Provisioning

Inbound SCIM 2.0 provisioning and connector management (PROV-001..PROV-009, PROV-018). 20 operations

Expand an endpoint for authentication, parameters, request fields and responses.

GET/api/v1/realms/{realm}/scim/v2/ServiceProviderConfig+

SCIM service provider configuration

Advertises exactly what is implemented: PATCH, filtering and ETags; no bulk, sort or password change (PROV-009).

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimServiceProviderConfig · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/scim/v2/ResourceTypes+

SCIM resource types

Resource types the connector may use.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`totalResults`	integer	Yes
`startIndex`	integer	—
`itemsPerPage`	integer	—
`Resources`	array	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimResourceTypes · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/scim/v2/Schemas+

SCIM schemas

Attributes stored for Users and Groups; other attributes are accepted and ignored.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`totalResults`	integer	Yes
`startIndex`	integer	—
`itemsPerPage`	integer	—
`Resources`	array	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimSchemas · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/scim/v2/Users+

List SCIM users

Lists users provisioned by this connector in its organization. Supports filter (eq, ne, co, sw, ew, gt, ge, lt, le, pr, and, or, not, value paths), startIndex, count (at most 200), attributes and excludedAttributes.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`filter`	query	—	RFC 7644 filter expression. `{"type":"string"}`
`startIndex`	query	—	`{"type":"integer","minimum":1}`
`count`	query	—	`{"type":"integer","minimum":0,"maximum":200}`
`attributes`	query	—	Comma-separated attributes to return. `{"type":"string"}`
`excludedAttributes`	query	—	Comma-separated attributes to omit. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`totalResults`	integer	Yes
`startIndex`	integer	—
`itemsPerPage`	integer	—
`Resources`	array	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimListUsers · Schema definitions · OpenAPI contract

POST/api/v1/realms/{realm}/scim/v2/Users+

Create a SCIM user

Provisions an account in the connector organization. An existing account is adopted only when its verified email is in a domain the organization has verified, and never when it is protected, privileged or mapped to another external ID (PROV-002, PROV-004).

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Request body

application/scim+json · required

Field	Type	Required	Description
`schemas`	array	—
`userName`	string	Yes
`externalId`	string	—
`displayName`	string	—
`name`	object	—
`emails`	array	—
`active`	boolean	—	Membership state in the connector organization.

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "userName": {
      "type": "string"
    },
    "externalId": {
      "type": "string"
    },
    "displayName": {
      "type": "string"
    },
    "name": {
      "type": "object",
      "properties": {
        "givenName": {
          "type": "string"
        },
        "familyName": {
          "type": "string"
        }
      }
    },
    "emails": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string"
          },
          "type": {
            "type": "string"
          },
          "primary": {
            "type": "boolean"
          }
        }
      }
    },
    "active": {
      "type": "boolean",
      "description": "Membership state in the connector organization."
    }
  },
  "required": [
    "userName"
  ]
}

application/json · required

Field	Type	Required	Description
`schemas`	array	—
`userName`	string	Yes
`externalId`	string	—
`displayName`	string	—
`name`	object	—
`emails`	array	—
`active`	boolean	—	Membership state in the connector organization.

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "userName": {
      "type": "string"
    },
    "externalId": {
      "type": "string"
    },
    "displayName": {
      "type": "string"
    },
    "name": {
      "type": "object",
      "properties": {
        "givenName": {
          "type": "string"
        },
        "familyName": {
          "type": "string"
        }
      }
    },
    "emails": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string"
          },
          "type": {
            "type": "string"
          },
          "primary": {
            "type": "boolean"
          }
        }
      }
    },
    "active": {
      "type": "boolean",
      "description": "Membership state in the connector organization."
    }
  },
  "required": [
    "userName"
  ]
}

Responses

201 Created

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "description": "Weak entity tag of the resource version.",
    "schema": {
      "type": "string"
    }
  },
  "Location": {
    "description": "URL of the created resource.",
    "schema": {
      "type": "string"
    }
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimCreateUser · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/scim/v2/Users/{id}+

Get a SCIM user

Returns a user provisioned by this connector.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`attributes`	query	—	Comma-separated attributes to return. `{"type":"string"}`
`excludedAttributes`	query	—	Comma-separated attributes to omit. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "description": "Weak entity tag of the resource version.",
    "schema": {
      "type": "string"
    }
  }
}

304 Not Modified (If-None-Match matched the current ETag).

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimGetUser · Schema definitions · OpenAPI contract

PUT/api/v1/realms/{realm}/scim/v2/Users/{id}+

Replace a SCIM user

Replaces the user. Identity attributes change only on accounts this connector owns; active maps to the organization membership state, never the account state (PROV-005).

