openapi: 3.0.3
info:
  title: SCIM 2.0 User Management
  description: |-
    System for Cross-domain Identity Management (SCIM) is designed to make managing user identities in cloud-based applications and services easier. It is an [open specification](https://www.simplecloud.info/) that is supported by many user management tools. 

    These pages document the specifics of Vendasta's implementation for partners who want to manage users in their own system and them push the changes to the Vendasta platform.
  version: 1.0.0
servers:
  - url: 'https://prod.apigateway.co/scim'
    description: Production
  - url: 'https://demo.apigateway.co/scim'
    description: Demo
  - url: 'http://localhost:11001/scim'
    description: Local
  - url: '{local}/scim'
    description: Localhost
tags:
  - name: User
    description: User resources
  - name: Group
    description: Group resource
  - name: System Operations
    description: System Operations
paths:
  '/{namespace}/Users':
    parameters:
      - $ref: '#/components/parameters/namespace'
    get:
      tags:
        - User
      summary: Search Users
      parameters:
        - $ref: '#/components/parameters/accept-scim'
        - $ref: '#/components/parameters/accept-charset-scim'
        - name: filter
          in: query
          description: |-
            Filtering is an OPTIONAL parameter.
            List users using described filters.
            <br> Supported filters are:
            <br> `externalId eq "user_external_id"`
            <br> `userName eq "user@mail.com"`
            <br>`/scim/v1/{partnerid}/Users?filter=userName eq "user@mail.com"`
          schema:
            type: string
        - schema:
            type: string
          in: query
          name: attributes
          description: |-
            Resource attributes can be restriceted by using attributes parameter.
            <br>`/scim/v1/{partnerid}/Users?filter=userName eq "user@mail.com"&attributes=userName`
            <br>`/scim/v1/{partnerid}/Users?attributes=id,externalId,userName`
        - schema:
            type: string
          in: query
          name: excludedAttributes
          description: 'A list of the attributes not to return in the response body. It '
        - schema:
            type: integer
            minimum: 1
            default: 1
          in: query
          name: startIndex
          description: The 1-based index of the first query result
        - schema:
            type: integer
          in: query
          name: count
          description: Specifies the desired maximum number of query results per page
        - schema:
            type: string
            enum:
              - userName
              - meta.created
              - name. givenName
              - name.familyName
          in: query
          name: sortBy
          description: The attribute to order the results based on
        - schema:
            type: string
            enum:
              - ascending
              - descending
            default: ascending
          in: query
          name: sortOrder
          description: Specifies if the results should be sorted A-Z (ascending) or Z-A (descending) based on the attribute in the sortBy parameter
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/ListResponseUsers'
        '400':
          description: |
            Below are the error messages for bad request:
            <br>Only eq filter operator supported.
            <br>Only "userName" or "externalId" filter attribute supported.
            <br>There is some issue with provided attribute value.
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        This endpoint can be used to search users based on filter or list all user if filter criteria is ignored
      operationId: scim-search-users
    post:
      tags:
        - User
      summary: Create User
      requestBody:
        description: Create a new user
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/User'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/User'
        '400':
          description: Failed to create user.
        '409':
          description: One or more of the attribute values are already in use or are reserved.
      operationId: scim-create-user
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        Create User based on SCIM schema
      security:
        - OAuth2Demo:
            - user.admin
        - OAuth2Prod:
            - user.admin
  '/{namespace}/Users/{id}':
    parameters:
      - schema:
          type: string
        name: id
        in: path
        required: true
        description: The id of the user assigned by Vendasta
      - $ref: '#/components/parameters/namespace'
    get:
      tags:
        - User
      summary: Get User
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/User'
        '404':
          description: Resource not found
      x-internal: false
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        Get an user when the user id is known
      operationId: scim-get-user
      security:
        - OAuth2Demo:
            - user.admin
        - OAuth2Prod:
            - user.admin
    put:
      tags:
        - User
      summary: Replace User
      requestBody:
        description: Create a new user
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/User'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/User'
        '400':
          description: Failed to create user.
      operationId: scim-replace-user
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        API to replace an user. All of the attributes will be replaced with provided value and attributes will be kept blank for which no value is specified
      security:
        - OAuth2Demo:
            - user.admin
        - OAuth2Prod:
            - user.admin
    patch:
      tags:
        - User
      summary: Update User
      requestBody:
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/PatchOp'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/User'
        '405':
          description: Invalid input
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        Update an user's one or multiple attributes by providing operation path and value. Post update all other attributes will be unchanged apart from provided attributes.
      operationId: scim-update-user
      security:
        - OAuth2Demo:
            - user.admin
        - OAuth2Prod:
            - user.admin
    delete:
      tags:
        - User
      summary: Delete User
      responses:
        '204':
          description: No Content
        '405':
          description: Resource not found
      operationId: scim-delete-user
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        API to delete an user
      security:
        - OAuth2Demo:
            - user.admin
        - OAuth2Prod:
            - user.admin
  '/{namespace}/Groups':
    parameters:
      - $ref: '#/components/parameters/namespace'
    get:
      tags:
        - Group
      summary: Search Groups
      parameters:
        - name: excludedAttributes
          in: query
          description: Exclude members using `excludedAttributes=members`
          required: false
          schema:
            type: string
        - name: filter
          in: query
          description: Search group using `displayName eq "Platform Admin"`
          required: false
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/ListResponseGroup'
        '404':
          description: User not found
      operationId: ''
      x-lifecycle:
        status: proposed
      description: |
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Draft`
  '/{namespace}/Groups/{id}':
    parameters:
      - $ref: '#/components/parameters/namespace'
      - schema:
          type: string
        name: id
        in: path
        required: true
        description: The id of the group assigned by Vendasta
    get:
      tags:
        - Group
      summary: Get Group
      parameters:
        - name: excludedAttributes
          in: query
          description: Exclude members using `excludedAttributes=members`
          required: false
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Group'
        '404':
          description: User not found
      x-lifecycle:
        status: proposed
      description: |
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Draft`
    patch:
      tags:
        - Group
      summary: Update Group
      requestBody:
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/PatchOp'
        required: true
      responses:
        '204':
          description: No Content
        '405':
          description: Invalid input
      x-lifecycle:
        status: proposed
      description: |
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Draft`
  '/{namespace}/ResourceTypes':
    parameters:
      - $ref: '#/components/parameters/namespace'
    get:
      summary: List Resource Types
      tags:
        - System Operations
      responses:
        '200':
          description: Ok
          content:
            application/scim+json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/MessageListResponse'
                  - type: object
                    properties:
                      Resources:
                        type: array
                        items:
                          $ref: '#/components/schemas/ResourceResourceType'
        default:
          $ref: '#/components/responses/error'
      parameters:
        - $ref: '#/components/parameters/Accept'
        - $ref: '#/components/parameters/attributes'
        - $ref: '#/components/parameters/excludedAttributes'
      operationId: get-namespace-ResourceTypes
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        Returns a list of the resource types that the server suppports. Example "Groups", "Users", "Contacts"
  '/{namespace}/ResourceTypes/{id}':
    parameters:
      - name: namespace
        in: path
        required: true
        schema:
          type: string
          example: VUNI
        description: Currently this must be the id of the partner that you wish to manage users for. In the future we plan to support other types of namespaces such as marketplace apps
      - schema:
          type: string
        name: id
        in: path
        required: true
    get:
      summary: Get Resource Type
      tags:
        - System Operations
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/ResourceResourceType'
          headers:
            Location:
              $ref: '#/components/headers/Location'
            Content-Type:
              $ref: '#/components/headers/Content-Type'
        default:
          $ref: '#/components/responses/error'
      operationId: get-ResourceTypes-id
      parameters:
        - $ref: '#/components/parameters/Accept'
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        Returns a list of the resource types that the server suppports. Example "Groups", "Users", "Contacts"
  '/{namespace}/Schemas':
    parameters:
      - $ref: '#/components/parameters/namespace'
    get:
      summary: List Schemas
      tags:
        - System Operations
      responses:
        '200':
          description: Ok
          content:
            application/scim+json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/MessageListResponse'
                  - type: object
                    properties:
                      Resources:
                        type: array
                        items:
                          $ref: '#/components/schemas/ResourceSchema'
        default:
          $ref: '#/components/responses/error'
      parameters:
        - $ref: '#/components/parameters/Accept'
        - $ref: '#/components/parameters/attributes'
        - $ref: '#/components/parameters/excludedAttributes'
      operationId: get-namespace-Schemas
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        Lists the data schemas that may be used by the resource types
  '/{namespace}/Schemas/{id}':
    parameters:
      - name: namespace
        in: path
        required: true
        schema:
          type: string
          example: VUNI
        description: Currently this must be the id of the partner that you wish to manage users for. In the future we plan to support other types of namespaces such as marketplace apps
      - schema:
          type: string
        name: id
        in: path
        required: true
    get:
      summary: Get Schema
      tags:
        - System Operations
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/ResourceSchema'
          headers:
            Location:
              $ref: '#/components/headers/Location'
            Content-Type:
              $ref: '#/components/headers/Content-Type'
        default:
          $ref: '#/components/responses/error'
      operationId: get-Schemas-id
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        Lists the data schemas that may be used by the resource types
  '/{namespace}/Me':
    parameters:
      - $ref: '#/components/parameters/namespace'
    get:
      summary: Me redirect
      tags:
        - User
      responses:
        '308':
          description: Permanent Redirect (experiemental)
          headers:
            Location:
              schema:
                type: string
                example: 'https://prod.apigateway.co/scim/VUNI/Users/U-123456'
              description: The correct URI to make a request to
      operationId: get-namespace-Me
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`


