Supported SCIM 2.0 operations

/ServiceProviderConfig

Description

Obtains the features that are supported by CloudSSO.

Limits

No authentication is required.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/ServiceProviderConfig -H "Content-type:application/json"

Sample response

{
  "authenticationSchemes": [
    {
      "description": "Authentication scheme using the OAuth Bearer Token Standard",
      "name": "OAuth Bearer Token",
      "primary": true,
      "type": "oauthbearertoken"
    }
  ],
  "bulk": {
    "maxOperations": 0,
    "maxPayloadSize": 0,
    "supported": false
  },
  "changePassword": {
    "supported": false
  },
  "etag": {
    "supported": false
  },
  "filter": {
    "maxResults": 1000,
    "supported": false
  },
  "patch": {
    "supported": true
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
  ],
  "sort": {
    "supported": false
  }
}

The response indicates:

• Supported: patch.

• Not supported: bulk, changePassword, sort, etag, and filter.

/ResourceTypes

Description

Obtains the resource types that are supported by CloudSSO. The details of users and user groups are returned.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/ResourceTypes --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json"

Sample response

{
  "Resources": [
    {
      "description": "Group",
      "endpoint": "/Groups",
      "id": "Group",
      "meta": {
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/ResourceTypes/Group",
        "resourceType": "ResourceType"
      },
      "name": "Group",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:Group",
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
      ]
    },
    {
      "description": "User Account",
      "endpoint": "/Users",
      "id": "User",
      "meta": {
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/ResourceTypes/User",
        "resourceType": "ResourceType"
      },
      "name": "User",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
      "schemaExtensions": [
        {
          "required": false,
          "schema": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
        }
      ],
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
      ]
    }
  ],
  "itemsPerPage": 10,
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "startIndex": 1,
  "totalResults": 2
}

/Schemas

Description

Obtains the schemas that are supported by CloudSSO. The schemas of users and user groups are returned.

Limits

• Supports query by resource type.

• SCIM 2.0 field names and values are case-insensitive.

• Only the fields in the following sample response are supported.

Sample request

The schema to request all resources.
    curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json"
The schema to request users.
    curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json"
The schema to request user groups.
    curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json"

Sample response

Schema to request users

{
  "attributes": [
    {
      "caseExact": true,
      "description": "A Boolean value indicating the User's administrative status.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "active",
      "required": false,
      "returned": "default",
      "type": "boolean",
      "uniqueness": "none"
    },
    {
      "caseExact": false,
      "description": "The name of the User, suitable for display to end-users. The name SHOULD be the full name of the User being described if known.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "displayName",
      "required": false,
      "returned": "default",
      "type": "string",
      "uniqueness": "none"
    },
    {
      "caseExact": true,
      "description": "E-mail addresses for the user. The value SHOULD be canonicalized by the Service Provider, e.g., bjensen@example.com instead of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and other.",
      "multiValued": true,
      "mutability": "readWrite",
      "name": "emails",
      "required": false,
      "returned": "default",
      "subAttributes": [
        {
          "caseExact": false,
          "description": "A human readable name, primarily used for display purposes.",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "display",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": true,
          "description": "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g., the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "primary",
          "required": false,
          "returned": "default",
          "type": "boolean",
          "uniqueness": "none"
        },
        {
          "canonicalValues": [
            "other",
            "work",
            "home"
          ],
          "caseExact": false,
          "description": "A label indicating the attribute's function; e.g., 'work' or 'home'.",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "type",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": false,
          "description": "E-mail addresses for the user. The value\nSHOULD be canonicalized by the Service Provider, e.g.\nbjensen@example.com instead of bjensen@EXAMPLE.COM. Canonical Type\nvalues of work, home, and other.",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "value",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        }
      ],
      "type": "complex",
      "uniqueness": "none"
    },
    {
      "caseExact": true,
      "description": "The components of the user's real name.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "name",
      "required": false,
      "returned": "default",
      "subAttributes": [
        {
          "caseExact": false,
          "description": "The family name of the User, or Last Name in most Western languages (for example, Jensen given the full name Ms. Barbara J Jensen, III.).",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "familyName",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": false,
          "description": "The given name of the User, or First Name in most Western languages (for example, Barbara given the full name Ms. Barbara J Jensen, III.).",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "givenName",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": false,
          "description": "The middle name(s) of the User (for example, Robert given the full name Ms. Barbara J Jensen, III.).",
          "multiValued": false,
          "mutability": "readWrite",
          "name": "middleName",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        }
      ],
      "type": "complex",
      "uniqueness": "none"
    },
    {
      "caseExact": false,
      "description": "Unique identifier for the User typically used by the user to directly authenticate to the service provider.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "userName",
      "required": true,
      "returned": "default",
      "type": "string",
      "uniqueness": "server"
    }
  ],
  "description": "User Account",
  "endpoint": "/Users",
  "extensionSchemas": [
    {
      "required": false,
      "schema": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
    }
  ],
  "id": "urn:ietf:params:scim:schemas:core:2.0:User",
  "meta": {
    "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User",
    "resourceType": "Schema"
  },
  "name": "User",
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Schema"
  ]
}

