Skip to content
DarkAuth Docs

SCIM API

DarkAuth exposes SCIM endpoints for identity-provider provisioning. SCIM requests use bearer-token authentication with a token created by a write admin.

Admin token endpoints

Section titled “Admin token endpoints”
  • GET /admin/scim/tokens lists SCIM token metadata.
  • POST /admin/scim/tokens creates a token and returns the plaintext bearer token once.
  • DELETE /admin/scim/tokens/{id} revokes a token.

Store the token in the upstream identity provider when it is created. DarkAuth does not reveal the same token again.

Token creation accepts a name and optional expiresAt. Token list responses include metadata such as token prefix, creator, creation time, last-used time, expiry, and revocation time. Use separate tokens for separate identity-provider apps and rotate them independently.

SCIM resource endpoints

Section titled “SCIM resource endpoints”

The SCIM API supports user and group provisioning behavior expected by identity providers:

  • GET /scim/v2/ServiceProviderConfig
  • GET /scim/v2/ResourceTypes
  • GET /scim/v2/Schemas
  • GET /scim/v2/Users
  • POST /scim/v2/Users
  • GET /scim/v2/Users/{id}
  • PUT /scim/v2/Users/{id}
  • PATCH /scim/v2/Users/{id}
  • DELETE /scim/v2/Users/{id}
  • GET /scim/v2/Groups
  • POST /scim/v2/Groups
  • GET /scim/v2/Groups/{id}
  • PATCH /scim/v2/Groups/{id}
  • DELETE /scim/v2/Groups/{id}

Use the OpenAPI document for exact payload shapes and the identity provider’s SCIM mapping controls for field selection.

Supported filter behavior is intentionally narrow. Users support simple filters for id, userName, externalId, displayName, and active. Groups support simple filters for id, externalId, and displayName.

Policy settings

Section titled “Policy settings”

Admin settings control SCIM sign-in and key-management behavior, including provisioned-only sign-in, required key unlock for ZK clients, allowed envelope types, trusted-device approval, deprovisioning behavior, unknown group handling, and group-to-role mappings.

Treat these settings as part of the SCIM integration, not generic UI preferences. They decide whether provisioned users can create local unlock paths and how upstream group state becomes DarkAuth authorization state.

When a user is deactivated through SCIM, pending authorization requests, authorization codes, and server-side session or refresh state for that user are invalidated before stale authorization state can be redeemed.

Security boundary

Section titled “Security boundary”

SCIM bearer tokens can change identity lifecycle state, but they do not grant access to passwords, OPAQUE export keys, recovery keys, passkey PRF output, account root keys, client app keys, or plaintext key envelopes.