        The SCIM standard defines a special resource called "Me" that represents the user making the API request as identified by the access token. This is similar to the "/userinfo" endpoint defined in the OAuth2 spec. 

        The Vendasta platform will respond to all requests with a redirect to the coorisponding '/Users' endpoint. This may result in a different namespace.
  '/{namespace}/ServiceProviderConfig':
    parameters:
      - $ref: '#/components/parameters/namespace'
    get:
      summary: Get Service Provider Config
      tags:
        - System Operations
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SchemaServiceProviderConfig'
      operationId: get-ServiceProviderConfig
      parameters:
        - $ref: '#/components/parameters/Accept'
        - $ref: '#/components/parameters/attributes'
        - $ref: '#/components/parameters/excludedAttributes'
      x-lifecycle:
        status: proposed
      description: |-
        [Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Proposed`

        Provides details on the SCIM features supported by the Vendasta platform
  '/{namespace}/Bulk':
    parameters:
      - $ref: '#/components/parameters/namespace'
    get:
      summary: Bulk Actions
      tags:
        - System Operations
      responses:
        '501':
          $ref: '#/components/responses/error'
      operationId: get-namespace-Bulk
      x-lifecycle:
        status: removed
      description: |-
        Status: `Not planned`


        The SCIM standard defines an optional `/Bulk` endpoint for performing multiple operations at the same time. The Vendasta platform does not currently support it.
components:
  schemas:
    User:
      type: object
      properties:
        schemas:
          type: array
          example:
            - 'urn:ietf:params:scim:schemas:core:2.0:User'
          minItems: 1
          uniqueItems: true
          items:
            type: string
            example: '["urn:ietf:params:scim:schemas:core:2.0:User"]'
        id:
          type: string
          description: |-
            Unique identifier in Vendasta.
            This field will be generated by Vendasta during creation of user.
        externalId:
          type: string
          description: External unique identifier of the user.
        userName:
          type: string
          description: |-
            A service provider's unique identifier for the user, typically
            used by the user to directly authenticate to the service provider.
            Often displayed to the user as their unique identifier within the
            system (as opposed to "id" or "externalId", which are generally
            opaque and not user-friendly identifiers).  Each User MUST include
            a non-empty userName value.  This identifier MUST be unique across
            the service provider's entire set of Users.  This attribute is
            REQUIRED and is case insensitive.
            <br><b>userName</b> is mapped with <b>email</b>
          example: barbara@mail.com
        name:
          $ref: '#/components/schemas/Name'
        displayName:
          type: string
          description: givenName + familyName
          example: Babs Jensen
          readOnly: true
        nickName:
          type: string
          example: Babs
        profileUrl:
          type: string
          format: uri
          description: <b>This field currently NOT SUPPORTED</b>
        title:
          type: string
          description: |-
            The user''s title, such as "Vice President".
            <br><b>This field currently NOT SUPPORTED</b>
        userType:
          type: string
          description: |-
            Used to identify the relationship between the organization and the
            user.  Typical values used might be "Contractor", "Employee",
            "Intern", "Temp", "External", and "Unknown", but any value may be used.
            <br><b>This field currently NOT SUPPORTED</b>
        preferredLanguage:
          type: string
        locale:
          type: string
          description: <b>This field currently NOT SUPPORTED</b>
        timezone:
          type: string
          example: America/Regina
        emails:
          type: array
          minItems: 1
          maxItems: 1
          description: Email is i one to one mapping with user.
          items:
            $ref: '#/components/schemas/Email'
        active:
          type: boolean
        password:
          type: string
          description: <b>This field currently NOT SUPPORTED</b>
        addresses:
          type: array
          description: Address is in one to one mapping with user
          minItems: 0
          maxItems: 1
          items:
            $ref: '#/components/schemas/Address'
        phoneNumbers:
          type: array
          items:
            $ref: '#/components/schemas/PhoneNumber'
        groups:
          type: array
          items:
            $ref: '#/components/schemas/Member'
        meta:
          $ref: '#/components/schemas/Meta'
      required:
        - schemas
        - userName
        - name
        - emails
    PhoneNumber:
      type: object
      properties:
        value:
          type: string
          example: +1-306-555-1234
          description: phone number format should match the region / country given in address against the type
        type:
          type: string
          example: work
    Address:
      type: object
      properties:
        type:
          type: string
          example: work
        streetAddress:
          type: string
          example: 100 Universal City Plaza
        locality:
          type: string
          example: Hollywood
          x-stoplight:
            id: ho5pd2iv86rrw
        region:
          type: string
          pattern: '^[A-Z]{2}-[\w]{1,3}$'
          description: |-
            The code for the top level subdivision within the country (state/province). For more info see the [Addresses guide](https://developers.vendasta.com/platform/1ljuzmi2uboim-addresses)

