Skip to content
Authrim

Replace a SCIM user.

PUT
/scim/v2/Users/{id}

Changes to userName or the mapped primary email use the durable identifier replacement workflow. Identifier reservation conflicts return 409; retryable directory convergence failures return 503.

The assurance extension replaces the claim of the authenticating token for the user (its ial within the tenant’s ceiling for SCIM, assurance.scim_max_ial: above it the request is refused with 400 invalidValue before anything is written, and 503 when the ceiling cannot be read); a replacement without it withdraws that token’s claim (evidence of other sources, such as another token, an administrator or the tenant default, is untouched). An extension that is not valid, or names a date or time that does not exist, is refused with 400 invalidValue. Evidence changes only after the user was written: a request refused or failed before that (409, 412) changes none, and if the evidence step fails afterwards the response is 500 and the same request is sent again. Evidence is identified by its content (token, ial, verifiedAt, expiresAt), also when it is made at creation: identical content never re-activates a revoked claim, whoever revoked it (an administrator, or this client by sending the user without the extension); a new verification (another verifiedAt, ial or expiresAt) is new evidence. The user’s version (ETag) moves with any change of its evidence.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
id
required
string

Header Parameters

Section titled “Header Parameters ”
If-Match
string

Optional ETag precondition for replace, patch, or delete operations.

Request Body required

Section titled “Request Body required ”
object
schemas
required
Array<string>
id
string
externalId

Source-system correlation identifier. Authrim does not require uniqueness.

string
userName
required

Tenant-wide, case-insensitive unique SCIM login identifier.

string
>= 1 characters
name
object
formatted
string
familyName
string
givenName
string
middleName
string
honorificPrefix
string
honorificSuffix
string
key
additional properties
displayName
string
nickName
string
profileUrl
string format: uri
title
string
userType
string
preferredLanguage
string
locale
string
timezone
string
active
boolean
password

Unsupported by Authrim SCIM provisioning. Requests that include this field are rejected with 400 invalidValue; use Passkey, Email Code, Directory Connector, or External IdP authentication instead.

string
emails
Array<object>
object
value
required
string format: email
type
string
primary
boolean
display
string
key
additional properties
phoneNumbers
Array<object>
object
value
required
string
type
string
primary
boolean
key
additional properties
addresses
Array<object>
object
formatted
string
streetAddress
string
locality
string
region
string
postalCode
string
country
string
type
string
primary
boolean
key
additional properties
groups
Array<object>
object
value
required
string
$ref
string format: uri
type
string
Allowed values: User Group
display
string
key
additional properties
urn:authrim:params:scim:schemas:extension:assurance:1.0:User

The identity assurance level the provisioning client asserts for the user (NIST SP 800-63A). Each token replaces its own claim. An absent or null extension is no claim.

object
ial
required

Not above the highest level the tenant accepts from SCIM (assurance.scim_max_ial, IAL1 until the tenant raises it); a higher level is refused with 400 invalidValue and nothing is written.

string
Allowed values: IAL1 IAL2 IAL3
verifiedAt
required

When the identity was proofed. Required, with a time zone; not in the future.

string format: date-time
expiresAt

When the claim lapses, after verifiedAt. A time already past is accepted (the claim then counts for nothing), so a user whose claim lapsed can still be updated.

string format: date-time
key
additional properties
meta
object
resourceType
string
Allowed values: User Group
created
string format: date-time
lastModified
string format: date-time
location
string format: uri
version
string
key
additional properties
key
additional properties

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Successful SCIM JSON response.

object
schemas
Array<string>
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ]
}

400

Section titled “400 ”

SCIM error response.

Media type application/scim+json
object
schemas
Array<string>
status
string
scimType
string
detail
string
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ],
  "status": "example",
  "scimType": "example",
  "detail": "example"
}

409

Section titled “409 ”

SCIM error response.

Media type application/scim+json
object
schemas
Array<string>
status
string
scimType
string
detail
string
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ],
  "status": "example",
  "scimType": "example",
  "detail": "example"
}

412

Section titled “412 ”

SCIM error response.

Media type application/scim+json
object
schemas
Array<string>
status
string
scimType
string
detail
string
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ],
  "status": "example",
  "scimType": "example",
  "detail": "example"
}

503

Section titled “503 ”

SCIM error response.

Media type application/scim+json
object
schemas
Array<string>
status
string
scimType
string
detail
string
key
additional properties
Example generated
{
  "schemas": [
    "example"
  ],
  "status": "example",
  "scimType": "example",
  "detail": "example"
}