SCIM Provisioning
Instead of asking admins to create accounts by hand, Modulo accepts provisioning calls from your identity provider. The System for Cross-domain Identity Management (SCIM) 2.0 protocol defines the user and group payloads; the identity provider stays the source of truth for who is active and which team they belong to.
- SCIM Users become Modulo User accounts
- SCIM Groups become Modulo Teams with membership
- Requests authenticate with a shared Bearer token (
MODULO_SCIM_TOKEN) - Gated by
MODULO_LICENSE_KEY(Team tier)
Endpoints
| Endpoint | Description |
|---|---|
POST /scim/v2/Users |
Create user |
GET /scim/v2/Users |
List users (paginated) |
GET /scim/v2/Users/{id} |
Get user by ID |
PUT /scim/v2/Users/{id} |
Update user attributes |
PATCH /scim/v2/Users/{id} |
Partial user update |
DELETE /scim/v2/Users/{id} |
Deactivate user |
POST /scim/v2/Groups |
Create group |
GET /scim/v2/Groups |
List groups |
GET /scim/v2/Groups/{id} |
Get group by ID |
PUT /scim/v2/Groups/{id} |
Update group |
PATCH /scim/v2/Groups/{id} |
Partial group update |
DELETE /scim/v2/Groups/{id} |
Delete group |
All SCIM endpoints require the Authorization: Bearer <MODULO_SCIM_TOKEN> header and a valid license key.
Related
- Configuration: environment variables including
MODULO_SCIM_TOKEN - Secrets: credential encryption and the SCIM bearer token
- Single Sign-On (SSO): identity provider login and group to team mappings