            Examples: CA-SK, US-FL, AG-08, AU-NSW
          example: CA-SK
        postalCode:
          type: string
          example: '91608'
        country:
          type: string
          pattern: '^[A-Z]{2}$'
          description: |-
            The two letter country code. For more info see the [Addresses guide](https://developers.vendasta.com/platform/1ljuzmi2uboim-addresses)

            Examples: CA, US, AU
          example: CA
        formatted:
          type: string
          example: '100 Universal City Plaza\nHollywood, CA-SK 91608 CA'
        primary:
          type: boolean
    Name:
      type: object
      properties:
        formatted:
          type: string
          description: givenName + " " + familyName
          readOnly: true
        familyName:
          type: string
          example: Jensen
        givenName:
          type: string
          example: Barbara
        middleName:
          type: string
          example: Jane
          description: <b>This field currently NOT SUPPORTED</b>
        honorificPrefix:
          type: string
          example: Ms.
          description: <b>This field currently NOT SUPPORTED</b>
        honorificSuffix:
          type: string
          example: III
          description: <b>This field currently NOT SUPPORTED</b>
      required:
        - givenName
    Email:
      type: object
      properties:
        value:
          type: string
          format: email
          example: bjensen@example.com
        type:
          type: string
          example: work
        primary:
          type: boolean
    Group:
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
          example:
            - 'urn:ietf:params:scim:schemas:core:2.0:Group'
        id:
          type: string
          example: e9e30dba-f08f-4109-8486-d5c6a331660a
        displayName:
          type: string
          example: Tour Guides
        members:
          type: array
          items:
            $ref: '#/components/schemas/Member'
        meta:
          $ref: '#/components/schemas/Meta'
      x-examples:
        Example 1:
          schemas:
            - 'urn:ietf:params:scim:schemas:core:2.0:Group'
          id: 'ba:getStarted:AG-1234567890'
          displayName: Get Started for AG-1234567890
          members:
            - value: 2819c223-7f76-453a-919d-413861904646
              display: Babs Jensen
          meta:
            resourceType: Group
    Member:
      type: object
      properties:
        value:
          type: string
          example: 2819c223-7f76-453a-919d-413861904646
        $ref:
          type: string
          format: uri
          example: 'https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646'
        display:
          type: string
          example: Babs Jensen
    ServiceProviderConfig:
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
          example:
            - 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'
        meta:
          $ref: '#/components/schemas/Meta'
    ListResponseUsers:
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
          example:
            - 'urn:ietf:params:scim:api:messages:2.0:ListResponse'
        Resources:
          type: array
          items:
            $ref: '#/components/schemas/User'
        startIndex:
          type: number
          description: |-
            The 1-based index of the first result in the current set of list results.
            REQUIRED when partial results are returned due to pagination.
        itemsPerPage:
          type: number
          description: |-
            The number of resources returned in a list response page.
            REQUIRED when partial results are returned due to pagination.
        totalResults:
          type: number
          description: The total number of results returned by the list or query operation
    ListResponseGroup:
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
          example:
            - 'urn:ietf:params:scim:api:messages:2.0:ListResponse'
        totalResults:
          type: number
        Resources:
          type: array
          items:
            $ref: '#/components/schemas/Group'
        startIndex:
          type: number
        itemsPerPage:
          type: number
    PatchOp:
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
          example:
            - 'urn:ietf:params:scim:api:messages:2.0:PatchOp'
        Operations:
          type: array
          items:
            $ref: '#/components/schemas/Operation'
    Operation:
      type: object
      properties:
        op:
          type: string
          example: Replace
        path:
          type: string
          example: 'emails[type eq "work"].value'
        value:
          type: string
          example: updatedEmail@mail.com
    ResourceResourceType:
      description: |
        The "ResourceType" schema specifies the metadata about a resource
          type.  Resource type resources are READ-ONLY and identified using the
          following schema URI:
          "urn:ietf:params:scim:schemas:core:2.0:ResourceType".  Unlike other
          core resources, all attributes are REQUIRED unless otherwise
          specified.  The "id" attribute is not required for the resource type
          resource.
      title: 'schemas:core:2.0:ResourceType'
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
            default: 'urn:ietf:params:scim:schemas:core:2.0:ResourceType'
            enum:
              - 'urn:ietf:params:scim:schemas:core:2.0:ResourceType'
        id:
          type: string
          description: |-
            The resource type's server unique id.  This is often the same
                  value as the "name" attribute.  OPTIONAL.
        name:
          type: string
          description: |-
            The resource type name.  When applicable, service providers MUST
                  specify the name, e.g., "User" or "Group".  This name is
                  referenced by the "meta.resourceType" attribute in all resources.
                  REQUIRED.
        description:
          type: string
          description: |-
            The resource type's human-readable description.  When applicable,
                  service providers MUST specify the description.  OPTIONAL.
        endpoint:
          type: string
          description: |-
            The resource type's HTTP-addressable endpoint relative to the Base
                  URL of the service provider, e.g., "Users".  REQUIRED.
        schema:
          type: string
          description: |-
            The resource type's primary/base schema URI, e.g.,
                  "urn:ietf:params:scim:schemas:core:2.0:User".  This MUST be equal
                  to the "id" attribute of the associated "Schema" resource.
                  REQUIRED.
        schemaExtensions:
          type: array
          description: |-
            A list of URIs of the resource type's schema extensions.
                  OPTIONAL.
          items:
            type: object
            properties:
              schema:
                type: string
                description: |-
                  The URI of an extended schema, e.g., "urn:edu:2.0:Staff".
                          This MUST be equal to the "id" attribute of a "Schema"
                          resource.  REQUIRED.
              required:
                type: boolean
                description: |-
                  A Boolean value that specifies whether or not the schema
                          extension is required for the resource type.  If true, a
                          resource of this type MUST include this schema extension and
                          also include any attributes declared as required in this schema
                          extension.  If false, a resource of this type MAY omit this
                          schema extension.  REQUIRED.
            required:
              - schema
              - required
        meta:
          type: object
          properties:
            location:
              type: string
            resourceType:
              type: string
              example: ResourceType
      required:
        - schemas
        - name
        - description
        - endpoint
        - schema
    ResourceSchema:
      title: 'schema:core:2.0:Schema'
      x-stoplight:
        id: unazswsqjjclk
      type: object
      description: |-
        This section defines a way to specify the schema in use by resources
           available and accepted by a SCIM service provider.  For each
           "schemas" URI value, this schema specifies the defined attribute(s)
           and their characteristics (mutability, returnability, etc).  For
           every schema URI used in a resource object, there is a corresponding
           "Schema" resource.  "Schema" resources are not modifiable, and their
           associated attributes have a mutability of "readOnly".  Except for
           "id" (which is always returned), all attributes have a "returned"
           characteristic of "default".  Unless otherwise specified, all schema
           attributes are case insensitive.  These resources have a "schemas"
           attribute with the following schema URI:

