SCIM provisioning

SCIM is an HTTP REST API and protocol used by identity providers to manage the users across a variety of software products, including Elimity Insights. This SCIM implementation targets version 2.0 of the protocol.

Be aware that the SCIM API allows creating and deleting users at will. Hence, thoroughly protect your API keys to prevent unauthorized people from making themselves admin and accessing your data. Similarly, thoroughly test your scripts before executing them to avoid deprovisioning all users in your tenant. Of course, our support team is available should you run into any trouble.

Authentication

The SCIM API of Elimity Insights requires authentication using a bearer token (HTTP Bearer Authentication). As such, the client must send this token in the Authorization header when making requests to protected resources:

Authorization: Bearer {token}

Use the 'SCIM API' tab on the 'Advanced settings' page to generate this token:

Roles and access profiles

Elimity Insights works with two authorization concepts:

  1. Roles like member, editor, connectorAdmin and admin determine the functionality that user can access.

  2. Access profiles determine which data sources a user is permitted to see.

A user in Elimity Insights is always assigned to exactly 1 role, to the default access profile and to 0 or more custom access profiles. SCIM on the other hand works with the concept of groups and Elimity Insights models roles and access profiles as groups in the following way:

  • We model roles as groups with an id in the format role:{roleId}. This list of roles currently exists:

    • role:member

    • role:editor

    • role:changeRequestManager

    • role:accessReviewManager

    • role:connectorAdmin

    • role:admin

  • We model access profiles as groups with an id in the format of profile:{profileId}; {profileId} represents the access profile's numeric identifier. You can find this value in the URL of the access profile's details page.

  • The default access profile is not available in the SCIM API and cannot be assigned or revoked explicitly.

Supported endpoints

The table below lists the endpoints supported by the SCIM API of Elimity Insights. We intentionally don't support other related actions like deleting or creating access profiles via the SCIM API, for those you'll have to use the UI.

Endpoint
Description

GET /scim/v2/ServiceProviderConfig

Retrieve the configuration details for the Elimity Insights SCIM API

GET /scim/v2/ResourceTypes

Retrieve the available resource types (users and groups)

GET /scim/v2/Schemas

Retrieve the schemas for users and groups

GET /scim/v2/Users

Retrieve the list of all users in Elimity Insights

GET /scim/v2/Users/{id}

Retrieve the user with the given identifier (email address)

POST /scim/v2/Users

Create a new user

PUT /scim/v2/Users/{id}

Change the name or status of the user with the given identifier (email address)

GET /scim/v2/Groups

Retrieve the list of all groups (roles and access profiles) in Elimity Insights

GET /scim/v2/Groups/{id}

Retrieve the group with the given identifier

PUT /scim/v2/Groups/{id}

Update the members of the group with the given identifier

PreviousPattern matching

Last updated