> For the complete documentation index, see [llms.txt](https://docs.tabnine.com/main/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tabnine.com/main/administering-tabnine/managing-your-team/settings/general-settings/idp-sync/tabnine-scim-api.md). # Tabnine SCIM API ## GET /Users > List/search users ```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"ScimUserListResponse":{"type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer"},"Resources":{"type":"array","items":{"$ref":"#/components/schemas/ScimUser"}}}},"ScimUser":{"type":"object","required":["schemas","id","externalId","userName","active","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"userName":{"type":"string","format":"email"},"active":{"type":"boolean"},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["User"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}},"responses":{"BadRequest":{"description":"Bad Request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}},"Unauthorized":{"description":"Missing/invalid bearer token, org mismatch, IDP sync disabled for the org, key ID mismatch, or key expired (verifyIdpKeyMiddleware in auth-service).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}},"paths":{"/Users":{"get":{"summary":"List/search users","parameters":[{"name":"filter","in":"query","schema":{"type":"string"},"description":"Only `userName eq \"\"` is supported. Any other property or operator returns 400. (scim.router.ts parseScimFilter)\n"},{"name":"count","in":"query","schema":{"type":"string"},"description":"Page size. Optional, passed through to auth-service (default 10 there)."},{"name":"startIndex","in":"query","schema":{"type":"string"},"description":"1-based per SCIM spec. Converted to 0-based before calling the internal auth-service API.\n"}],"responses":{"200":{"description":"OK. Deviation - no real pagination handling (`AuthClient.getUsers` has `// TODO: handle pagination`); totalResults may not reflect true dataset size across pages.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimUserListResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"}}}}}} ``` ## POST /Users > Create a user ```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"CreateScimUser":{"type":"object","required":["userName","externalId"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"userName":{"type":"string","format":"email","description":"Required. Not validated as email format at this layer (only presence-checked)."},"externalId":{"type":"string","description":"Required."},"active":{"type":"boolean","description":"Optional. Defaults to true downstream if omitted."},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["User"]}},"description":"Typed as required in source but NOT enforced at runtime."}}},"ScimUser":{"type":"object","required":["schemas","id","externalId","userName","active","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"userName":{"type":"string","format":"email"},"active":{"type":"boolean"},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["User"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}},"responses":{"Unauthorized":{"description":"Missing/invalid bearer token, org mismatch, IDP sync disabled for the org, key ID mismatch, or key expired (verifyIdpKeyMiddleware in auth-service).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}},"paths":{"/Users":{"post":{"summary":"Create a user","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateScimUser"}}}},"responses":{"201":{"description":"Created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimUser"}}}},"400":{"description":"Missing `userName` or `externalId`. (These are the only two fields validated at runtime, despite `meta.resourceType` being typed as required — it is not enforced.)\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"409":{"description":"Deviation from RFC (no standard SCIM 409 body defined) - a user with this `userName` already has an `externalId` set.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}}}}} ``` ## GET /Users/{id} > Get a user by ID ```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"ScimUser":{"type":"object","required":["schemas","id","externalId","userName","active","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"userName":{"type":"string","format":"email"},"active":{"type":"boolean"},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["User"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}},"responses":{"Unauthorized":{"description":"Missing/invalid bearer token, org mismatch, IDP sync disabled for the org, key ID mismatch, or key expired (verifyIdpKeyMiddleware in auth-service).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}},"NotFound":{"description":"Not Found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}},"paths":{"/Users/{id}":{"get":{"summary":"Get a user by ID","responses":{"200":{"description":"OK.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimUser"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}}}} ``` ## Replace a user > Deviation - not a true full replace. Omitted fields are left unchanged rather than cleared (internal auth-service call is a PATCH, not a PUT).
```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"UpdateScimUser":{"type":"object","description":"All fields optional (Partial - see auth.types.ts). No firstName/lastName at this layer.","properties":{"userName":{"type":"string","format":"email"},"externalId":{"type":"string"},"active":{"type":"boolean"}}},"ScimUser":{"type":"object","required":["schemas","id","externalId","userName","active","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"userName":{"type":"string","format":"email"},"active":{"type":"boolean"},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["User"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}},"responses":{"NotFound":{"description":"Not Found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}},"paths":{"/Users/{id}":{"put":{"summary":"Replace a user","description":"Deviation - not a true full replace. Omitted fields are left unchanged rather than cleared (internal auth-service call is a PATCH, not a PUT).\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateScimUser"}}}},"responses":{"200":{"description":"OK.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimUser"}}}},"400":{"description":"A field outside {userName, externalId, active} was sent.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}} ``` ## Delete (deactivate) a user > Deviation - this is a soft delete. The user is deactivated (\`toggleUserActive(..., false)\` in auth-service); the record is not removed. Re-provisioning: POSTing \`/Users\` again with the same \`userName\` reactivates/adopts the existing (deactivated) user rather than creating a new one or erroring, as long as it currently has no \`externalId\` set - if it still has one, POST returns 409 instead.