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`If-Match`	header	—	ETag from a previous response; a stale value fails with 412. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Request body

application/scim+json · required

Field	Type	Required	Description
`schemas`	array	—
`userName`	string	Yes
`externalId`	string	—
`displayName`	string	—
`name`	object	—
`emails`	array	—
`active`	boolean	—	Membership state in the connector organization.

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "userName": {
      "type": "string"
    },
    "externalId": {
      "type": "string"
    },
    "displayName": {
      "type": "string"
    },
    "name": {
      "type": "object",
      "properties": {
        "givenName": {
          "type": "string"
        },
        "familyName": {
          "type": "string"
        }
      }
    },
    "emails": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string"
          },
          "type": {
            "type": "string"
          },
          "primary": {
            "type": "boolean"
          }
        }
      }
    },
    "active": {
      "type": "boolean",
      "description": "Membership state in the connector organization."
    }
  },
  "required": [
    "userName"
  ]
}

application/json · required

Field	Type	Required	Description
`schemas`	array	—
`userName`	string	Yes
`externalId`	string	—
`displayName`	string	—
`name`	object	—
`emails`	array	—
`active`	boolean	—	Membership state in the connector organization.

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "userName": {
      "type": "string"
    },
    "externalId": {
      "type": "string"
    },
    "displayName": {
      "type": "string"
    },
    "name": {
      "type": "object",
      "properties": {
        "givenName": {
          "type": "string"
        },
        "familyName": {
          "type": "string"
        }
      }
    },
    "emails": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string"
          },
          "type": {
            "type": "string"
          },
          "primary": {
            "type": "boolean"
          }
        }
      }
    },
    "active": {
      "type": "boolean",
      "description": "Membership state in the connector organization."
    }
  },
  "required": [
    "userName"
  ]
}

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "description": "Weak entity tag of the resource version.",
    "schema": {
      "type": "string"
    }
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimReplaceUser · Schema definitions · OpenAPI contract

PATCH/api/v1/realms/{realm}/scim/v2/Users/{id}+

Patch a SCIM user

Applies RFC 7644 PATCH operations (add, replace, remove; op names are case-insensitive).

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`If-Match`	header	—	ETag from a previous response; a stale value fails with 412. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Request body

application/scim+json · required

Field	Type	Required	Description
`schemas`	array	—
`Operations`	array	Yes

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "Operations": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "op": {
            "type": "string",
            "description": "add, replace or remove (case-insensitive)."
          },
          "path": {
            "type": "string"
          },
          "value": {}
        },
        "required": [
          "op"
        ]
      }
    }
  },
  "required": [
    "Operations"
  ]
}

application/json · required

Field	Type	Required	Description
`schemas`	array	—
`Operations`	array	Yes

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "Operations": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "op": {
            "type": "string",
            "description": "add, replace or remove (case-insensitive)."
          },
          "path": {
            "type": "string"
          },
          "value": {}
        },
        "required": [
          "op"
        ]
      }
    }
  },
  "required": [
    "Operations"
  ]
}

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "description": "Weak entity tag of the resource version.",
    "schema": {
      "type": "string"
    }
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimPatchUser · Schema definitions · OpenAPI contract

DELETE/api/v1/realms/{realm}/scim/v2/Users/{id}+

Delete a SCIM user

Removes the user from the connector organization only; the account and other memberships are untouched (PROV-005).

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`If-Match`	header	—	ETag from a previous response; a stale value fails with 412. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

204 No Content

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimDeleteUser · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/scim/v2/Groups+

List SCIM groups

Lists groups provisioned by this connector in its organization. Supports filter (eq, ne, co, sw, ew, gt, ge, lt, le, pr, and, or, not, value paths), startIndex, count (at most 200), attributes and excludedAttributes.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`filter`	query	—	RFC 7644 filter expression. `{"type":"string"}`
`startIndex`	query	—	`{"type":"integer","minimum":1}`
`count`	query	—	`{"type":"integer","minimum":0,"maximum":200}`
`attributes`	query	—	Comma-separated attributes to return. `{"type":"string"}`
`excludedAttributes`	query	—	Comma-separated attributes to omit. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`totalResults`	integer	Yes
`startIndex`	integer	—
`itemsPerPage`	integer	—
`Resources`	array	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimListGroups · Schema definitions · OpenAPI contract

