10 minutes ago.

Disabling changes nobody's access: the people and groups already provisioned keep their grants, and the /scim/v2 routes answer 403 until SCIM is enabled again. Returns the settings.

People only; agents and bearer credentials have no route. enabled true is SCIM provisioning, which the Enterprise plan includes; an organization whose plan lacks it is refused with feature_not_in_plan (402). enabled false is always accepted, and the /scim/v2 endpoints of an organization that has SCIM on keep answering.


Operation: dashboardOrganizationsSetSCIM.

- Authentication: dashboardSession
- Request body: SCIMSettingsWrite

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| org_id | path | required |  |

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| enabled | required | boolean |  |
| proof | required | DashboardProof |  |

#### Request template

~~~sh
curl --request PUT --cookie cookies.txt --cookie-jar cookies.txt --header 'Content-Type: application/json' --data '@request.json' 'https://screenrig.ai/api/organizations/ORG_ID/scim'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The organization's SCIM settings. | SCIMSettings (application/json); headers: Cache-Control |
| 400 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 402 | feature_not_in_plan — SCIM provisioning is part of the Enterprise plan; the problem names the feature, the plan the account is on and required_plan. | Problem (application/problem+json) |
| 403 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### POST /api/organizations/{org_id}/scim/tokens

**Dashboard Organizations Create SCIMToken**

A designated admin mints a provisioning token after fresh proof (as for PUT .../scim). The token, srscim_ plus 43 base64url characters, is returned once, here only; the server keeps a SHA-256 digest and a prefix to recognise it by. An organization holds at most 5 live tokens, otherwise resource_conflict.

People only; agents and bearer credentials have no route. Issuing a token is SCIM provisioning, which the Enterprise plan includes; an organization whose plan lacks it is refused with feature_not_in_plan (402). Tokens already issued keep working and can be revoked.


Operation: dashboardOrganizationsCreateSCIMToken.

- Authentication: dashboardSession
- Request body: SCIMTokenCreate

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| org_id | path | required |  |

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| name | required | string | minLength: 1 maxLength: 80 |
| proof | required | DashboardProof |  |

#### Request template

~~~sh
curl --request POST --cookie cookies.txt --cookie-jar cookies.txt --header 'Content-Type: application/json' --data '@request.json' 'https://screenrig.ai/api/organizations/ORG_ID/scim/tokens'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 201 | The new token, with its secret. | SCIMTokenCreated (application/json); headers: Cache-Control |
| 400 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 402 | feature_not_in_plan — SCIM provisioning is part of the Enterprise plan; the problem names the feature, the plan the account is on and required_plan. | Problem (application/problem+json) |
| 403 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 409 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### DELETE /api/organizations/{org_id}/scim/tokens/{token_id}

**Dashboard Organizations Revoke SCIMToken**

A designated admin revokes a provisioning token; requests that present it are refused with 401 from then on. An already revoked token returns 204; an id the organization does not hold is not_found. People only; agents and bearer credentials have no route.


Operation: dashboardOrganizationsRevokeSCIMToken.

- Authentication: dashboardSession
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| org_id | path | required |  |
| token_id | path | required |  |

#### Request template

~~~sh
curl --request DELETE --cookie cookies.txt --cookie-jar cookies.txt 'https://screenrig.ai/api/organizations/ORG_ID/scim/tokens/TOKEN_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 204 | The token is revoked. | no body |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 403 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 404 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### GET /api/organizations/{org_id}/scim/groups

**Dashboard Organizations List SCIMGroups**

A designated admin lists the groups the identity provider has provisioned, with their member counts and the projects each is bound to. Binding is done in the project (createDashboardGroupBinding) by a person who can approve there; an admin sees bindings and project names only, which grants no project access.

People only; agents and bearer credentials have no route.


Operation: dashboardOrganizationsListSCIMGroups.

- Authentication: dashboardSession
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| org_id | path | required |  |

#### Request template

~~~sh
curl --request GET --cookie cookies.txt --cookie-jar cookies.txt 'https://screenrig.ai/api/organizations/ORG_ID/scim/groups'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The organization's provisioned groups. | SCIMGroupList (application/json); headers: Cache-Control |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 403 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### GET /api/organizations/{org_id}/scim/events

**Dashboard Organizations List SCIMEvents**

A designated admin reads the latest 500 requests the organization's SCIM clients made, newest first, failures included, kept for 30 days. Each row names the operation, the resource and the status, and carries a detail when the request failed. People only; agents and bearer credentials have no route.


