Skip to content
CHAMPREPCHAMPREPCHAMPREP Docs

SCIM 2.0 provisioning

CHAMPREP supports SCIM 2.0 provisioning for eligible enterprise organizations. An identity provider can provision and deprovision organization members and, when group synchronization is enabled, maintain organization groups.

SCIM is separate from the CHAMPREP API Gateway. Use the organization-specific SCIM base URL and token shown in the enterprise administration experience; do not substitute a browser API URL or a general CHAMPREP API key.

Configure an identity provider

Section titled “Configure an identity provider”
  1. In the enterprise dashboard, open SCIM Provisioning.
  2. Review the default seat type, deprovisioning behavior, and group-sync setting before enabling provisioning.
  3. Create a SCIM token with only the Users, Groups, or combined access the identity provider needs.
  4. Copy the displayed SCIM base URL and token into the identity provider.
  5. Test with a non-privileged user before assigning production groups.
  6. Confirm the resulting member, seat, and group state in CHAMPREP.

The token value is shown only when it is created or rotated. Store it in the identity provider’s secret store and never place it in a browser bundle, ticket, log, or shared document.

Authentication

Section titled “Authentication”

Send the organization-specific token as an OAuth bearer credential:

Authorization: Bearer YOUR_SCIM_TOKEN
Accept: application/scim+json
Content-Type: application/scim+json

A token can expire or be revoked. Rotate it by configuring the replacement in the identity provider, confirming a successful synchronization, and then revoking the previous token.

Supported resources

Section titled “Supported resources”

All paths below are relative to the SCIM base URL displayed by CHAMPREP.

Method Path Purpose
POST /Users Provision a user.
GET /Users List users or filter by a supported attribute.
GET /Users/{id} Read one user.
PUT /Users/{id} Replace a user.
PATCH /Users/{id} Apply supported partial updates.
DELETE /Users/{id} Apply the configured deprovisioning behavior.
POST /Groups Create a group when group sync is enabled.
GET /Groups List synchronized groups.
GET /Groups/{id} Read one group.
PUT /Groups/{id} Replace a group and its supported membership.
PATCH /Groups/{id} Add or remove supported group members.
DELETE /Groups/{id} Delete a synchronized group.

Group operations return 403 when group synchronization is disabled. Member identifiers in group requests must refer to users visible to the same organization.

Discovery

Section titled “Discovery”

CHAMPREP exposes the standard discovery resources:

Path Purpose
/ServiceProviderConfig Supported SCIM features and authentication scheme.
/ResourceTypes User and Group resource definitions.
/Schemas Supported core and enterprise user schemas and the Group schema.

PATCH and filtering are supported. Bulk operations, password changes, and ETags are not advertised as supported. Use discovery responses as the source of truth rather than assuming optional SCIM features.

Operational guidance

Section titled “Operational guidance”
  • Assign only the organization roles and seat types intended for automatically provisioned members.
  • Treat identity-provider group assignment as a privileged administrative action.
  • Review enterprise audit activity after configuration changes and bulk directory updates.
  • Revoke tokens that are unused, exposed, or owned by a retired integration.
  • If a synchronization fails, preserve the SCIM status, response body, resource type, and approximate time, but redact the bearer token and user data before contacting CHAMPREP Support.