SCIM provisioning

Overview

Formuley supports SCIM 2.0 for enterprise user provisioning and deprovisioning.

SCIM is separate from the standard REST API:

• it uses /api/scim/v2
• it uses a dedicated bearer token
• it is intended for identity providers and enterprise IT workflows

SCIM is an enterprise-only capability.

Authentication model

SCIM does not use the normal API key scopes from /developer/api-keys.

It uses an organization-scoped SCIM bearer token, which is validated separately from REST API keys.

SCIM endpoints

Current SCIM routes include:

• GET /api/scim/v2/ServiceProviderConfig
• GET /api/scim/v2/Users
• POST /api/scim/v2/Users
• GET /api/scim/v2/Users/[id]
• PUT /api/scim/v2/Users/[id]
• PATCH /api/scim/v2/Users/[id]
• DELETE /api/scim/v2/Users/[id]
• GET /api/scim/v2/Groups

Supported capabilities

ServiceProviderConfig currently reports:

• patch: supported
• filter: supported
• bulk: not supported
• sort: not supported
• changePassword: not supported
• etag: not supported

Design your IdP setup around those constraints.

Group and role mapping

Formuley maps its five system roles to SCIM groups:

• Owner
• Admin
• Formulator
• Production
• Viewer

GET /api/scim/v2/Groups exposes those roles so your identity provider can assign users to the correct permission set during provisioning.

If no matching group is provided, SCIM-provisioned users default to the Formulator role.

Recommended setup flow

1. Confirm the organization is on Enterprise.
2. Validate connectivity with GET /api/scim/v2/ServiceProviderConfig.
3. Read /Groups and map your IdP assignments to Formuley's system roles.
4. Test create, patch, and deprovision flows with a non-production user.

Troubleshooting

• If you get 401, confirm you are using the SCIM bearer token, not a REST API key.
• If provisioning succeeds but role assignment looks wrong, review the group display names or role IDs your IdP is sending.
• If your IdP expects SCIM bulk support, disable that behavior because Formuley currently reports bulk as unsupported.

Next docs

• API overview
• Authentication and scopes