           urn:ietf:params:scim:schemas:core:2.0:Schema

           Unlike other core resources, the "Schema" resource MAY contain a
           complex object within a sub-attribute, and all attributes are
           REQUIRED unless otherwise specified.
      properties:
        schemas:
          type: array
          items:
            type: string
            default: 'urn:ietf:params:scim:schemas:core:2.0:Schema'
            enum:
              - 'urn:ietf:params:scim:schemas:core:2.0:Schema'
        id:
          type: string
          description: |-
            The unique URI of the schema.  When applicable, service providers
                  MUST specify the URI, e.g.,
                  "urn:ietf:params:scim:schemas:core:2.0:User".  Unlike most other
                  schemas, which use some sort of Globally Unique Identifier (GUID)
                  for the "id", the schema "id" is a URI so that it can be
                  registered and is portable between different service providers and
                  clients.  REQUIRED.
        name:
          type: string
          description: |-
            The schema's human-readable name.  When applicable, service
                  providers MUST specify the name, e.g., "User" or "Group".
                  OPTIONAL.
        description:
          type: string
          description: |-
            The schema's human-readable description.  When applicable, service
                  providers MUST specify the description.  OPTIONAL.
        attributes:
          type: array
          description: |-
            A complex type that defines service provider attributes and their
                  qualities
          items:
            type: object
            properties:
              name:
                type: string
                description: |
                  The attribute's name.
              type:
                type: string
                description: |-
                  The attribute's data type.  Valid values are "string",
                           "boolean", "decimal", "integer", "dateTime", "reference", and
                           "complex".  When an attribute is of type "complex", there
                           SHOULD be a corresponding schema attribute "subAttributes"
                           defined, listing the sub-attributes of the attribute.
              subAttributes:
                type: array
                description: |-
                  When an attribute is of type "complex",
                           "subAttributes" defines a set of sub-attributes.
                           "subAttributes" has the same schema sub-attributes as
                           "attributes".
                items:
                  type: object
              multiValued:
                type: boolean
                description: A Boolean value indicating the attribute's plurality.
              description:
                type: string
                description: |-
                  The attribute's human-readable description.  When
                           applicable, service providers MUST specify the description.
              required:
                type: boolean
                description: |-
                  A Boolean value that specifies whether or not the
                           attribute is required.
              canonicalValues:
                type: array
                description: |-
                  A collection of suggested canonical values that
                           MAY be used (e.g., "work" and "home").  In some cases, service
                           providers MAY choose to ignore unsupported values.  OPTIONAL.
                items: {}
              caseExact:
                type: boolean
                description: |-
                  A Boolean value that specifies whether or not a string
                           attribute is case sensitive.  The server SHALL use case
                           sensitivity when evaluating filters.  For attributes that are
                           case exact, the server SHALL preserve case for any value
                           submitted.  If the attribute is case insensitive, the server
                           MAY alter case for a submitted value.  Case sensitivity also
                           impacts how attribute values MAY be compared against filter
                           values (see Section 3.4.2.2 of [RFC7644]).
              mutability:
                type: string
                description: |-
                  A single keyword indicating the circumstances under
                  which the value of the attribute can be (re)defined:

                  `readOnly` - The attribute SHALL NOT be modified.

                  `readWrite` - The attribute MAY be updated and read at any time.
                    This is the default value.

                  `immutable` - The attribute MAY be defined at resource creation
                    (e.g., POST) or at record replacement via a request (e.g., a
                    PUT).  The attribute SHALL NOT be updated.

                  `writeOnly` - The attribute MAY be updated at any time.  Attribute
                    values SHALL NOT be returned (e.g., because the value is a
                    stored hash).  Note: An attribute with a mutability of
                    "writeOnly" usually also has a returned setting of "never".
              returned:
                type: string
                description: |-
                  A single keyword that indicates when an attribute and
                  associated values are returned in response to a GET request or
                  in response to a PUT, POST, or PATCH request.  Valid keywords
                  are as follows:

                  `always` - The attribute is always returned, regardless of the
                      contents of the "attributes" parameter.  For example, "id"
                      is always returned to identify a SCIM resource.

                  `never` - The attribute is never returned.  This may occur because
                      the original attribute value (e.g., a hashed value) is not
                      retained by the service provider.  A service provider MAY
                      allow attributes to be used in a search filter.

                  `default` - The attribute is returned by default in all SCIM
                      operation responses where attribute values are returned.  If
                      the GET request "attributes" parameter is specified,
                      attribute values are only returned if the attribute is named
                      in the "attributes" parameter.  DEFAULT.

                  `request` - The attribute is returned in response to any PUT,
                      POST, or PATCH operations if the attribute was specified by
                      the client (for example, the attribute was modified).  The
                      attribute is returned in a SCIM query operation only if
                      specified in the "attributes" parameter.
              uniqueness:
                type: string
                description: |-
                  A single keyword value that specifies how the service
                  provider enforces uniqueness of attribute values.  A server MAY
                  reject an invalid value based on uniqueness by returning HTTP
                  response code 400 (Bad Request).  A client MAY enforce
                  uniqueness on the client side to a greater degree than the
                  service provider enforces.  For example, a client could make a
                  value unique while the server has uniqueness of "none".  Valid
                  keywords are as follows:

                  `none` ` The values are not intended to be unique in any way.
                      DEFAULT.