Operation: dashboardOrganizationsListSCIMEvents.

- Authentication: dashboardSession
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| org_id | path | required |  |

#### Request template

~~~sh
curl --request GET --cookie cookies.txt --cookie-jar cookies.txt 'https://screenrig.ai/api/organizations/ORG_ID/scim/events'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The organization's latest SCIM events. | SCIMEventList (application/json); headers: Cache-Control |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 403 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### GET /api/project/group-bindings

**List Dashboard Group Bindings**

The session project's group bindings, and the groups its organization's identity provider has provisioned (name and member count) to choose from.

A binding gives every member of the group a membership in this project: role member is a plain membership and role approver also lets the person approve reviews, of the whole project or of the binding's screen_scope. A person several bindings of the project reach holds the union of their scopes, and a binding without a scope gives the whole project.

They approve reviews only when the union of their approver bindings' scopes (with an approving hand grant's) covers that whole union, and are a member otherwise; SCIM never lowers a hand grant: a binding that would is not applied to the person and is recorded as a failed SCIM event.

Any member of the project reads, except a caller limited to screens (outside_screen_scope).


Operation: listDashboardGroupBindings.

- Authentication: dashboardSession
- Request body: none

#### Request template

~~~sh
curl --request GET --cookie cookies.txt --cookie-jar cookies.txt 'https://screenrig.ai/api/project/group-bindings'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The project's bindings and the organization's groups. | GroupBindingList (application/json); headers: Cache-Control |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 409 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### POST /api/project/group-bindings

**Create Dashboard Group Binding**

Binds a provisioned group to the session project with a role and, optionally, a screen_scope that limits it to screen folders and screens (fixed once made; invalid_request names the field of an id the project does not hold).

The project owner or a member who can approve only (approver_required otherwise; a caller limited to screens is outside_screen_scope); an admin of the project's organization binds as such a member, so one who cannot approve joins the project first (POST /api/organizations/{org_id}/projects/{project_id}/access makes them an approver), and the binding is then recorded in the organization audit, marked by_organization_admin in the project's audit, and the project's owner is emailed; a staff shadow session is read-only.

The group must be one of the project's organization's provisioned groups, otherwise not_found, and a group is bound to a project once, otherwise resource_conflict. The binding takes effect at once for the group's current members and follows every change to the group's membership.

The project's 200-member limit applies: a person it refuses is recorded as a failed event in the organization's SCIM events and nothing else changes; so is a person who would be an external guest that the organization's guest policy does not admit (guest_not_allowed).

A scope change a binding makes appends project.member_screen_scope_changed (details user_id, screen_scope, previous, via scim, changed_by_user_id empty). Binding a group is SCIM provisioning, which the Enterprise plan includes; a project whose plan lacks it is refused with feature_not_in_plan (402). Bindings that exist keep granting and can be removed.


Operation: createDashboardGroupBinding.

