Voyti

Voyti
User management, authentication & authorization

SCIM Provisioning

SCIM 2.0 provisioning for identity providers. The voyti-api-scim package exposes Voyti users through the SCIM Users resource and Voyti RBAC roles through the SCIM Groups resource.

Installation

Create an issue
GitHub Packagist

Resources

The Users resource represents existing Voyti users. userName, emails, and active are returned attributes; password is accepted as a write-only provisioning attribute. The Groups resource represents Voyti RBAC roles: displayName is the role name and members are user assignments. All routes use the base API’s Bearer-token authentication and administrator-access policy.

Route name Method Path Purpose
voyti/api-scim-v2-service-provider-config GET v2/ServiceProviderConfig SCIM service provider capabilities
voyti/api-scim-v2-resource-types GET v2/ResourceTypes List supported resource types
voyti/api-scim-v2-schemas GET v2/Schemas List supported schemas
voyti/api-scim-v2-schema GET v2/Schemas/{schema} View a schema
voyti/api-scim-v2-bulk POST v2/Bulk Process sequential User and Group operations
voyti/api-scim-v2-users-index GET v2/Users List Voyti users
voyti/api-scim-v2-users-create POST v2/Users Create a Voyti user
voyti/api-scim-v2-users-search POST v2/Users/.search Search Voyti users
voyti/api-scim-v2-users-view GET v2/Users/{id} View a Voyti user
voyti/api-scim-v2-users-replace PUT v2/Users/{id} Replace a Voyti user
voyti/api-scim-v2-users-patch PATCH v2/Users/{id} Patch a Voyti user
voyti/api-scim-v2-users-delete DELETE v2/Users/{id} Delete a Voyti user
voyti/api-scim-v2-groups-index GET v2/Groups List RBAC roles
voyti/api-scim-v2-groups-create POST v2/Groups Create an RBAC role
voyti/api-scim-v2-groups-search POST v2/Groups/.search Search RBAC roles
voyti/api-scim-v2-groups-view GET v2/Groups/{id} View an RBAC role
voyti/api-scim-v2-groups-replace PUT v2/Groups/{id} Replace an RBAC role
voyti/api-scim-v2-groups-patch PATCH v2/Groups/{id} Patch an RBAC role
voyti/api-scim-v2-groups-delete DELETE v2/Groups/{id} Delete an RBAC role

Provisioning behavior

Collection endpoints support SCIM pagination, attribute selection, filtering, and sorting. User and Group resources support replacement with PUT, partial updates with PATCH, and standard SCIM error responses.

User and Group responses include opaque ETag values. PUT, PATCH, and DELETE honor If-Match; a stale conditional write returns 412 with SCIM invalidVers. If-None-Match can be used for conditional reads.

POST /v2/Bulk processes sequential User and Group operations and returns a per-operation status and response. Bulk requests require the SCIM BulkRequest schema, support up to 100 operations, and are limited to a 1 MiB payload. Discovery endpoints describe the provider, resource types, and schemas. Search requests can use either GET query parameters or the resource-specific POST /v2/Users/.search and POST /v2/Groups/.search endpoints.

Supported profile

Voyti provides a focused SCIM 2.0 service-provider profile for identity lifecycle management and RBAC role membership. It covers the operations needed to provision Voyti accounts and roles without claiming to model every possible SCIM resource, extension, or attribute.

Area Implementation status
Resources Voyti users and RBAC roles, exposed as SCIM Users and Groups
Discovery Service provider configuration, resource types, and supported schemas
Lifecycle operations Create, read, replace, partial update, and delete
Query operations Pagination, attribute selection, supported filters, and sorting
Bulk operations Sequential User and Group operations, limited to 100 operations, with bulkId references and failOnErrors
Conditional requests ETag, If-Match, and If-None-Match
Resource scope userName, emails, active, and write-only password for users; displayName and members for groups
Search GET query parameters and POST /v2/Users/.search or POST /v2/Groups/.search are supported
PATCH add, remove, and replace are supported for the mapped attributes, with the required PatchOp schema URI enforced
Resource metadata Location and meta.location are emitted for resource responses
Extensions and additional resources Not included in this focused profile

SCIM requests should be sent over HTTPS. The package supplies Bearer-token authentication and administrator-access enforcement through voyti-api; the application remains responsible for TLS configuration and deployment-level security.