                  `server` - The value SHOULD be unique within the context of the
                      current SCIM endpoint (or tenancy) and MAY be globally
                      unique (e.g., a "username", email address, or other
                      server-generated key or counter).  No two resources on the
                      same server SHOULD possess the same value.

                  `global` - The value SHOULD be globally unique (e.g., an email
                      address, a GUID, or other value).  No two resources on any
                      server SHOULD possess the same value.
              referenceTypes:
                type: array
                items:
                  type: string
                description: |-
                  A multi-valued array of JSON strings that indicate
                  the SCIM resource types that may be referenced.  Valid values
                  are as follows:
                  - A SCIM resource type (e.g., "User" or "Group"),
                  -  "external" - indicating that the resource is an external
                      resource (e.g., a photo), or

                  -  "uri" - indicating that the reference is to a service
                      endpoint or an identifier (e.g., a schema URN).

                  This attribute is only applicable for attributes that are of
                  type "reference" (Section 2.3.7).
      required:
        - schemas
        - id
    MessageListResponse:
      type: object
      description: |-
        All seach requests should return a response with this format.

        When not all resources matching the filter criteria can be returned due to paging
        the next page can be obtained by adding the `startIndex` to the `itemsPerPage` to get the value to use as the new `startIndex` query param when making the next request.

        Cursor based paging may be added in the future by following [draft-peterson-scim-cursor-pagination](https://datatracker.ietf.org/doc/draft-peterson-scim-cursor-pagination/).
      title: 'api:messages:2.0:ListResponse'
      properties:
        schemas:
          type: array
          items:
            type: string
            default: 'urn:ietf:params:scim:api:messages:2.0:ListResponse'
            enum:
              - 'urn:ietf:params:scim:api:messages:2.0:ListResponse'
        Resources:
          type: array
          description: |-
            A multi-valued list of complex objects containing the
                  requested resources.  This MAY be a subset of the full set of
                  resources if pagination (Section 3.4.2.4) is requested.  REQUIRED
                  if "totalResults" is non-zero.
          items:
            type: object
        totalResults:
          type: integer
          description: |-
            The total number of results returned by the list or
                  query operation.  The value may be larger than the number of
                  resources returned, such as when returning a single page (see
                  Section 3.4.2.4) of results where multiple pages are available.
                  REQUIRED.
        startIndex:
          type: integer
          minimum: 1
          description: |-
            The 1-based index of the first result in the current set
                  of list results.  REQUIRED when partial results are returned due
                  to pagination.
        itemsPerPage:
          type: integer
          description: |-
            The number of resources returned in a list response
                  page.  REQUIRED when partial results are returned due to
                  pagination.
      required:
        - Resources
        - totalResults
      x-stoplight:
        id: b11e844160d23
    MessageError:
      title: 'api:messages:2.0:Error'
      x-stoplight:
        id: zon0d9si6ldkw
      type: object
      properties:
        schemas:
          type: array
          description: Documents that the error response contains the core error message attributes
          items:
            type: string
            enum:
              - 'urn:ietf:params:scim:api:messages:2.0:Error'
            default: 'urn:ietf:params:scim:api:messages:2.0:Error'
        status:
          type: string
          description: |-
            The HTTP status code that represents the error.

            | Status                      | Applicability                 | Suggested Explanation                                                                                                                                                                                                                                       |
            |-----------------------------|-------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
            | 307 (Temporary Redirect)    | GET, POST, PUT, PATCH, DELETE | The client is directed to repeat the same HTTP request at the location identified.  The client SHOULD NOT use the location provided in the response as a permanent reference to the resource and SHOULD continue to use the original request URI [RFC7231]. |
            | 308 (Permanent Redirect)    | GET, POST, PUT, PATCH, DELETE | The client is directed to repeat the same HTTP request at the location identified.  The client SHOULD use the location provided in the response as the permanent reference to the resource [RFC7538].                                                       |
            | 400 (Bad Request)           | GET, POST, PUT, PATCH, DELETE | Request is unparsable, syntactically incorrect, or violates schema.                                                                                                                                                                                         |
            | 401 (Unauthorized)          | GET, POST, PUT, PATCH, DELETE | Authorization failure.  The authorization header is invalid or missing.                                                                                                                                                                                     |
            | 403 (Forbidden)             | GET, POST, PUT, PATCH, DELETE | Operation is not permitted based on the supplied authorization.                                                                                                                                                                                             |
            | 404 (Not Found)             | GET, POST, PUT, PATCH, DELETE | Specified resource (e.g., User) or endpoint does not exist.                                                                                                                                                                                                 |
            | 409 (Conflict)              | POST, PUT, PATCH, DELETE      | The specified version number does not match the resource's latest version number, or a service provider refused to create a new, duplicate resource.                                                                                                        |
            | 412 (Precondition Failed)   | PUT, PATCH, DELETE            | Failed to update.  Resource has changed on the server.                                                                                                                                                                                                      |
            | 413 (Payload Too Large)     | POST                          | {"maxOperations": 1000,"maxPayloadSize": 1048576}                                                                                                                                                                                                           |
            | 500 (Internal Server Error) | GET, POST, PUT, PATCH, DELETE | An internal error.  Implementers SHOULD provide descriptive debugging advice.                                                                                                                                                                               |
            | 501 (Not Implemented)       | GET, POST, PUT, PATCH, DELETE | Service provider does not support the request operation, e.g., PATCH.                                                                                                                                                                                       |
          pattern: '^[2-5][0-9][0-9]$'
          example: '400'
        scimType:
          type: string
          description: |-
            The status field is used to documment a more specific error category than the HTTP status codes support. For status code 400 there is a list of predefined options. Implementations may add additional ones.

