> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM API: Sync Users and Groups from Your IdP

> The OneCLI SCIM 2.0 endpoint lets Okta, Entra ID, and other identity providers create, update, suspend, and group your members.

SCIM 2.0 lets your identity provider keep the OneCLI directory in sync. When you add, change, or deactivate someone in Okta, Entra ID, or another provider, the change flows to OneCLI automatically.

Your provider authenticates with a [SCIM token](https://onecli.sh/docs/api-reference/scim-tokens). You rarely call these endpoints by hand. For setup, see [User provisioning](https://onecli.sh/docs/guides/user-provisioning.md).

## Related guides

* [User provisioning: set up SCIM](https://onecli.sh/docs/guides/user-provisioning.md)
* [SCIM tokens API reference](https://onecli.sh/docs/api-reference/scim-tokens)

## Endpoints

| Endpoint | Method and path | What it does |
| - | - | - |
| [List users](https://onecli.sh/docs/api-reference/scim/list-users.md) | `GET /Users` | List SCIM users with filtering by userName and paging. |
| [Create a user](https://onecli.sh/docs/api-reference/scim/create-a-user.md) | `POST /Users` | Create a member through SCIM when your identity provider assigns someone to OneCLI. |
| [Get a user](https://onecli.sh/docs/api-reference/scim/get-a-user.md) | `GET /Users/{id}` | Get one SCIM user by ID. |
| [Replace a user](https://onecli.sh/docs/api-reference/scim/replace-a-user.md) | `PUT /Users/{id}` | Replace a SCIM user's full record. |
| [Patch a user](https://onecli.sh/docs/api-reference/scim/patch-a-user.md) | `PATCH /Users/{id}` | Patch a SCIM user with an RFC 7644 PatchOp. |
| [Delete a user](https://onecli.sh/docs/api-reference/scim/delete-a-user.md) | `DELETE /Users/{id}` | Delete a SCIM user with reversible offboarding. |
| [List groups](https://onecli.sh/docs/api-reference/scim/list-groups.md) | `GET /Groups` | List SCIM groups with filtering by displayName or externalId and paging, so your identity provider can match its groups to OneCLI. |
| [Create a group](https://onecli.sh/docs/api-reference/scim/create-a-group.md) | `POST /Groups` | Create a SCIM-sourced directory group when your identity provider pushes a group, ready to map to a role in OneCLI. |
| [Get a group](https://onecli.sh/docs/api-reference/scim/get-a-group.md) | `GET /Groups/{id}` | Get one SCIM group by ID, including its members, so your identity provider can reconcile group membership with OneCLI. |
| [Replace a group](https://onecli.sh/docs/api-reference/scim/replace-a-group.md) | `PUT /Groups/{id}` | Replace a SCIM group's name and its full member set in one call. |
| [Patch a group](https://onecli.sh/docs/api-reference/scim/patch-a-group.md) | `PATCH /Groups/{id}` | Patch a SCIM group with an RFC 7644 PatchOp. |
| [Delete a group](https://onecli.sh/docs/api-reference/scim/delete-a-group.md) | `DELETE /Groups/{id}` | Delete a SCIM group when your identity provider removes it. |
| [Service provider configuration](https://onecli.sh/docs/api-reference/scim/service-provider-configuration.md) | `GET /ServiceProviderConfig` | Discover which SCIM features OneCLI supports, such as patch, filter, and bulk. |

## Next steps

* [API overview](https://onecli.sh/docs/api-reference.md): base URLs, authentication, and pagination
* [Errors](https://onecli.sh/docs/api-reference/errors.md): status codes and the error format
* [Editions](https://onecli.sh/docs/api-reference/editions.md): which endpoints each edition serves


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.