Schema to request user groups

{
  "attributes": [
    {
      "caseExact": false,
      "description": "A human-readable name for the Group.",
      "multiValued": false,
      "mutability": "readWrite",
      "name": "displayName",
      "required": true,
      "returned": "default",
      "type": "string",
      "uniqueness": "server"
    },
    {
      "caseExact": true,
      "description": "A list of members of the Group.",
      "multiValued": true,
      "mutability": "readWrite",
      "name": "members",
      "required": false,
      "returned": "default",
      "subAttributes": [
        {
          "caseExact": false,
          "description": "A human readable name, primarily used for display purposes.",
          "multiValued": false,
          "mutability": "immutable",
          "name": "display",
          "required": false,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        },
        {
          "caseExact": true,
          "description": "The URI of the member resource.",
          "multiValued": false,
          "mutability": "immutable",
          "name": "ref",
          "referenceTypes": [
            "User"
          ],
          "required": true,
          "returned": "default",
          "type": "reference",
          "uniqueness": "none"
        },
        {
          "caseExact": false,
          "description": "The identifier of a group member.",
          "multiValued": false,
          "mutability": "immutable",
          "name": "value",
          "required": true,
          "returned": "default",
          "type": "string",
          "uniqueness": "none"
        }
      ],
      "type": "complex",
      "uniqueness": "none"
    }
  ],
  "description": "Group",
  "endpoint": "/Groups",
  "id": "urn:ietf:params:scim:schemas:core:2.0:Group",
  "meta": {
    "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group",
    "resourceType": "Schema"
  },
  "name": "Group",
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Schema"
  ]
}

POST /Users

Description

Synchronizes users.

Limits

• Only fields defined in the "/Schemas" section are supported.

• If a manually created user in CloudSSO has the same username as a user in your IdP, the SCIM-synchronized user replaces the existing user.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X POST -d '<data>'

Example data field:

{
    "displayName": "<user display name>",
    "emails": [
        {
            "primary": true,
            "type": "work",
            "value": "<user email>"
        }
    ],
    "externalId": "<external Id>",
    "name": {
        "familyName": "<user family name>",
        "givenName": "<user given name>"
    },
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
    "userName": "<user name>"
}

Sample response

{
    "active": true,
    "displayName": "<user display name>",
    "emails":
    [
        {
            "primary": true,
            "type": "work",
            "value": "<user email>"
        }
    ],
    "externalId": "<external Id>",
    "id": "u-00vrs1l19d6gbsi5****",
    "meta":
    {
        "created": "2023-08-01T13:16:30.000Z",
        "lastModified": "2023-08-01T13:16:30.000Z",
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/u-00vrs1l19d6gbsi5****",
        "resourceType": "User"
    },
    "name":
    {
        "familyName": "<user family name>",
        "givenName": "<user given name>"
    },
    "schemas":
    [
        "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
    "userName": "<user name>"
}

GET /Users/{id} and GET /Users

Description

• GET /Users/{id}: queries a user.

• GET /Users: queries specific users or all users.

Limits

• If you specify the id parameter, the specified user is returned. If the ID does not match an existing user, the request is rejected.

• If you omit the id parameter and specify the filter parameter, matching users are returned. The filter supports only the externalId and userName fields with the eq and operators.

• If you omit both the id and filter parameters, all users are returned. Pagination follows the SCIM 2.0 standard. Maximum 100 entries per page.

