SCIM 2.0 reference

For setup and identity-provider walkthroughs, see SCIM provisioning.

Base URL and auth

https://chgrkvftjfibufoopmav.supabase.co/functions/v1

All requests except schema discovery require Authorization: Bearer tqc_scim_…. The tenant is resolved from the token — see authentication.

Endpoints

Filters

List endpoints accept the subset that mainstream identity providers emit: userName eq, externalId eq, id eq, active eq true|false, emails eq, emails.value eq, and the bracketed emails[type eq "work"].value eq form (the selector is treated as the inner attribute). Groups additionally support displayName eq, members eq, and members.value eq.

GET /functions/v1/scim-users?filter=userName%20eq%20%22alice%40acme.com%22 HTTP/1.1
Host: chgrkvftjfibufoopmav.supabase.co
Authorization: Bearer tqc_scim_…

Unsupported filters return:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "detail": "Filter not supported: …",
  "scimType": "invalidFilter"
}

Response shapes

List responses follow RFC 7644 ListResponse:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 1,
  "startIndex": 1,
  "itemsPerPage": 1,
  "Resources": [
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
      "id": "5f3a…",
      "userName": "alice@acme.com",
      "name": { "givenName": "Alice", "familyName": "Janssen" },
      "displayName": "Alice Janssen",
      "emails": [{ "value": "alice@acme.com", "primary": true }],
      "externalId": "00u1abcd2EFGHIJKL345",
      "active": true,
      "meta": {
        "resourceType": "User",
        "created": "2026-01-15T09:12:00Z",
        "lastModified": "2026-06-01T14:03:00Z",
        "location": "https://…/scim-users/5f3a…"
      }
    }
  ]
}

The enterprise user extension (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User) is accepted, stored, and returned verbatim; only the core attributes above project onto platform profiles.

Deprovision semantics

DELETE /scim-users/{id} returns 204 and:

• Removes the SCIM binding for the user — subsequent SCIM GET for that id returns 404, per RFC 7644.
• Suspends the underlying account; sign-in is blocked.
• Retains the profile for audit. Deprovisioning is not data erasure — see GDPR for deletion.

PATCH with active: false suspends without removing the binding; active: true reactivates.

Errors

Not supported

Bulk operations (/Bulk), password synchronization (by design — passwords are never copied across the wire), and SCIM v1.