Skip to main content
KaireonAI implements the SCIM 2.0 protocol (RFC 7644) for automated user provisioning from enterprise identity providers like Okta, Azure AD, and OneLogin. SCIM endpoints require bearer token authentication configured in your IdP.

​
GET /api/v1/scim/v2/Users

List users in SCIM ListResponse format.

​
Query Parameters

ParameterTypeRequiredDescription
startIndexnumberNo1-based pagination index (default: 1)
countnumberNoPage size (default: 100, max: 200)

​
Response

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 25,
  "startIndex": 1,
  "itemsPerPage": 25,
  "Resources": [
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
      "id": "clx...",
      "userName": "john@example.com",
      "name": {
        "givenName": "John",
        "familyName": "Smith"
      },
      "displayName": "John Smith",
      "emails": [
        { "value": "john@example.com", "primary": true, "type": "work" }
      ],
      "active": true,
      "meta": {
        "resourceType": "User",
        "created": "2026-03-01T00:00:00.000Z",
        "lastModified": "2026-03-18T00:00:00.000Z",
        "location": "https://playground.kaireonai.com/api/v1/scim/v2/Users/clx..."
      }
    }
  ]
}

​
POST /api/v1/scim/v2/Users

Create a user from a SCIM resource.

​
Request Body

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "jane@example.com",
  "name": {
    "givenName": "Jane",
    "familyName": "Doe"
  },
  "displayName": "Jane Doe",
  "emails": [
    { "value": "jane@example.com", "primary": true, "type": "work" }
  ]
}

​
Response (201)

Returns the created SCIM User resource.

​
Error — User Exists (409)

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "detail": "User already exists",
  "status": 409
}

​
GET /api/v1/scim/v2/Users/

Get a single user by ID.

​
PUT /api/v1/scim/v2/Users/

Replace a user resource. Supports updating displayName, userName, name, emails, and active status. Setting active: false soft-deactivates the user (locks the account). Setting active: true reactivates.

​
DELETE /api/v1/scim/v2/Users/

Soft-deactivate a user. The user record is not deleted — it is locked to preserve audit history.

​
Response

204 No Content on success.