• Only SCIM-synchronized users can be queried.

Example 1: Query a user

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X GET

Sample response

{
    "active": true,
    "displayName": "<user display name>",
    "emails":
    [
        {
            "primary": true,
            "type": "work",
            "value": "<user email>"
        }
    ],
    "externalId": "<external Id>",
    "id": "u-00vrs1l19d6gbsi5****",
    "meta":
    {
        "created": "2023-08-01T13:16:30.000Z",
        "lastModified": "2023-08-01T13:16:30.000Z",
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/u-00vrs1l19d6gbsi5****",
        "resourceType": "User"
    },
    "name":
    {
        "familyName": "<user family name>",
        "givenName": "<user given name>"
    },
    "schemas":
    [
        "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
    "userName": "<user name>"
}

Example 2: Query the information about specific users or query all users

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users<?parameters> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X GET

Supported parameters:

Sample response

{
    "Resources":
    [
        {
            "active": true,
            "displayName": "<user display name>",
            "emails":
            [
                {
                    "primary": true,
                    "type": "work",
                    "value": "<user email>"
                }
            ],
            "externalId": "external****",
            "id": "u-0015b4962vrywtzb****",
            "meta":
            {
                "created": "2023-07-07T17:21:07.000Z",
                "lastModified": "2023-07-07T17:21:07.000Z",
                "resourceType": "User"
            },
            "name":
            {
                "familyName": "<user family name>",
                "givenName": "<user given name>"
            },
            "schemas":
            [
                "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName": "<user name>"
        },
        {
            "active": true,
            "displayName": "<user display name>",
            "emails":
            [
                {
                    "primary": true,
                    "type": "work",
                    "value": "<user email>"
                }
            ],
            "externalId": "<external Id>",
            "id": "u-00vrs1l19d6gbsi5****",
            "meta":
            {
                "created": "2023-08-01T13:16:30.000Z",
                "lastModified": "2023-08-01T13:16:30.000Z",
                "resourceType": "User"
            },
            "name":
            {
                "familyName": "<user family name>",
                "givenName": "<user given name>"
            },
            "schemas":
            [
                "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName": "<user name>"
        }
    ],
    "itemsPerPage": 10,
    "schemas":
    [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "startIndex": 1,
    "totalResults": 2
}

PUT /Users/{id} and PATCH /Users/{id}

Description

• PUT /Users/{id}: replaces a user's information.

• PATCH /Users/{id}: partially updates a user's information.

Limits

• The id parameter is required. Only fields defined in the "/Schemas" section can be modified.

• PUT overwrites all attributes.

• PATCH supports Add, Replace, and Remove operations.

• Only SCIM-synchronized users can be modified.

Sample request

Replace the information about a user (PUT)

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X PUT -d '<data>'

Example data field:

{
    "active": false,
    "externalId": "<external Id>",
    "id": "<user id>",
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
    "userName": "<user name>"
}

Update the information about a user (PATCH)

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X PATCH -d '<data>'

Example data field:

// The Remove operation.
{
    "Operations": [
        {
            "op": "remove",
            "path": "displayName"
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}
// The Replace operation.
{
    "Operations": [
        {
            "op": "replace",
            "path": "",
            "value": {
                "active": false,
                "displayName": "displayName",
                "name": {
                    "familyName": "familyName",
                    "givenName": "givenName"
                }
            }
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}
// The Add operation.
{
    "Operations": [
        {
            "op": "add",
            "path": "",
            "value": {
                "displayName": "displayName",
                "name": {
                    "familyName": "familyName",
                    "givenName": "givenName"
                }
            }
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}

DELETE /Users/{id}

Description

Deletes a user.

Limits

• The id parameter is required.

• Only SCIM-synchronized users can be deleted.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X DELETE

POST /Groups

Description

Synchronizes a user group.

Limits

• Field limits follow the "/Schemas" section.