POST/api/v1/realms/{realm}/scim/v2/Groups+

Create a SCIM group

Creates a group in the connector organization. Roles come only from the connector approved group mappings within its role ceiling (PROV-006). Members must be users this connector provisioned.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Request body

application/scim+json · required

Field	Type	Required
`schemas`	array	—
`displayName`	string	Yes
`externalId`	string	—
`members`	array	—

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "displayName": {
      "type": "string"
    },
    "externalId": {
      "type": "string"
    },
    "members": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string"
          }
        }
      }
    }
  },
  "required": [
    "displayName"
  ]
}

application/json · required

Field	Type	Required
`schemas`	array	—
`displayName`	string	Yes
`externalId`	string	—
`members`	array	—

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "displayName": {
      "type": "string"
    },
    "externalId": {
      "type": "string"
    },
    "members": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string"
          }
        }
      }
    }
  },
  "required": [
    "displayName"
  ]
}

Responses

201 Created

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "description": "Weak entity tag of the resource version.",
    "schema": {
      "type": "string"
    }
  },
  "Location": {
    "description": "URL of the created resource.",
    "schema": {
      "type": "string"
    }
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimCreateGroup · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/scim/v2/Groups/{id}+

Get a SCIM group

Returns a group provisioned by this connector.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`attributes`	query	—	Comma-separated attributes to return. `{"type":"string"}`
`excludedAttributes`	query	—	Comma-separated attributes to omit. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "description": "Weak entity tag of the resource version.",
    "schema": {
      "type": "string"
    }
  }
}

304 Not Modified (If-None-Match matched the current ETag).

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimGetGroup · Schema definitions · OpenAPI contract

PUT/api/v1/realms/{realm}/scim/v2/Groups/{id}+

Replace a SCIM group

Replaces the group name and members.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`If-Match`	header	—	ETag from a previous response; a stale value fails with 412. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Request body

application/scim+json · required

Field	Type	Required
`schemas`	array	—
`displayName`	string	Yes
`externalId`	string	—
`members`	array	—

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "displayName": {
      "type": "string"
    },
    "externalId": {
      "type": "string"
    },
    "members": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string"
          }
        }
      }
    }
  },
  "required": [
    "displayName"
  ]
}

application/json · required

Field	Type	Required
`schemas`	array	—
`displayName`	string	Yes
`externalId`	string	—
`members`	array	—

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "displayName": {
      "type": "string"
    },
    "externalId": {
      "type": "string"
    },
    "members": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string"
          }
        }
      }
    }
  },
  "required": [
    "displayName"
  ]
}

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "description": "Weak entity tag of the resource version.",
    "schema": {
      "type": "string"
    }
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimReplaceGroup · Schema definitions · OpenAPI contract

PATCH/api/v1/realms/{realm}/scim/v2/Groups/{id}+

Patch a SCIM group

Applies RFC 7644 PATCH operations (add, replace, remove; op names are case-insensitive).

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`If-Match`	header	—	ETag from a previous response; a stale value fails with 412. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Request body

application/scim+json · required

Field	Type	Required	Description
`schemas`	array	—
`Operations`	array	Yes

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "Operations": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "op": {
            "type": "string",
            "description": "add, replace or remove (case-insensitive)."
          },
          "path": {
            "type": "string"
          },
          "value": {}
        },
        "required": [
          "op"
        ]
      }
    }
  },
  "required": [
    "Operations"
  ]
}

application/json · required

Field	Type	Required	Description
`schemas`	array	—
`Operations`	array	Yes

Complete request schema

{
  "type": "object",
  "additionalProperties": true,
  "properties": {
    "schemas": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "Operations": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "op": {
            "type": "string",
            "description": "add, replace or remove (case-insensitive)."
          },
          "path": {
            "type": "string"
          },
          "value": {}
        },
        "required": [
          "op"
        ]
      }
    }
  },
  "required": [
    "Operations"
  ]
}

Responses

200 OK

application/scim+json

Field	Type	Required
`schemas`	array	—
`id`	string	—
`externalId`	string	—
`meta`	object	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "ETag": {
    "description": "Weak entity tag of the resource version.",
    "schema": {
      "type": "string"
    }
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimPatchGroup · Schema definitions · OpenAPI contract

DELETE/api/v1/realms/{realm}/scim/v2/Groups/{id}+

Delete a SCIM group

Deletes the group and its connector-sourced role assignments.

