SCIM 2.0 Provisioning

NodeLoom implements SCIM 2.0 (System for Cross-domain Identity Management) for automated user and group provisioning. SCIM lets your identity provider manage the full lifecycle of NodeLoom accounts, including creation, updates, deactivation, and role assignment.

Overview

SCIM 2.0 is an open standard defined by RFC 7643 (Core Schema) and RFC 7644 (Protocol) for automating the exchange of user identity information between identity domains. When configured, your identity provider pushes user and group changes to NodeLoom in real time.

Prerequisites

Before configuring SCIM provisioning, ensure the following requirements are met:

Setting Up SCIM

Follow these steps to enable SCIM provisioning for your team.

Token Management

SCIM tokens authenticate your identity provider's requests to NodeLoom. Each team can have up to 10 active SCIM tokens, allowing for token rotation without downtime.

{
  "name": "Okta SCIM Provisioning",
  "allowedIPs": [
    "52.18.0.0/24",
    "54.76.120.0/24"
  ],
  "expiresAt": "2027-01-01T00:00:00Z"
}

User Provisioning

When your identity provider creates a user through SCIM, NodeLoom automatically provisions a new account. SCIM-managed users are distinguished from manually created users and have specific behaviors.

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "[email protected]",
  "name": {
    "givenName": "Jane",
    "familyName": "Doe"
  },
  "emails": [
    {
      "primary": true,
      "value": "[email protected]",
      "type": "work"
    }
  ],
  "displayName": "Jane Doe",
  "active": true
}

Group Provisioning

SCIM groups from your identity provider map to NodeLoom roles. When a user is added to or removed from a group in your IdP, their NodeLoom role is automatically updated.

Group names are matched case-insensitively. You can customize the group-to-role mapping in Settings → SCIM → Group Mapping. Users who belong to multiple groups receive the highest-privilege role.

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {
      "op": "add",
      "path": "members",
      "value": [
        {
          "value": "user-uuid-here",
          "display": "[email protected]"
        }
      ]
    }
  ]
}

Supported Operations

NodeLoom implements the full SCIM 2.0 protocol as defined in RFC 7644. The following table lists all supported operations by resource type.

Rate Limiting

SCIM endpoints are rate-limited to prevent abuse and ensure consistent performance. Rate limits apply per team and are tracked using a sliding window.

The default rate limit is 60 requests per minute per team. Enterprise customers can request higher limits through their account manager. When the rate limit is exceeded, the API returns a 429 Too Many Requests response with a Retry-After header.

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "429",
  "detail": "Rate limit exceeded. Retry after 32 seconds."
}

Filtering

SCIM list endpoints support filtering using the standard SCIM filter syntax. Filters are passed as a filter query parameter.

curl -H "Authorization: Bearer scim_token_here" \
  "https://your-domain.com/api/scim/v2/Users?filter=userName%20eq%20%22jane%40example.com%22"

API Endpoints

All SCIM endpoints are authenticated with a SCIM bearer token and prefixed with /api/scim/v2. Requests must include the Authorization: Bearer header.

User Endpoints

Group Endpoints

Audit Logging

All SCIM operations are recorded in the NodeLoom audit log. Each entry includes the operation type, affected resource, requesting IP address, and the SCIM token used. Audit entries are immutable and tamper-evident.

{
  "id": "audit_3a2b1c0d",
  "timestamp": "2026-03-15T09:22:00Z",
  "event": "scim.user.created",
  "actor": "scim-token:okta-provisioner",
  "resource": {
    "type": "user",
    "id": "usr_abc123",
    "email": "[email protected]"
  },
  "sourceIP": "52.18.44.100",
  "teamId": "team_xyz789"
}