            | scimType             | Description                                                                                                                                                                                                                                             | Applicability                                                                                     |   |   |
            |----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------|---|---|
            | invalidFilter        | The specified filter syntax was invalid (does not comply with Figure 1), or the specified attribute and filter comparison combination is not supported.                                                                                                 | GET (Section 3.4.2), POST (Search - Section 3.4.3), PATCH (Path Filter - Section 3.5.2)           |   |   |
            | tooMany              | The specified filter yields many more results than the server is willing to calculate or process.  For example a filter such as "(userName pr)" by itself would return all entries with a "userName" and MAY not be acceptable to the service provider. | GET (Section 3.4.2), POST (Search - Section 3.4.3)                                                |   |   |
            | uniqueness           | One or more of the attribute values are already in use or are reserved.                                                                                                                                                                                 | POST (Create - Section 3.3), PUT (Section 3.5.1), PATCH (Section 3.5.2)                           |   |   |
            | mutability           | The attempted modification is not compatible with the target attribute's mutability or current state (e.g. modification of an "immutable" attribute with an existing value).                                                                            | PUT (Section 3.5.1), PATCH (Section 3.5.2)                                                        |   |   |
            | invalidSyntax        | The request body message structure was invalid or did not conform to the request schema.                                                                                                                                                                | POST (Search - Section 3.4.3, Create - Section 3.3, Bulk - Section 3.7), PUT (Section 3.5.1)      |   |   |
            | invalidPath noTarget | The `path` attribute was invalid or malformed (see Figure 7).                                                                                                                                                                                           | PATCH (Section 3.5.2)                                                                             |   |   |
            | noTarget             | The specified "path" did not yield an attribute or attribute value that could be operated on.  This occurs when the specified "path" value contains a filter that yields no match.                                                                      | PATCH (Section 3.5.2)                                                                             |   |   |
            | invalidValue         | A required value was missing, or the value specified was not compatible with the operation or attribute type (see Section 2.2 of [RFC7643]), or resource schema (see Section 4 of [RFC7643]).                                                           | GET (Section 3.4.2), POST (Create - Section 3.3, PATCH (Section 3.5.2)                            |   |   |
            | invalidVers          | The specified SCIM protocol version is not supported (see Section 3.13).                                                                                                                                                                                | GET (Section 3.4.2), POST (ALL), PUT (Section 3.5.1), PATCH (Section 3.5.2), DELETE (Section 3.6) |   |   |
            | sensitive            | The specified request cannot be completed, due to the passing of sensitive (e.g., personal) information in a request URI.  For example, personal information SHALL NOT be transmitted over request URIs.  See Section 7.5.2.                            | GET (Section 3.4.2)                                                                               |   |   |
          example: invalidFilter
        detail:
          type: string
          description: A detailed human-readable message.  OPTIONAL.
          example: Here is how you can fix your error
      required:
        - schemas
        - status
    CommonResourceAttributes:
      title: Common - Resource Attributes
      x-stoplight:
        id: 9sqf7w852p8c7
      type: object
      description: |-
        Each SCIM resource (Users, Groups, etc.) includes the following
           common attributes.  With the exception of the "ServiceProviderConfig"
           and "ResourceType" server discovery endpoints and their associated
           resources, these attributes MUST be defined for all resources,
           including any extended resource types.  When accepted by a service
           provider (e.g., after a SCIM create), the attributes "id" and "meta"
           (and its associated sub-attributes) MUST be assigned values by the
           service provider.  Common attributes are considered to be part of
           every base resource schema and do not use their own "schemas" URI.
      properties:
        schemas:
          type: array
          description: |-
            contains a list of one or more URIs that
               indicate included SCIM schemas that are used to indicate the
               attributes contained within a resource.  Specific information about
               what attributes are defined within a schema MAY be obtained by
               querying a SCIM service provider's "/Schemas" endpoint for a schema
               definition (see Section 8.7 of [RFC7643])
          minItems: 1
          items:
            type: string
        id:
          type: string
          description: |-
            A unique identifier for a SCIM resource as defined by the service
             provider.  Each representation of the resource MUST include a
             non-empty "id" value.  This identifier MUST be unique across the
             SCIM service provider's entire set of resources.  It MUST be a
             stable, non-reassignable identifier that does not change when the
             same resource is returned in subsequent requests.  The value of
             the "id" attribute is always issued by the service provider and
             MUST NOT be specified by the client.  The string "bulkId" is a
             reserved keyword and MUST NOT be used within any unique identifier
             value.  The attribute characteristics are "caseExact" as "true", a
             mutability of "readOnly", and a "returned" characteristic of
             "always".  See Section 9 for additional considerations regarding
             privacy.
          readOnly: true
        externalId:
          type: string
          description: |-
            A String that is an identifier for the resource as defined by the
            provisioning client.  The "externalId" may simplify identification
            of a resource between the provisioning client and the service
            provider by allowing the client to use a filter to locate the
            resource with an identifier from the provisioning domain,
            obviating the need to store a local mapping between the
            provisioning domain's identifier of the resource and the
            identifier used by the service provider.  Each resource MAY
            include a non-empty "externalId" value.  The value of the
            "externalId" attribute is always issued by the provisioning client
            and MUST NOT be specified by the service provider.  The service
            provider MUST always interpret the externalId as scoped to the
            provisioning domain.  While the server does not enforce
            uniqueness, it is assumed that the value's uniqueness is
            controlled by the client setting the value.  See Section 9 for
            additional considerations regarding privacy.  This attribute has
            "caseExact" as "true" and a mutability of "readWrite".  This
            attribute is OPTIONAL.
        meta:
          type: object
          description: |-
            A complex attribute containing resource metadata.  All "meta"
            sub-attributes are assigned by the service provider (have a
            "mutability" of "readOnly"), and all of these sub-attributes have
            a "returned" characteristic of "default".  This attribute SHALL be
            ignored when provided by clients.  "meta" contains the following
            sub-attributes:
          properties:
            resourceType:
              type: string
              description: |-
                The name of the resource type of the resource.  This attribute has a mutability of "readOnly" and "caseExact" as "true".