```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"responses":{"NotFound":{"description":"Not Found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}},"schemas":{"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}}},"paths":{"/Users/{id}":{"delete":{"summary":"Delete (deactivate) a user","description":"Deviation - this is a soft delete. The user is deactivated (`toggleUserActive(..., false)` in auth-service); the record is not removed. Re-provisioning: POSTing `/Users` again with the same `userName` reactivates/adopts the existing (deactivated) user rather than creating a new one or erroring, as long as it currently has no `externalId` set - if it still has one, POST returns 409 instead.\n","responses":{"204":{"description":"No Content. Correctly empty-bodied (unlike the internal auth-service delete endpoint, which incorrectly sends a body on 204)."},"404":{"$ref":"#/components/responses/NotFound"}}}}}} ``` ## Partially update a user > Deviation - only \`active\`, \`externalId\`, \`userName\` (case-insensitive path match) are patchable. Operations targeting any other path are silently ignored (logged, not rejected). If no operation targets a supported property, this is a silent no-op that returns the current user unchanged with a 200 - the caller cannot distinguish "applied" from "ignored" from the response alone.
```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"ScimPatchRequest":{"type":"object","required":["Operations"],"properties":{"Operations":{"type":"array","items":{"$ref":"#/components/schemas/ScimPatchOperation"}}}},"ScimPatchOperation":{"type":"object","required":["op","path"],"properties":{"op":{"type":"string","enum":["add","remove","replace"]},"path":{"type":"string","description":"For Users: one of active | externalId | userName (case-insensitive), others silently ignored. For Groups: displayName | externalId | members | members[value eq \"\"].\n"},"value":{"description":"Type depends on path; string \"true\"/\"false\" is coerced to boolean."}}},"ScimUser":{"type":"object","required":["schemas","id","externalId","userName","active","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"userName":{"type":"string","format":"email"},"active":{"type":"boolean"},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["User"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}},"responses":{"NotFound":{"description":"Not Found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}},"paths":{"/Users/{id}":{"patch":{"summary":"Partially update a user","description":"Deviation - only `active`, `externalId`, `userName` (case-insensitive path match) are patchable. Operations targeting any other path are silently ignored (logged, not rejected). If no operation targets a supported property, this is a silent no-op that returns the current user unchanged with a 200 - the caller cannot distinguish \"applied\" from \"ignored\" from the response alone.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimPatchRequest"}}}},"responses":{"200":{"description":"OK (see no-op deviation note above).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimUser"}}}},"400":{"description":"Unsupported `op` value (must be add/remove/replace).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}} ``` ## GET /Groups > List/search groups ```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"ScimGroupListResponse":{"type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer"},"Resources":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroup"}}}},"ScimGroup":{"type":"object","required":["schemas","id","displayName","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"displayName":{"type":"string"},"members":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupMember"},"description":"Omitted entirely if `members` is passed via `excludedAttributes`."},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["Group"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimGroupMember":{"type":"object","required":["value"],"properties":{"value":{"type":"string","description":"Member's user ID."},"display":{"type":"string"},"type":{"type":"string","enum":["User","Group"]},"ref":{"type":"string","description":"SCIM $ref — URI of the member resource (maps to SCIM protocol attribute '$ref')"}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}},"responses":{"Unauthorized":{"description":"Missing/invalid bearer token, org mismatch, IDP sync disabled for the org, key ID mismatch, or key expired (verifyIdpKeyMiddleware in auth-service).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}},"paths":{"/Groups":{"get":{"summary":"List/search groups","parameters":[{"name":"filter","in":"query","schema":{"type":"string"},"description":"Only `displayName eq \"\"` is supported."},{"name":"count","in":"query","schema":{"type":"string"}},{"name":"startIndex","in":"query","schema":{"type":"string"},"description":"1-based, converted to 0-based internally."},{"name":"excludedAttributes","in":"query","schema":{"type":"string"},"description":"Comma-separated attribute names to omit from each result (e.g. `members`)."}],"responses":{"200":{"description":"Deviation - if the organization's IDP sync mode is not `UsersAndTeams` (i.e. group provisioning isn't enabled for that org/token), this returns 200 with an empty list rather than an error, masking the feature-flag state.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimGroupListResponse"}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}}}}} ``` ## Create a group > Deviation - \`members\` is accepted in the request body's type but is never sent to auth-service on create; a created group always starts with no members (add members afterward via PATCH/PUT).
