Skip to main content
FormuleyFormuley

SCIM provisioning

Set up enterprise SCIM 2.0 provisioning for Formuley users, understand supported operations, and map IdP groups to Formuley roles.

Updated March 13, 2026
2 min read

Overview

Formuley supports SCIM 2.0 for enterprise user provisioning and deprovisioning.

SCIM is separate from the standard REST API:

  • it uses /api/scim/v2
  • it uses a dedicated bearer token
  • it is intended for identity providers and enterprise IT workflows

SCIM is an enterprise-only capability.

Authentication model

SCIM does not use the normal API key scopes from /developer/api-keys.

It uses an organization-scoped SCIM bearer token, which is validated separately from REST API keys.

SCIM endpoints

Current SCIM routes include:

  • GET /api/scim/v2/ServiceProviderConfig
  • GET /api/scim/v2/Users
  • POST /api/scim/v2/Users
  • GET /api/scim/v2/Users/[id]
  • PUT /api/scim/v2/Users/[id]
  • PATCH /api/scim/v2/Users/[id]
  • DELETE /api/scim/v2/Users/[id]
  • GET /api/scim/v2/Groups

Supported capabilities

ServiceProviderConfig currently reports:

  • patch: supported
  • filter: supported
  • bulk: not supported
  • sort: not supported
  • changePassword: not supported
  • etag: not supported

Design your IdP setup around those constraints.

Group and role mapping

Formuley maps its five system roles to SCIM groups:

  • Owner
  • Admin
  • Formulator
  • Production
  • Viewer

GET /api/scim/v2/Groups exposes those roles so your identity provider can assign users to the correct permission set during provisioning.

If no matching group is provided, SCIM-provisioned users default to the Formulator role.

  1. Confirm the organization is on Enterprise.
  2. Validate connectivity with GET /api/scim/v2/ServiceProviderConfig.
  3. Read /Groups and map your IdP assignments to Formuley's system roles.
  4. Test create, patch, and deprovision flows with a non-production user.

Troubleshooting

  • If you get 401, confirm you are using the SCIM bearer token, not a REST API key.
  • If provisioning succeeds but role assignment looks wrong, review the group display names or role IDs your IdP is sending.
  • If your IdP expects SCIM bulk support, disable that behavior because Formuley currently reports bulk as unsupported.

Next docs

Related Docs

Developer

API overview

Understand the Formuley API surface, the difference between public docs and gated developer tools, and which endpoint families exist.

Developer

Authentication and scopes

Create API keys, use the correct bearer format, understand scopes, and interpret rate-limit and authorization failures.

Need support instead?

Use the Help Center for troubleshooting, billing questions, account issues, and product guidance once your setup is already in motion.

Open Help CenterContact Support