Skip to content
Authrim

Create a SCIM user.

POST
/scim/v2/Users

Creates the account through the tenant directory publication workflow. Idempotency-Key is optional for SCIM client compatibility; when omitted, Authrim derives a stable key from the authenticated provisioning token and canonical request body. Returns 202 with an operation Location when directory publication continues asynchronously. userName is unique within the tenant using case-insensitive comparison; externalId is not unique. Capacity provisioning and runtime binding propagation return retryable 503 responses.

The identity assurance of the new account is what the request’s assurance extension (urn:authrim:params:scim:schemas:extension:assurance:1.0:User) asserts, recorded as SCIM evidence of the authenticating token. Without the extension, the tenant’s default IAL (assurance.default_ial) is recorded as tenant-policy evidence when it is IAL2 or IAL3; when it cannot be read the account is not created (retryable 503). The extension’s ial may not be above the tenant’s ceiling for SCIM (assurance.scim_max_ial, IAL1 until raised): a higher level is refused with 400 invalidValue and the user is not created. The ceiling does not apply to the default IAL.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Header Parameters

Section titled “Header Parameters ”
Idempotency-Key
string
>= 8 characters <= 128 characters

Stable replay-protection key for one user creation request. Omit to use Authrim’s deterministic SCIM request key; send a new explicit value to intentionally recreate an otherwise identical resource after deletion.

Request Body required

Section titled “Request Body required ”
object
schemas
required
Array<string>
id
string
externalId

Source-system correlation identifier. Authrim does not require uniqueness.

string
userName
required

Tenant-wide, case-insensitive unique SCIM login identifier.

string
>= 1 characters
name
object
formatted
string
familyName
string
givenName
string
middleName
string
honorificPrefix
string
honorificSuffix
string
key
additional properties
displayName
string
nickName
string
profileUrl
string format: uri
title
string
userType
string
preferredLanguage
string
locale
string
timezone
string
active
boolean
password

Unsupported by Authrim SCIM provisioning. Requests that include this field are rejected with 400 invalidValue; use Passkey, Email Code, Directory Connector, or External IdP authentication instead.

string
emails
Array<object>
object
value
required
string format: email
type
string
primary
boolean
display
string
key
additional properties
phoneNumbers
Array<object>
object
value
required
string
type
string
primary
boolean
key
additional properties
addresses
Array<object>
object
formatted
string
streetAddress
string
locality
string
region
string
postalCode
string
country
string
type
string
primary
boolean
key
additional properties
groups
Array<object>
object
value
required
string
$ref
string format: uri
type
string
Allowed values: User Group
display
string
key
additional properties
urn:authrim:params:scim:schemas:extension:assurance:1.0:User

The identity assurance level the provisioning client asserts for the user (NIST SP 800-63A). Each token replaces its own claim. An absent or null extension is no claim.

object
ial
required

Not above the highest level the tenant accepts from SCIM (assurance.scim_max_ial, IAL1 until the tenant raises it); a higher level is refused with 400 invalidValue and nothing is written.

string
Allowed values: IAL1 IAL2 IAL3
verifiedAt
required

When the identity was proofed. Required, with a time zone; not in the future.

string format: date-time
expiresAt

When the claim lapses, after verifiedAt. A time already past is accepted (the claim then counts for nothing), so a user whose claim lapsed can still be updated.

string format: date-time
key
additional properties
meta
object
resourceType
string
Allowed values: User Group
created
string format: date-time
lastModified
string format: date-time
location
string format: uri
version
string
key
additional properties
key
additional properties

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Successful SCIM JSON response.

object
schemas
Array<string>
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ]
}

202

Section titled “202 ”

Durable account creation operation state.

Media type application/scim+json
object
schemas
required
array
id
required
string
status
required
string
Allowed values: preparing reserved writing directory_pending succeeded blocked canceled
operationId
required
string
userId
string
resourceLocation
string format: uri
meta
required
object
resourceType
string
Allowed values: User Group
created
string format: date-time
lastModified
string format: date-time
location
string format: uri
version
string
key
additional properties
key
additional properties
Example 
{
  "status": "preparing",
  "meta": {
    "resourceType": "User"
  }
}

Headers

Section titled “Headers ”
Location
string

Operation status URL when returned by POST /Users.

400

Section titled “400 ”

SCIM error response.

Media type application/scim+json
object
schemas
Array<string>
status
string
scimType
string
detail
string
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ],
  "status": "example",
  "scimType": "example",
  "detail": "example"
}

409

Section titled “409 ”

SCIM error response.

Media type application/scim+json
object
schemas
Array<string>
status
string
scimType
string
detail
string
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ],
  "status": "example",
  "scimType": "example",
  "detail": "example"
}

503

Section titled “503 ”

Account capacity or a newly deployed runtime database binding is unavailable.

Media type application/scim+json
object
schemas
Array<string>
status
string
scimType
string
detail
string
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ],
  "status": "example",
  "scimType": "example",
  "detail": "example"
}

Headers

Section titled “Headers ”
Retry-After
integer
>= 1
Example 
1

Minimum suggested delay before retrying the same request, in seconds.