```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"CreateScimGroup":{"type":"object","required":["displayName","externalId"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"displayName":{"type":"string"},"externalId":{"type":"string"},"members":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupMember"},"description":"Accepted in the type but ignored on create - see path-level deviation note."}}},"ScimGroupMember":{"type":"object","required":["value"],"properties":{"value":{"type":"string","description":"Member's user ID."},"display":{"type":"string"},"type":{"type":"string","enum":["User","Group"]},"ref":{"type":"string","description":"SCIM $ref — URI of the member resource (maps to SCIM protocol attribute '$ref')"}}},"ScimGroup":{"type":"object","required":["schemas","id","displayName","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"displayName":{"type":"string"},"members":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupMember"},"description":"Omitted entirely if `members` is passed via `excludedAttributes`."},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["Group"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}}},"paths":{"/Groups":{"post":{"summary":"Create a group","description":"Deviation - `members` is accepted in the request body's type but is never sent to auth-service on create; a created group always starts with no members (add members afterward via PATCH/PUT).\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateScimGroup"}}}},"responses":{"201":{"description":"Deviation (significant) - if the org's sync mode is not `UsersAndTeams`, this endpoint does NOT call auth-service at all. It fabricates a 201 response with a random UUID and echoes the input back. The caller is told the group was created; nothing was persisted.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimGroup"}}}},"400":{"description":"Missing `externalId`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}}}}} ``` ## GET /Groups/{id} > Get a group by ID ```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"ScimGroup":{"type":"object","required":["schemas","id","displayName","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"displayName":{"type":"string"},"members":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupMember"},"description":"Omitted entirely if `members` is passed via `excludedAttributes`."},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["Group"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimGroupMember":{"type":"object","required":["value"],"properties":{"value":{"type":"string","description":"Member's user ID."},"display":{"type":"string"},"type":{"type":"string","enum":["User","Group"]},"ref":{"type":"string","description":"SCIM $ref — URI of the member resource (maps to SCIM protocol attribute '$ref')"}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}}},"paths":{"/Groups/{id}":{"get":{"summary":"Get a group by ID","parameters":[{"name":"excludedAttributes","in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"OK.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimGroup"}}}},"404":{"description":"Not found, OR sync mode is not `UsersAndTeams` (both cases return 404 here - inconsistent with GET /Groups, which returns an empty 200 list for the same disabled-sync-mode condition instead of an error).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}}}}} ``` ## PUT /Groups/{id} > Replace a group ```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"UpdateScimGroup":{"type":"object","required":["displayName"],"properties":{"displayName":{"type":"string"},"externalId":{"type":"string"},"members":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupMember"}}}},"ScimGroupMember":{"type":"object","required":["value"],"properties":{"value":{"type":"string","description":"Member's user ID."},"display":{"type":"string"},"type":{"type":"string","enum":["User","Group"]},"ref":{"type":"string","description":"SCIM $ref — URI of the member resource (maps to SCIM protocol attribute '$ref')"}}},"ScimGroup":{"type":"object","required":["schemas","id","displayName","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"displayName":{"type":"string"},"members":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupMember"},"description":"Omitted entirely if `members` is passed via `excludedAttributes`."},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["Group"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}},"responses":{"NotFound":{"description":"Not Found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}},"paths":{"/Groups/{id}":{"put":{"summary":"Replace a group","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateScimGroup"}}}},"responses":{"200":{"description":"Deviation - if sync mode is not `UsersAndTeams`, fabricates a 200 echo of the input without persisting anything (same no-op pattern as POST /Groups).\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimGroup"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}} ``` ## Delete a group > Deviation - if sync mode is not \`UsersAndTeams\`, silently no-ops and returns 204 without calling auth-service.