- Authentication: dashboardSession
- Request body: GroupBindingCreate

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| group_id | required | string | minLength: 1 maxLength: 200 |
| role | required | string | Allowed: "approver", "member" |
| screen_scope | optional | ScreenScope | What a scoped member or agent may act on (docs/screen-scope.md): the screens in the listed screen folders and in every folder inside them, and the listed screens. At least one id in all. An id that names no live folder or screen of the project when written is invalid_request at its position; a later deletion leaves a dead id, which grants nothing. The scope is read on each request, so a change applies to the next one. Tags are never scope. |

#### Request template

~~~sh
curl --request POST --cookie cookies.txt --cookie-jar cookies.txt --header 'Content-Type: application/json' --data '@request.json' 'https://screenrig.ai/api/project/group-bindings'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 201 | The new binding. | GroupBinding (application/json); headers: Cache-Control |
| 400 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 402 | feature_not_in_plan — SCIM provisioning is part of the Enterprise plan; the problem names the feature, the plan the account is on and required_plan. | Problem (application/problem+json) |
| 403 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 404 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 409 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### DELETE /api/project/group-bindings/{binding_id}

**Delete Dashboard Group Binding**

Unbinds a group from the session project. The project owner or a member who can approve only (approver_required otherwise); an admin of the project's organization unbinds as such a member, recorded as a binding is.

People who held access only through the binding lose it; a membership granted by hand stays, and a hand grant the binding raised or widened returns to what it was, its screen scope included. An id the project does not hold is not_found.


Operation: deleteDashboardGroupBinding.

- Authentication: dashboardSession
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| binding_id | path | required |  |

#### Request template

~~~sh
curl --request DELETE --cookie cookies.txt --cookie-jar cookies.txt 'https://screenrig.ai/api/project/group-bindings/BINDING_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 204 | The binding is removed and the access it gave is withdrawn. | no body |
| 401 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 403 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 404 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| 409 | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |
| default | Stable RFC 9457 problem response. A 421 server_draining carries Retry-After of 1 second, a 500 not_ready or dependency_unavailable carries 5, and a 500 manifest_degraded carries 60, unless the handler set a more specific value. | Problem (application/problem+json) |

### GET /scim/v2/ServiceProviderConfig

**Get SCIMService Provider Config**

The RFC 7643 ServiceProviderConfig of the organization's SCIM service: patch and filter (at most 200 results) are supported; bulk, sort, etag and changePassword are not. Requests and responses are application/scim+json; application/json is accepted on requests.


Operation: getSCIMServiceProviderConfig.

- Authentication: scimBearer
- Request body: none

#### Request template

~~~sh
curl --request GET --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/ServiceProviderConfig'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The service provider configuration. | SCIMResource (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### GET /scim/v2/ResourceTypes

**List SCIMResource Types**

The RFC 7643 resource types the service provisions: User and Group.


Operation: listSCIMResourceTypes.

- Authentication: scimBearer
- Request body: none

#### Request template

~~~sh
curl --request GET --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/ResourceTypes'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | A ListResponse of the resource types. | SCIMResource (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### GET /scim/v2/Schemas

**List SCIMSchemas**

The RFC 7643 schema definitions of the resources the service provisions.


Operation: listSCIMSchemas.

- Authentication: scimBearer
- Request body: none

#### Request template

~~~sh
curl --request GET --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/Schemas'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | A ListResponse of the schemas. | SCIMResource (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### GET /scim/v2/Users

**List SCIMUsers**

Lists the organization's provisioned users as an RFC 7644 ListResponse. filter is one to four attr eq value terms joined by and; a value is a quoted JSON string, or true or false for active.

Users filter on userName (case-insensitive), externalId (exact), id, emails and emails.value, displayName and active; any other filter is 400 invalidFilter. startIndex is 1-based. count defaults to 100 and is at most 200; count=0 returns only totalResults. attributes and excludedAttributes trim the members returned.


Operation: listSCIMUsers.

- Authentication: scimBearer
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| filter | query | optional | One to four attr eq value terms joined by and. A value is a quoted JSON string, or true or false for active. An unsupported attribute, operator or shape is 400 invalidFilter. |
| startIndex | query | optional | The 1-based index of the first result. A value below 1 is read as 1. |
| count | query | optional | The page size, at most 200. 0 returns only totalResults. A larger value is read as 200. |
| attributes | query | optional | A comma-separated list of attributes to return; the others are left out, except id and schemas. |
| excludedAttributes | query | optional | A comma-separated list of attributes to leave out. |

#### Request template

~~~sh
curl --request GET --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/Users'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | A ListResponse of users. | SCIMResource (application/scim+json) |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### POST /scim/v2/Users

**Create SCIMUser**

Provisions a user and answers 201 with the resource and its Location. The person is identified by their work email, else their primary email, else userName, and the address must be at one of the organization's verified domains.