                When adding a resource to a specific endpoint, the meta attribute
                   "resourceType" SHALL be set by the HTTP service provider to the
                   corresponding resource type for the endpoint.  For example, a POST to
                   the endpoint "/Users" will set "resourceType" to "User", and
                   "/Groups" will set "resourceType" to "Group".
              readOnly: true
            created:
              type: string
              format: date-time
              description: |-
                The "DateTime" that the resource was added to the service
                provider.  This attribute MUST be a DateTime.
              readOnly: true
            lastModified:
              type: string
              format: date-time
              description: |-
                The most recent DateTime that the details of this
                resource were updated at the service provider.  If this
                resource has never been modified since its initial creation,
                the value MUST be the same as the value of "created".
              readOnly: true
            location:
              type: string
              format: uri
              description: |-
                The URI of the resource being returned.  This value MUST
                be the same as the "Content-Location" HTTP response header (see
                Section 3.1.4.2 of [RFC7231]).
              readOnly: true
            version:
              type: string
              description: |-
                The version of the resource being returned.  This value
                must be the same as the entity-tag (ETag) HTTP response header
                (see Sections 2.1 and 2.3 of [RFC7232]).  This attribute has
                "caseExact" as "true".  Service provider support for this
                attribute is optional and subject to the service provider's
                support for versioning (see Section 3.14 of [RFC7644]).  If a
                service provider provides "version" (entity-tag) for a
                representation and the generation of that entity-tag does not
                satisfy all of the characteristics of a strong validator (see
                Section 2.1 of [RFC7232]), then the origin server MUST mark the
                "version" (entity-tag) as weak by prefixing its opaque value
                with "W/" (case sensitive).
              readOnly: true
      required:
        - id
    SchemaServiceProviderConfig:
      type: object
      x-examples:
        Example 1:
          schemas:
            - 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'
          documentationUri: 'http://example.com/help/scim.html'
          patch:
            supported: true
          bulk:
            supported: true
            maxOperations: 1000
            maxPayloadSize: 1048576
          filter:
            supported: true
            maxResults: 200
          changePassword:
            supported: true
          sort:
            supported: true
          etag:
            supported: true
          authenticationSchemes:
            - name: OAuth Bearer Token
              description: Authentication scheme using the OAuth Bearer Token Standard
              specUri: 'http://www.rfc-editor.org/info/rfc6750'
              documentationUri: 'http://example.com/help/oauth.html'
              type: oauthbearertoken
              primary: true
            - name: HTTP Basic
              description: Authentication scheme using the HTTP Basic Standard
              specUri: 'http://www.rfc-editor.org/info/rfc2617'
              documentationUri: 'http://example.com/help/httpBasic.html'
              type: httpbasic
          meta:
            location: 'https://example.com/v2/ServiceProviderConfig'
            resourceType: ServiceProviderConfig
            created: '2010-01-23T04:56:22Z'
            lastModified: '2011-05-13T04:42:34Z'
            version: W/"3694e05e9dff594"
      description: |-
        SCIM provides a schema for representing the service provider's
           configuration, identified using the following schema URI:
           "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig".

           The service provider configuration resource enables a service
           provider to discover SCIM specification features in a standardized
           form as well as provide additional implementation details to clients.
           All attributes have a mutability of "readOnly".  Unlike other core
           resources, the "id" attribute is not required for the service
           provider configuration resource.
      title: 'schemas:core:2.0:ServiceProviderConfig'
      properties:
        schemas:
          type: array
          description: |-
            An HTTP-addressable URL pointing to the service provider's
                  human-consumable help documentation.  OPTIONAL.
          items:
            type: string
            default: 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'
            enum:
              - 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig'
        documentationUri:
          type: string
        patch:
          type: object
          required:
            - supported
          properties:
            supported:
              type: boolean
              description: A Boolean value specifying whether or not the operation is supported.  REQUIRED.
        bulk:
          type: object
          required:
            - supported
            - maxOperations
            - maxPayloadSize
          properties:
            supported:
              type: boolean
              description: |-
                A Boolean value specifying whether or not the operation
                         is supported
            maxOperations:
              type: integer
              description: |-
                An integer value specifying the maximum number of
                         operations.  REQUIRED.
            maxPayloadSize:
              type: integer
              description: |-
                An integer value specifying the maximum payload
                         size in bytes.  REQUIRED.
        filter:
          type: object
          required:
            - supported
            - maxResults
          properties:
            supported:
              type: boolean
            maxResults:
              type: integer
        changePassword:
          type: object
          required:
            - supported
          properties:
            supported:
              type: boolean
        sort:
          type: object
          required:
            - supported
          properties:
            supported:
              type: boolean
        etag:
          type: object
          required:
            - supported
          properties:
            supported:
              type: boolean
        authenticationSchemes:
          type: array
          description: |-
            specifies supported
                  authentication scheme properties.  To enable seamless discovery of
                  configurations, the service provider SHOULD, with the appropriate
                  security considerations, make the authenticationSchemes attribute
                  publicly accessible without prior authentication.  REQUIRED.
          items:
            type: object
            properties:
              type:
                type: string
                description: |-
                  The authentication scheme.  This specification defines the
                           values "oauth", "oauth2", "oauthbearertoken", "httpbasic", and
                           "httpdigest".  REQUIRED.
                enum:
                  - oauth
                  - oauth2
                  - oauthbearertoken
                  - httpbasic
                  - httpdigest
              name:
                type: string
                description: |-
                  The common authentication scheme name, e.g., HTTP Basic.
                           REQUIRED.
              description:
                type: string
                description: |-
                  A description of the authentication scheme.
                           REQUIRED.
              specUri:
                type: string
                description: An HTTP-addressable URL pointing to the authentication       scheme's specification.  OPTIONAL.
              documentationUri:
                type: string
                description: |-
                  An HTTP-addressable URL pointing to the
                           authentication scheme's usage documentation.  OPTIONAL.
              primary:
                type: boolean
            required:
              - type
              - name
              - description
        meta:
          type: object
          properties:
            location:
              type: string
            resourceType:
              type: string
            created:
              type: string
            lastModified:
              type: string
            version:
              type: string
      required:
        - schemas
        - patch
        - bulk
        - filter
        - changePassword
        - sort
        - etag
        - authenticationSchemes
    Meta:
      type: object
      properties:
        resourceType:
          type: string
          example: User
        created:
          type: string
          format: date-time
          example: '2010-01-23T04:56:22Z'
        lastModified:
          type: string
          format: date-time
          example: '2011-05-13T04:42:34Z'
        version:
          type: string
          description: |-
            The version of the resource being returned.  This value
            must be the same as the entity-tag (ETag) HTTP response header.
            This attribute has "caseExact" as "true".  Service provider support for this
            attribute is optional and subject to the service provider's
            support for versioning.  If a
            service provider provides "version" (entity-tag) for a
            representation and the generation of that entity-tag does not
            satisfy all of the characteristics of a strong validator, then the origin server MUST mark the
            "version" (entity-tag) as weak by prefixing its opaque value
            with "W/" (case sensitive).
          example: W/"3694e05e9dff591"
        location:
          type: string
          example: 'https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: ''
    OAuth2Demo:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: 'https://sso-api-demo.apigateway.co/oauth2/auth'
          tokenUrl: 'https://sso-api-demo.apigateway.co/oauth2/token'
          scopes:
            user.admin: Read-write access to manage all users
            'user.profile:read': Read access to the profile fields of all categories of users
    OAuth2Prod:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: 'https://sso-api-prod.apigateway.co/oauth2/auth'
          tokenUrl: 'https://sso-api-prod.apigateway.co/oauth2/token'
          scopes:
            user.admin: Read-write access to manage all users
            'user.profile:read': Read access to the profile fields of all categories of users
  parameters:
    content-type-scim:
      name: Content-Type
      in: header
      required: true
      schema:
        type: string
        default: application/scim+json; charset=utf-8
        enum:
          - application/scim+json; charset=utf-8
          - application/scim+json
          - application/json
        example: application/scim+json; charset=utf-8
      description: Indicates that the request body contains content formated according to SCIM rules
    accept-scim:
      name: Accept
      in: header
      schema:
        type: string
        default: application/scim+json
        enum:
          - application/scim+json
          - application/json
        example: application/scim+json
      description: Indicates that the response body contains content formated according to SCIM rules
    accept-charset-scim:
      name: Accept-Charset
      in: header
      schema:
        type: string
        default: UTF-8
        enum:
          - UTF-8
        example: UTF-8
      description: Indicates that the response body contains content in UTF-8
    namespace:
      name: namespace
      in: path
      required: true
      schema:
        type: string
        example: VUNI
      description: Currently this must be the id of the partner that you wish to manage users for. In the future we plan to support other types of namespaces such as marketplace apps
    Content-Type:
      name: Content-Type
      in: header
      required: true
      schema:
        type: string
        default: application/scim+json
        enum:
          - application/scim+json; charset=utf-8
          - application/scim+json
          - application/json
        example: application/scim+json
      description: |-
        Indicates that the request body contains content formated according to SCIM rules

