Sign in
scim

Create the organisation's SCIM binding for one identity provider.

Changed on

At most one binding per (organisation, provider): the concurrent-create race resolves to one row and the loser is refused with conflict. The subject source and the NameID profile are immutable after creation, and the provider reference is read-only — creating a binding grants no authority over the provider it names. Creating the binding also creates its provisioning connection and that connection's structural scim-provision grant, atomically.

post/api/v1/orgs/{org}/scim-bindings

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/orgs/{org}/scim-bindings
  • Auth: HTTP bearer

Request body

provider_kind'oidc' | 'saml' required
provider_slugstring required
subject_sourcestring required

externalId or a declared enterprise/custom extension path. userName is refused by name: RFC 7643 defines it caseExact: false and server-unique, which contradicts byte-exact identity material.

nameid_formatstring

SAML bindings only. A scalar SCIM attribute cannot carry the locked SAML subject, so the binding declares the NameID PROFILE and the subject-source attribute supplies the NameID value alone.

nameid_qualifierstring
nameid_qualifier_presentboolean

Presence is carried separately from value because an absent qualifier and an empty one are different inputs to the injective encoder, and collapsing them would make two SAML subjects collide.

nameid_sp_qualifierstring
nameid_sp_qualifier_presentboolean

Response

The created binding.

idstring required

A prefixed UUIDv7, e.g. org_0198….

org_idstring required

A prefixed UUIDv7, e.g. org_0198….

provider_kind'oidc' | 'saml' required
provider_slugstring required
provider_issuerstring required

Frozen at creation. A provider whose issuer moved under a binding is a rebinding hazard, not a rename to follow silently.

subject_sourcestring required

The SCIM attribute path carrying identity material, immutable after creation. userName is refused by name.

nameid_formatstring

The SAML NameID profile's Format URI; empty for an OIDC binding.

nameid_qualifierstring

The SAML NameID profile's fixed NameQualifier.

nameid_qualifier_presentboolean

Whether the assertion carries a NameQualifier at all. Presence is reported separately from value because an absent qualifier and an empty one are different inputs to the injective subject encoder.

nameid_sp_qualifierstring

The SAML NameID profile's fixed SPNameQualifier.

nameid_sp_qualifier_presentboolean
connection_principal_idstring required

A prefixed UUIDv7, e.g. org_0198….

last_contact_atstring date-time

RFC 3339 UTC, microsecond precision.

created_atstring date-time required

RFC 3339 UTC, microsecond precision.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status