A person who holds no credential, or whom the organization already manages, becomes managed by it and signs in through the connection; a person who is already a member of one of its projects and keeps their own sign-in is linked for access only, so SCIM manages their grants in the organization's projects and never the person.

An address the organization may not provision, such as one at another domain or a screenRIG staff person, is refused with a SCIM error whose detail names the reason. A person whose user this organization deleted while it did not manage them is provisioned again, with the access the deletion removed. A userName that is already provisioned is 409 uniqueness.


Operation: createSCIMUser.

- Authentication: scimBearer
- Request body: SCIMResource

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| schemas | optional | array | The URNs of the schemas the document follows. |

#### Request template

~~~sh
curl --request POST --header 'Authorization: Bearer [SCIM_TOKEN]' --header 'Content-Type: application/scim+json' --data '@request.json' 'https://api.screenrig.ai/scim/v2/Users'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 201 | The provisioned user. | SCIMResource (application/scim+json); headers: Location |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 409 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### GET /scim/v2/Users/{id}

**Get SCIMUser**

Reads one provisioned user. attributes and excludedAttributes trim the members returned.


Operation: getSCIMUser.

- Authentication: scimBearer
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| id | path | required | The id of a provisioned resource, as the SCIM service returned it. |
| attributes | query | optional | A comma-separated list of attributes to return; the others are left out, except id and schemas. |
| excludedAttributes | query | optional | A comma-separated list of attributes to leave out. |

#### Request template

~~~sh
curl --request GET --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/Users/RESOURCE_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The user. | SCIMResource (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 404 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### PUT /scim/v2/Users/{id}

**Replace SCIMUser**

Replaces a provisioned user with the document sent. active false deactivates the person.

A person the organization manages is deactivated as in the dashboard: their sessions and dashboard tokens end, their project memberships and responsible agents are suspended, and the last organization admin is refused with 400 mutability; active true reinstates them with those memberships and agents.

A person it does not manage loses their access in the organization's projects (never a project they own) and their sessions end; active true restores that access. A user that stands for a screenRIG staff person is never changed: 400 mutability.


Operation: replaceSCIMUser.

- Authentication: scimBearer
- Request body: SCIMResource

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| id | path | required | The id of a provisioned resource, as the SCIM service returned it. |

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| schemas | optional | array | The URNs of the schemas the document follows. |

#### Request template

~~~sh
curl --request PUT --header 'Authorization: Bearer [SCIM_TOKEN]' --header 'Content-Type: application/scim+json' --data '@request.json' 'https://api.screenrig.ai/scim/v2/Users/RESOURCE_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The user as stored. | SCIMResource (application/scim+json) |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 404 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 409 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### PATCH /scim/v2/Users/{id}

**Patch SCIMUser**

Applies an RFC 7644 PatchOp message to a provisioned user and answers 200 with the user.

The operations are read as Microsoft Entra ID and Okta send them, with or without ?aadOptscim062020: op names are case- insensitive; booleans are true or false, or "True" or "False"; an operation may omit path or use dotted keys such as name.givenName; paths include emails[type eq "work"].value, members (add, replace, and remove with a value array) and members[value eq "<id>"] (remove); attributes screenRIG does not use are accepted and ignored. active false deactivates the person.

A person the organization manages is deactivated as in the dashboard: their sessions and dashboard tokens end, their project memberships and responsible agents are suspended, and the last organization admin is refused with 400 mutability; active true reinstates them with those memberships and agents.

A person it does not manage loses their access in the organization's projects (never a project they own) and their sessions end; active true restores that access. A user that stands for a screenRIG staff person is never changed: 400 mutability.


Operation: patchSCIMUser.

- Authentication: scimBearer
- Request body: SCIMResource

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| id | path | required | The id of a provisioned resource, as the SCIM service returned it. |

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| schemas | optional | array | The URNs of the schemas the document follows. |

#### Request template

