SCIM

Sync users and groups from Okta, Entra ID or another directory with SCIM 2.0, so people get a Fob account when they join and are disabled when they leave.

Permission

Creating a SCIM token needs Manage API keys and webhooks.

Set up Okta

1. In the Fob console, open People > Provisioning, choose Create SCIM token, and copy the base URL and token.

2. In the Okta Admin Console, open the app integration for Fob. On its General tab, set Provisioning to SCIM and save.

3. On the Provisioning tab, under Integration, choose Edit and enter:

   Okta field	Value
   SCIM connector base URL	https://acme.fobauth.com/scim/v2
   Unique identifier field for users	userName
   Supported provisioning actions	Push New Users, Push Profile Updates, Push Groups
   Authentication Mode	HTTP Header
   Authorization	The SCIM token

4. Choose Test Connector Configuration, then save.

5. Under To App, turn on Create Users, Update User Attributes and Deactivate Users. Leave Sync Password off: Fob ignores passwords sent over SCIM.

6. Assign people and groups to the app, and push the groups you want in Fob from the Push Groups tab.

Deactivating someone in Okta disables their Fob account.

Set up Entra ID

1. In the Fob console, open People > Provisioning, choose Create SCIM token, and copy the base URL and token.

2. In the Microsoft Entra admin center, open Enterprise applications and the application for Fob, or create a non-gallery application.

3. Open Provisioning, set Provisioning Mode to Automatic, and under Admin Credentials enter:

   Entra field	Value
   Tenant URL	https://acme.fobauth.com/scim/v2
   Secret Token	The SCIM token

4. Choose Test Connection, then save.

5. Keep the default user mapping. Fob uses userName, active, emails[type eq "work"].value, displayName, name.givenName, name.familyName and externalId.

6. If you provision groups, keep displayName, externalId and members in the group mapping.

7. Assign users and groups to the application, set Provisioning Status to On, and save.

Group names

Fob group names can only contain letters, digits, spaces, hyphens, underscores, dots and colons, up to 100 characters. Groups with other characters fail to provision. Rename them in your directory first.

How provisioned users work

• Their email counts as confirmed, including after SCIM changes it.
• They have no password. They sign in through your identity provider, or set a password with Forgot password on the sign-in page.
• Setting active to false disables the account and signs the user out. DELETE deletes the account.
• Every SCIM change appears in the audit log under the token's name, and is sent as a webhook.

The built-in Everyone group isn't visible over SCIM.

Reference

A SCIM token is an API key with only the scim scope. Any API key with that scope works.

Base URL: https://acme.fobauth.com/scim/v2. Every endpoint, including discovery, needs the token as a bearer token. Responses are application/scim+json.

Method	Path
GET	/ServiceProviderConfig, /ResourceTypes, /ResourceTypes/{name}, /Schemas, /Schemas/{id}
GET, POST	/Users, /Groups
GET, PUT, PATCH, DELETE	/Users/{id}, /Groups/{id}
POST	/Users/.search, /Groups/.search, /.search

Supported features

Feature	Support
PATCH	add, remove and replace, with or without a path
Filters	eq only. Users by userName, externalId or emails.value. Groups by displayName or externalId.
Paging	startIndex and count. 100 per page by default, up to 200, or 50 for groups with their members.
attributes, excludedAttributes	Yes. Use excludedAttributes=members to list groups faster.
Bulk, sorting, ETags, password changes	No

Each request applies in full or not at all. A request that fails partway changes nothing.

User attributes

SCIM attribute	In Fob
userName	Required and unique, ignoring case
emails	The primary email, or the first one. Without any, userName is used.
name.formatted or displayName	Display name. Without either, given and family names joined.
name.givenName, name.familyName	Sent to apps as given_name and family_name. Up to 200 characters each.
externalId	Stored as sent. Up to 255 characters.
active	false disables the account. Strings "True" and "False" work too, as Entra sends them. A PUT without active leaves it unchanged.
groups	Read-only. Change membership through Groups.

Fob accepts and ignores standard attributes it doesn't store, such as title, phoneNumbers and the enterprise extension. A PATCH that removes emails or userName is refused, since every account needs both.

Group attributes

SCIM attribute	In Fob
displayName	Required. The group name.
externalId	Stored as sent. Up to 255 characters, unique among groups.
members	Each value is a Fob user ID. A group lists its first 1,000 members.

To remove one member, PATCH with a path like members[value eq "0193f3c4-a1b2-7c7e-9d0e-5b3f8a6c2d41"]. One request can change up to 1,000 members and carry up to 1,000 operations. Split larger changes across requests.

Errors

Errors use SCIM's format, with a scimType such as invalidFilter, invalidValue, invalidPath, mutability or uniqueness.

Status	When
404	No resource with that ID
409 uniqueness	Another resource already has that userName, email or externalId
429	Too many requests. See Rate limits.