AuthenticationscimConnectorTokenTrust classprovisioningPermissionsSee operation description

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`If-Match`	header	—	ETag from a previous response; a stale value fails with 412. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

204 No Content

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

400 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

401 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

403 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

404 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

409 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

412 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

429 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

500 SCIM error (RFC 7644 section 3.12).

application/scim+json

Field	Type	Required
`schemas`	array	Yes
`status`	string	Yes
`scimType`	string	—
`detail`	string	—

Operation scimDeleteGroup · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/organizations/{org}/provisioning-connectors+

List provisioning connectors

AuthenticationaccountToken or adminTokenTrust classuser-self-service-or-administrativePermissionsorg.integrations.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`org`	path	Yes	Organization identifier (a selector; access is checked, API-003). `{"type":"string"}`
`cursor`	query	—	Opaque cursor from a previous page (next_cursor). Cursors are HMAC-bound to the realm and listing. `{"type":"string"}`
`limit`	query	—	Page size; defaults to limits.default_page_size and is capped at limits.max_page_size. `{"type":"integer","minimum":1}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/json

Field	Type	Required	Description
`items`	array	Yes
`next_cursor`	string	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

400 Malformed request, invalid JSON (duplicate members, unknown fields, wrong types), invalid cursor or invalid transaction (code invalid_request, transaction_invalid, invalid_proof, invitation_invalid).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

403 Authenticated but not allowed (code forbidden, mfa_required, step_up_required, recent_authentication_required, grant_ceiling_exceeded, impersonation_restricted, account_unavailable, sso_required, recovery_restricted). Step-up problems carry obligations.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation listProvisioningConnectors · Schema definitions · OpenAPI contract

POST/api/v1/realms/{realm}/organizations/{org}/provisioning-connectors+

Create a provisioning connector

Creates an inbound SCIM connector bound to the organization. The role ceiling must be within the creator own ceiling (PROV-003). The token is shown once. Requires an MFA session.

AuthenticationaccountToken or adminTokenTrust classuser-self-service-or-administrativePermissionsorg.integrations.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`org`	path	Yes	Organization identifier (a selector; access is checked, API-003). `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Request body

application/json · required

Field	Type	Required	Description
`name`	string	Yes
`kind`	string	—	`scim_inbound`
`allowed_resource_types`	array	—
`role_ceiling_ids`	array	—	Roles the connector may ever grant; within the creator own ceiling.
`group_role_mappings`	object	—	Approved mappings from SCIM group display names to role IDs within the ceiling.
`default_role_id`	string	—
`config`	object	—

Complete request schema

{
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "name": {
      "type": "string"
    },
    "kind": {
      "type": "string",
      "enum": [
        "scim_inbound"
      ]
    },
    "allowed_resource_types": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "User",
          "Group"
        ]
      }
    },
    "role_ceiling_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Roles the connector may ever grant; within the creator own ceiling."
    },
    "group_role_mappings": {
      "type": "object",
      "additionalProperties": {
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "description": "Approved mappings from SCIM group display names to role IDs within the ceiling."
    },
    "default_role_id": {
      "type": "string"
    },
    "config": {
      "type": "object",
      "additionalProperties": true
    }
  },
  "required": [
    "name"
  ]
}

Responses

201 OK

application/json

Field	Type	Required	Description
`connector`	ProvisioningConnector	Yes
`token`	string	Yes	Connector bearer token (pa_scim_...), shown once.
`scim_base_url`	string	Yes

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation createProvisioningConnector · Schema definitions · OpenAPI contract

GET/api/v1/realms/{realm}/organizations/{org}/provisioning-connectors/{id}+

Get a provisioning connector

Includes operational evidence: last_sync_at, last_error and per-operation stats (PROV-018).

AuthenticationaccountToken or adminTokenTrust classuser-self-service-or-administrativePermissionsorg.integrations.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`org`	path	Yes	Organization identifier (a selector; access is checked, API-003). `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/json

Field	Type	Required	Description
`id`	string	Yes
`organization_id`	string	—
`name`	string	Yes
`kind`	string	—
`state`	string	Yes	`active \| disabled`
`allowed_resource_types`	array	—
`role_ceiling_ids`	array	—
`group_role_mappings`	object	—
`default_role_id`	string	—
`config`	object	—
`last_sync_at`	string	—
`last_error`	string	—
`stats`	object	—
`version`	integer	Yes
`created_at`	string	—
`updated_at`	string	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation getProvisioningConnector · Schema definitions · OpenAPI contract

PUT/api/v1/realms/{realm}/organizations/{org}/provisioning-connectors/{id}+

Update a provisioning connector

Replaces the connector settings; state disabled stops the token working at once. Requires If-Match and an MFA session.