```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"responses":{"NotFound":{"description":"Not Found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}},"schemas":{"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}}},"paths":{"/Groups/{id}":{"delete":{"summary":"Delete a group","description":"Deviation - if sync mode is not `UsersAndTeams`, silently no-ops and returns 204 without calling auth-service.\n","responses":{"204":{"description":"No Content."},"404":{"$ref":"#/components/responses/NotFound"}}}}}} ``` ## Partially update a group (including membership) > Supports standard \`Operations\` array. \`members\` path supports add/remove/replace, including value-filtered paths like \`members\[value eq "\"]\`. Flat \`displayName\`/\`externalId\` replace also supported.
```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"schemas":{"ScimPatchRequest":{"type":"object","required":["Operations"],"properties":{"Operations":{"type":"array","items":{"$ref":"#/components/schemas/ScimPatchOperation"}}}},"ScimPatchOperation":{"type":"object","required":["op","path"],"properties":{"op":{"type":"string","enum":["add","remove","replace"]},"path":{"type":"string","description":"For Users: one of active | externalId | userName (case-insensitive), others silently ignored. For Groups: displayName | externalId | members | members[value eq \"\"].\n"},"value":{"description":"Type depends on path; string \"true\"/\"false\" is coerced to boolean."}}},"ScimGroup":{"type":"object","required":["schemas","id","displayName","meta"],"properties":{"schemas":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"externalId":{"type":"string"},"displayName":{"type":"string"},"members":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupMember"},"description":"Omitted entirely if `members` is passed via `excludedAttributes`."},"meta":{"type":"object","properties":{"resourceType":{"type":"string","enum":["Group"]},"created":{"type":"string","format":"date-time"},"lastModified":{"type":"string","format":"date-time"}}}}},"ScimGroupMember":{"type":"object","required":["value"],"properties":{"value":{"type":"string","description":"Member's user ID."},"display":{"type":"string"},"type":{"type":"string","enum":["User","Group"]},"ref":{"type":"string","description":"SCIM $ref — URI of the member resource (maps to SCIM protocol attribute '$ref')"}}},"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}},"responses":{"NotFound":{"description":"Not Found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}}},"paths":{"/Groups/{id}":{"patch":{"summary":"Partially update a group (including membership)","description":"Supports standard `Operations` array. `members` path supports add/remove/replace, including value-filtered paths like `members[value eq \"\"]`. Flat `displayName`/`externalId` replace also supported.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimPatchRequest"}}}},"responses":{"200":{"description":"OK (only reached when sync mode is `UsersAndTeams`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimGroup"}}}},"204":{"description":"Deviation - if sync mode is not `UsersAndTeams`, silently returns 204 with no indication the patch was discarded.\n"},"400":{"description":"Invalid member payload or unsupported operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}} ``` ## List supported SCIM schemas > Known gap (referenced by DEV3-6023) - only \`User\` and \`Group\` core schemas are returned. An \`EnterpriseUser\` extension schema (\`employeeNumber\` attribute) exists fully drafted in source (consts.ts) but is commented out and not served. No custom-attribute extension schemas exist at all.
```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}}},"paths":{"/Schemas":{"get":{"summary":"List supported SCIM schemas","description":"Known gap (referenced by DEV3-6023) - only `User` and `Group` core schemas are returned. An `EnterpriseUser` extension schema (`employeeNumber` attribute) exists fully drafted in source (consts.ts) but is commented out and not served. No custom-attribute extension schemas exist at all.\n","responses":{"200":{"description":"OK.","content":{"application/json":{"schema":{"type":"object"}}}}}}}}} ``` ## GET /Schemas/{id} > Get a single schema by its URN ID ```json {"openapi":"3.0.3","info":{"title":"Tabnine SCIM API","version":"2.0"},"servers":[{"url":"/scim/v2"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"SCIM API key issued via the admin-only auth-service endpoint `POST /organization/idp/scim-key`. Token also encodes `syncMode` (e.g. `UsersAndTeams`), which gates Groups behavior as noted above.\n"}},"responses":{"NotFound":{"description":"Not Found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimError"}}}}},"schemas":{"ScimError":{"description":"RFC 7644 §3.12-compliant error shape (unlike auth-service's own internal error format, which this service translates from).","type":"object","properties":{"schemas":{"type":"array","items":{"type":"string"}},"status":{"type":"string"},"detail":{"type":"string"}}}}},"paths":{"/Schemas/{id}":{"get":{"summary":"Get a single schema by its URN ID","responses":{"200":{"description":"OK.","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.tabnine.com/main/administering-tabnine/managing-your-team/settings/general-settings/idp-sync/tabnine-scim-api.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.