• If a manually created user group in CloudSSO has the same name as a group in your IdP, the SCIM-synchronized group replaces the existing group.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X POST -d '<data>'

Example data field:

{
    "displayName": "<group name>",
    "externalId": "<external Id>",
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}

Sample response

{
    "displayName": "<group name>",
    "externalId": "<external Id>",
    "id": "g-00nqnd7hoevd1unv****",
    "members":
    [],
    "meta":
    {
        "created": "2023-08-01T13:30:23.000Z",
        "lastModified": "2023-08-01T13:30:23.000Z",
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/g-00nqnd7hoevd1unv****",
        "resourceType": "Group"
    },
    "schemas":
    [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}

GET /Groups/{id} and GET /Groups

Description

• GET /Groups/{id}: queries a user group.

• GET /Groups: queries specific user groups or all user groups.

Limits

• Use the id or filter parameter to narrow results.

• The filter supports only the externalId and displayName fields with the eq and operators.

• With the id parameter, the specified user group and its members are returned. If the ID does not match an existing group, the request is rejected.

• Without the id or filter parameter, all user groups are returned without member details. Pagination follows the SCIM 2.0 standard. Maximum 100 entries per page.

• Only SCIM-synchronized user groups can be queried.

Example 1: Query a user group

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/<groupId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X GET

Sample response

{
    "displayName": "<group name>",
    "externalId": "<external Id>",
    "id": "g-00nqnd7hoevd1unv****",
    "members":
    [
        {
            "$ref": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/u-00vrs1l19d6gbsi5****",
            "display": "",
            "value": "u-00vrs1l19d6gbsi5****"
        }
    ],
    "meta":
    {
        "created": "2023-08-01T13:30:23.000Z",
        "lastModified": "2023-08-01T13:30:23.000Z",
        "location": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/g-00nqnd7hoevd1unv****",
        "resourceType": "Group"
    },
    "schemas":
    [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}

Example 2: Query the information about specific user groups or query all user groups

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups<?parameters> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X GET

Supported parameters:

Sample response

{
    "Resources":
    [
        {
            "displayName": "<group name>",
            "externalId": "<external Id>",
            "id": "g-00nqnd7hoevd1unv****",
            "members":
            [],
            "meta":
            {
                "created": "2023-08-01T13:30:23.000Z",
                "lastModified": "2023-08-01T13:30:23.000Z",
                "resourceType": "Group"
            },
            "schemas":
            [
                "urn:ietf:params:scim:schemas:core:2.0:Group"
            ]
        }
    ],
    "itemsPerPage": 10,
    "schemas":
    [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "startIndex": 1,
    "totalResults": 1
}

PUT /Groups/{id} and PATCH /Groups/{id}

Description

• PUT /Groups/{id}: replaces a user group's information.

• PATCH /Groups/{id}: partially updates a user group's information.

Limits

• The id parameter is required. Only fields defined in the "/Schemas" section can be modified.

• PUT overwrites all attributes, including group membership.

• PATCH supports Add, Replace, and Remove operations.

• Only SCIM-synchronized user groups can be modified.

Sample request

Replace the information about a user group (PUT)

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/<groupId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X PUT -d '<data>'

Example data field:

{
    "displayName": "<group name>",
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}

Update the information about a user group (PATCH)

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/<groupId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X PATCH -d '<data>'

Example data field:

// Remove the specified user <userId> from the user group <groupId>.
{
    "Operations": [
        {
            "op": "remove",
            "path": "members",
            "value": [
                {
                    "value": "<userId>"
                }
            ]
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}
// Remove all users from the user group <groupId>.
{
    "Operations": [
        {
            "op": "remove",
            "path": "members"
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}
// Add three users to the user group <groupId>.
{
    "Operations": [
        {
            "op": "add",
            "path": "members",
            "value": [
                {
                    "$ref": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId1>",
                    "display": "<userName1>",
                    "value": "<userId1>"
                },
                {
                    "$ref": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId2>",
                    "display": "<userName2>",
                    "value": "<userId2>"
                },
                {
                    "$ref": "https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Users/<userId3>",
                    "display": "<userName3>",
                    "value": "<userId3>"
                }
            ]
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}

DELETE /Groups/{id}

Description

Deletes a user group.

Limits

• The id parameter is required.

• Deleting a user group removes all members from the group.

• Only SCIM-synchronized user groups can be deleted.

Sample request

curl https://cloudsso-scim-<regionId>.aliyun.com/scim/v2/Groups/<groupId> --header 'Authorization: Bearer <your scim credential>' --header "content-type:application/json" -X DELETE