AuthenticationaccountToken or adminTokenTrust classuser-self-service-or-administrativePermissionsorg.integrations.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`org`	path	Yes	Organization identifier (a selector; access is checked, API-003). `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`If-Match`	header	Yes	Expected resource version from the ETag. Required: missing returns 428, stale returns 412. `{"type":"string","examples":["W/\"v12\""]}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Request body

application/json · required

{
  "allOf": [
    {
      "$ref": "#/components/schemas/ProvisioningConnectorInput"
    },
    {
      "type": "object",
      "properties": {
        "state": {
          "type": "string",
          "enum": [
            "active",
            "disabled"
          ]
        }
      }
    }
  ]
}

Complete request schema

{
  "allOf": [
    {
      "$ref": "#/components/schemas/ProvisioningConnectorInput"
    },
    {
      "type": "object",
      "properties": {
        "state": {
          "type": "string",
          "enum": [
            "active",
            "disabled"
          ]
        }
      }
    }
  ]
}

Responses

200 OK

application/json

Field	Type	Required	Description
`id`	string	Yes
`organization_id`	string	—
`name`	string	Yes
`kind`	string	—
`state`	string	Yes	`active \| disabled`
`allowed_resource_types`	array	—
`role_ceiling_ids`	array	—
`group_role_mappings`	object	—
`default_role_id`	string	—
`config`	object	—
`last_sync_at`	string	—
`last_error`	string	—
`stats`	object	—
`version`	integer	Yes
`created_at`	string	—
`updated_at`	string	—

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation updateProvisioningConnector · Schema definitions · OpenAPI contract

POST/api/v1/realms/{realm}/organizations/{org}/provisioning-connectors/{id}/token+

Rotate a connector token

Issues a new token; the old one stops working at once. Requires an MFA session.

AuthenticationaccountToken or adminTokenTrust classuser-self-service-or-administrativePermissionsorg.integrations.write

Parameters

Name	Location	Required	Details
`realm`	path	Yes	Realm name (path-based issuer). Unknown realms return 404. `{"type":"string"}`
`org`	path	Yes	Organization identifier (a selector; access is checked, API-003). `{"type":"string"}`
`id`	path	Yes	Resource identifier. `{"type":"string"}`
`X-Request-Id`	header	—	Optional caller-supplied correlation ID (printable ASCII, at most 64 characters); otherwise generated. Echoed in X-Request-Id and problem request_id. `{"type":"string","maxLength":64,"pattern":"^[\\x21-\\x7e]+$"}`

Responses

200 OK

application/json

Field	Type	Required	Description
`token`	string	Yes

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

401 Missing or invalid credentials (code unauthenticated or invalid_credentials). Includes WWW-Authenticate.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  },
  "WWW-Authenticate": {
    "$ref": "#/components/headers/WWW-Authenticate"
  }
}

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

404 Unknown realm or resource, or existence concealed from the caller (code not_found, feature_disabled).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

409 Conflicts with current state, or an idempotent request with the same key is still in progress / carried a one-time secret (code conflict, unexpected_step, last_owner, last_sign_in_method).

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

422 Validation failed (code validation_failed, password_policy, idempotency_key_reused); errors maps fields to messages.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

500 Unexpected error (code internal_error); no stack traces or secrets.

application/problem+json

Field	Type	Required	Description
`type`	string	Yes	https://auth.proudbase.com/problems/{code}
`title`	string	Yes
`status`	integer	Yes
`code`	string	Yes	Stable machine-readable error code. invalid_request \| validation_failed \| unauthenticated \| forbidden \| not_found \| conflict \| precondition_failed \| precondition_required \| rate_limited \| unavailable \| internal_error \| payload_too_large \| unsupported_media_type \| step_up_required \| recent_authentication_required \| mfa_required \| recovery_restricted \| transaction_invalid \| transaction_expired \| invalid_credentials \| invalid_proof \| unexpected_step \| password_policy \| last_owner \| grant_ceiling_exceeded \| impersonation_denied \| impersonation_restricted \| feature_disabled \| invitation_invalid \| last_sign_in_method \| idempotency_key_reused \| account_unavailable \| sso_required \| upstream_unavailable
`detail`	string	—	Client-safe detail; never contains secrets.
`errors`	object	—	Field name -> validation message.
`request_id`	string	—	Correlation identifier, equal to the X-Request-Id response header.
`obligations`	array	—	Present on step-up / recent-authentication / MFA problems.
`original_status`	integer	—	Present when an idempotent replay is refused because the original response carried a one-time secret.

Response headers

{
  "X-Request-Id": {
    "$ref": "#/components/headers/X-Request-Id"
  }
}

Operation rotateProvisioningConnectorToken · Schema definitions · OpenAPI contract