Voyti
SCIM Provisioning
SCIM 2.0 provisioning for identity providers. The voyti-api-scim package exposes Voyti users
through the SCIM Users resource and Voyti RBAC roles through the SCIM Groups resource.
Installation
Resources
The Users resource represents existing Voyti users. userName, emails, and active are returned
attributes; password is accepted as a write-only provisioning attribute. The Groups resource
represents Voyti RBAC roles: displayName is the role name and members are user assignments. All
routes use the base API’s Bearer-token authentication and administrator-access policy.
| Route name | Method | Path | Purpose |
|---|---|---|---|
voyti/api-scim-v2-service-provider-config | GET | v2/ServiceProviderConfig | SCIM service provider capabilities |
voyti/api-scim-v2-resource-types | GET | v2/ResourceTypes | List supported resource types |
voyti/api-scim-v2-schemas | GET | v2/Schemas | List supported schemas |
voyti/api-scim-v2-schema | GET | v2/Schemas/{schema} | View a schema |
voyti/api-scim-v2-bulk | POST | v2/Bulk | Process sequential User and Group operations |
voyti/api-scim-v2-users-index | GET | v2/Users | List Voyti users |
voyti/api-scim-v2-users-create | POST | v2/Users | Create a Voyti user |
voyti/api-scim-v2-users-search | POST | v2/Users/.search | Search Voyti users |
voyti/api-scim-v2-users-view | GET | v2/Users/{id} | View a Voyti user |
voyti/api-scim-v2-users-replace | PUT | v2/Users/{id} | Replace a Voyti user |
voyti/api-scim-v2-users-patch | PATCH | v2/Users/{id} | Patch a Voyti user |
voyti/api-scim-v2-users-delete | DELETE | v2/Users/{id} | Delete a Voyti user |
voyti/api-scim-v2-groups-index | GET | v2/Groups | List RBAC roles |
voyti/api-scim-v2-groups-create | POST | v2/Groups | Create an RBAC role |
voyti/api-scim-v2-groups-search | POST | v2/Groups/.search | Search RBAC roles |
voyti/api-scim-v2-groups-view | GET | v2/Groups/{id} | View an RBAC role |
voyti/api-scim-v2-groups-replace | PUT | v2/Groups/{id} | Replace an RBAC role |
voyti/api-scim-v2-groups-patch | PATCH | v2/Groups/{id} | Patch an RBAC role |
voyti/api-scim-v2-groups-delete | DELETE | v2/Groups/{id} | Delete an RBAC role |
Provisioning behavior
Collection endpoints support SCIM pagination, attribute selection, filtering, and sorting. User
and Group resources support replacement with PUT, partial updates with PATCH, and standard
SCIM error responses.
User and Group responses include opaque ETag values. PUT, PATCH, and DELETE honor
If-Match; a stale conditional write returns 412 with SCIM invalidVers. If-None-Match can
be used for conditional reads.
POST /v2/Bulk processes sequential User and Group operations and returns a per-operation status
and response. Bulk requests require the SCIM BulkRequest schema, support up to 100 operations, and
are limited to a 1 MiB payload. Discovery endpoints describe the provider, resource types, and
schemas. Search requests can use either GET query parameters or the resource-specific
POST /v2/Users/.search and POST /v2/Groups/.search endpoints.
Supported profile
Voyti provides a focused SCIM 2.0 service-provider profile for identity lifecycle management and RBAC role membership. It covers the operations needed to provision Voyti accounts and roles without claiming to model every possible SCIM resource, extension, or attribute.
| Area | Implementation status |
|---|---|
| Resources | Voyti users and RBAC roles, exposed as SCIM Users and Groups |
| Discovery | Service provider configuration, resource types, and supported schemas |
| Lifecycle operations | Create, read, replace, partial update, and delete |
| Query operations | Pagination, attribute selection, supported filters, and sorting |
| Bulk operations | Sequential User and Group operations, limited to 100 operations, with bulkId references and failOnErrors |
| Conditional requests | ETag, If-Match, and If-None-Match |
| Resource scope | userName, emails, active, and write-only password for users; displayName and members for groups |
| Search | GET query parameters and POST /v2/Users/.search or POST /v2/Groups/.search are supported |
| PATCH | add, remove, and replace are supported for the mapped attributes, with the required PatchOp schema URI enforced |
| Resource metadata | Location and meta.location are emitted for resource responses |
| Extensions and additional resources | Not included in this focused profile |
SCIM requests should be sent over HTTPS. The package supplies Bearer-token authentication and
administrator-access enforcement through voyti-api; the application remains responsible for
TLS configuration and deployment-level security.