~~~sh
curl --request PATCH --header 'Authorization: Bearer [SCIM_TOKEN]' --header 'Content-Type: application/scim+json' --data '@request.json' 'https://api.screenrig.ai/scim/v2/Users/RESOURCE_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The user as stored. | SCIMResource (application/scim+json) |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 404 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 409 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### DELETE /scim/v2/Users/{id}

**Delete SCIMUser**

Deactivates the user as active false does, after which the id is not_found and the user leaves every listing and filter. For a person the organization does not manage, the access the deactivation removed is kept, and a later create of the same person restores it. A user that stands for a screenRIG staff person is never changed: 400 mutability.

It never erases a person; erasure is the person's own account deletion.


Operation: deleteSCIMUser.

- Authentication: scimBearer
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| id | path | required | The id of a provisioned resource, as the SCIM service returned it. |

#### Request template

~~~sh
curl --request DELETE --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/Users/RESOURCE_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 204 | The user is deactivated and no longer provisioned. | no body |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 404 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### GET /scim/v2/Groups

**List SCIMGroups**

Lists the organization's provisioned groups as an RFC 7644 ListResponse. filter is one to four attr eq value terms joined by and.

Groups filter on displayName, externalId, id, and members and members.value; any other filter is 400 invalidFilter. startIndex is 1-based. count defaults to 100 and is at most 200; count=0 returns only totalResults. attributes and excludedAttributes trim the members returned.


Operation: listSCIMGroups.

- Authentication: scimBearer
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| filter | query | optional | One to four attr eq value terms joined by and. A value is a quoted JSON string, or true or false for active. An unsupported attribute, operator or shape is 400 invalidFilter. |
| startIndex | query | optional | The 1-based index of the first result. A value below 1 is read as 1. |
| count | query | optional | The page size, at most 200. 0 returns only totalResults. A larger value is read as 200. |
| attributes | query | optional | A comma-separated list of attributes to return; the others are left out, except id and schemas. |
| excludedAttributes | query | optional | A comma-separated list of attributes to leave out. |

#### Request template

~~~sh
curl --request GET --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/Groups'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | A ListResponse of groups. | SCIMResource (application/scim+json) |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### POST /scim/v2/Groups

**Create SCIMGroup**

Provisions a group and answers 201 with the resource and its Location. displayName is unique in the organization, compared case-insensitively; a duplicate is 409 uniqueness. A group grants no access until a person who can approve binds it to a project in the dashboard.


Operation: createSCIMGroup.

- Authentication: scimBearer
- Request body: SCIMResource

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| schemas | optional | array | The URNs of the schemas the document follows. |

#### Request template

~~~sh
curl --request POST --header 'Authorization: Bearer [SCIM_TOKEN]' --header 'Content-Type: application/scim+json' --data '@request.json' 'https://api.screenrig.ai/scim/v2/Groups'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 201 | The provisioned group. | SCIMResource (application/scim+json); headers: Location |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 409 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### GET /scim/v2/Groups/{id}

**Get SCIMGroup**

Reads one provisioned group. attributes and excludedAttributes trim the members returned.


Operation: getSCIMGroup.

- Authentication: scimBearer
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| id | path | required | The id of a provisioned resource, as the SCIM service returned it. |
| attributes | query | optional | A comma-separated list of attributes to return; the others are left out, except id and schemas. |
| excludedAttributes | query | optional | A comma-separated list of attributes to leave out. |

#### Request template

~~~sh
curl --request GET --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/Groups/RESOURCE_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The group. | SCIMResource (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 404 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### PUT /scim/v2/Groups/{id}

**Replace SCIMGroup**

Replaces a provisioned group with the document sent. A document without members keeps the group's members. Membership changes reconcile the affected people's project access, which is idempotent.


Operation: replaceSCIMGroup.

- Authentication: scimBearer
- Request body: SCIMResource

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| id | path | required | The id of a provisioned resource, as the SCIM service returned it. |

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| schemas | optional | array | The URNs of the schemas the document follows. |

#### Request template

~~~sh
curl --request PUT --header 'Authorization: Bearer [SCIM_TOKEN]' --header 'Content-Type: application/scim+json' --data '@request.json' 'https://api.screenrig.ai/scim/v2/Groups/RESOURCE_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The group as stored. | SCIMResource (application/scim+json) |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 404 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 409 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### PATCH /scim/v2/Groups/{id}

**Patch SCIMGroup**

Applies an RFC 7644 PatchOp message to a provisioned group and answers 204, or 200 with the group when attributes or excludedAttributes are given.

The operations are read as Microsoft Entra ID and Okta send them, with or without ?aadOptscim062020: op names are case-insensitive; booleans are true or false, or "True" or "False"; an operation may omit path or use dotted keys such as name.givenName; paths include emails[type eq "work"].value, members (add, replace, and remove with a value array) and members[value eq "<id>"] (remove); attributes screenRIG does not use are accepted and ignored.

Membership changes reconcile the affected people's project access, which is idempotent.


Operation: patchSCIMGroup.

- Authentication: scimBearer
- Request body: SCIMResource

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| id | path | required | The id of a provisioned resource, as the SCIM service returned it. |
| attributes | query | optional | A comma-separated list of attributes to return; the others are left out, except id and schemas. |
| excludedAttributes | query | optional | A comma-separated list of attributes to leave out. |

#### Request body fields

| Field | Required? | Type | Description |
| --- | --- | --- | --- |
| schemas | optional | array | The URNs of the schemas the document follows. |

#### Request template

~~~sh
curl --request PATCH --header 'Authorization: Bearer [SCIM_TOKEN]' --header 'Content-Type: application/scim+json' --data '@request.json' 'https://api.screenrig.ai/scim/v2/Groups/RESOURCE_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 200 | The group as stored, when attributes or excludedAttributes were given. | SCIMResource (application/scim+json) |
| 204 | The patch is applied. | no body |
| 400 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 404 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 409 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |

### DELETE /scim/v2/Groups/{id}

**Delete SCIMGroup**

Deletes a provisioned group together with its project bindings. People who held access only through those bindings lose it; a membership granted by hand stays.


Operation: deleteSCIMGroup.

- Authentication: scimBearer
- Request body: none

#### Parameters

| Name | Send in | Required? | Description |
| --- | --- | --- | --- |
| id | path | required | The id of a provisioned resource, as the SCIM service returned it. |

#### Request template

~~~sh
curl --request DELETE --header 'Authorization: Bearer [SCIM_TOKEN]' 'https://api.screenrig.ai/scim/v2/Groups/RESOURCE_ID'
~~~

#### Responses

| Status | Meaning | Body and headers |
| --- | --- | --- |
| 204 | The group is deleted. | no body |
| 401 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 403 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 404 | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |
| 429 | The organization's request budget (600 a minute) is spent. A SCIM error with status "429"; retry after the Retry-After interval. | SCIMError (application/scim+json); headers: Retry-After |
| default | An RFC 7644 section 3.12 SCIM error, application/scim+json, not a problem document. status repeats the HTTP status as a string and scimType names the class (invalidFilter, uniqueness, mutability and the others of the RFC); detail says what was refused. 401 is an unknown or revoked token and 403 an organization with SCIM turned off. | SCIMError (application/scim+json) |


## Sitemap

See the [public documentation sitemap](https://screenrig.ai/sitemap.md).