        Note [rfc7644#section-3.8](https://www.rfc-editor.org/rfc/rfc7644#section-3.8) mentions that `.scim` 
        may be added to the end of URIs instead however using URIs for content negoation may interfear with 
        adding future resouce actions like `.search`
    Accept:
      name: Accept
      in: header
      schema:
        type: string
        default: application/scim+json
        enum:
          - application/scim+json
          - application/json
        example: application/scim+json
      description: Indicates that the response body contains content formated according to SCIM rules
    Accept-Charset:
      name: Accept-Charset
      in: header
      schema:
        type: string
        default: UTF-8
        enum:
          - UTF-8
        example: UTF-8
      description: Indicates that the response body contains content in UTF-8
    attributes:
      name: attributes
      in: query
      required: false
      schema:
        type: array
        items:
          type: string
      description: |-
        SCIM service providers MUST support both `attributes` and `excludedAttributes` query parameters. 
        Clients may optionally send either of them to control which attributes are returned in responses.

        When `attributes` is provided it overrides the default set.

        When `excludedAttributes` is provided the listed attributes shall be removed from the default set. 
        This parameter SHALL have no effect on attributes whose schema "returned" setting is "always".

        Attribute names MUST be in standard attribute notation (Section 3.10) form.  See
        rfc7644 Section 3.9 for additional retrieval query parameters.
    excludedAttributes:
      name: excludedAttributes
      in: query
      required: false
      schema:
        type: array
        items:
          type: string
      description: |-
        SCIM service providers MUST support both `attributes` and `excludedAttributes` query parameters. 
        Clients may optionally send either of them to control which attributes are returned in responses.

        When `attributes` is provided it overrides the default set.

        When `excludedAttributes` is provided the listed attributes shall be removed from the default set. 
        This parameter SHALL have no effect on attributes whose schema "returned" setting is "always".

        Attribute names MUST be in standard attribute notation (Section 3.10) form.  See
        rfc7644 Section 3.9 for additional retrieval query parameters.
    filter:
      name: filter
      in: query
      required: false
      schema:
        type: string
      description: |-
        Filtering is an OPTIONAL parameter for SCIM service providers.

        [rfc7644#section-7.5.2](https://www.rfc-editor.org/rfc/rfc7644#section-7.5.2) state the following however most systems ignore it
        > Servers that receive HTTP GET requests using filters that contain
        > sensitive or confidential personal information SHOULD respond with
        > HTTP status code 403 to indicate that the operation is forbidden.  A
        > "scimType" error code of "sensitive" may be returned to indicate that
        > the request must be submitted using POST.

        Clients MAY discover service provider filter capabilities by looking
        at the "filter" attribute of the "ServiceProviderConfig" endpoint
        (see Section 4).  Clients MAY request a subset of resources by
        specifying the "filter" query parameter containing a filter
        expression.  When specified, only those resources matching the filter
        expression SHALL be returned.  The expression language that is used
        with the filter parameter supports references to attributes and literals.
        Attribute names and attribute operators used in filters are case insensitive.
        For example, the following two expressions will evaluate to the same logical value:     
        `filter=userName Eq "john"` and `filter=Username eq "john"`

        The filter parameter MUST contain at least one valid expression (see Table 3).  
        Each expression MUST contain an attribute name followed by an attribute operator and optional value.  Multiple expressions MAY    
        be combined using logical operators (see Table 4).  Expressions MAY be grouped together using round brackets "(" and ")" (see Table 5).'

        examples:
          - filter=userName eq "bjensen"
          - filter=name.familyName co "O'Malley"
          - filter=userName sw "J"
          - 'filter=urn:ietf:params:scim:schemas:core:2.0:User:userName sw "J"'
          - filter=title pr
          - 'filter=meta.lastModified gt "2011-05-13T04:42:34Z"'
          - 'filter=meta.lastModified ge "2011-05-13T04:42:34Z"'
          - 'filter=meta.lastModified lt "2011-05-13T04:42:34Z"'
          - 'filter=meta.lastModified le "2011-05-13T04:42:34Z"'
          - filter=title pr and userType eq "Employee"
          - filter=title pr or userType eq "Intern"
          - 'filter=schemas eq "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"'
          - filter=userType eq "Employee" and (emails co "example.com" or emails.value co "example.org")
          - filter=userType ne "Employee" and not (emails co "example.com" or emails.value co "example.org")
          - filter=userType eq "Employee" and (emails.type eq "work")
          - 'filter=userType eq "Employee" and emails[type eq "work" and value co "@example.com"]'
          - 'filter=emails[type eq "work" and value co "@example.com"] or ims[type eq "xmpp" and value co "@foo.com"]'
    sortBy:
      name: sortBy
      in: query
      required: false
      schema:
        type: string
      description: 'The "sortBy" parameter specifies the attribute whose value       SHALL be used to order the returned responses.  If the "sortBy"       attribute corresponds to a singular attribute, resources are       sorted according to that attribute''s value; if it''s a multi-valued       attribute, resources are sorted by the value of the primary       attribute (see Section 2.4 of [RFC7643]), if any, or else the       first value in the list, if any.  If the attribute is complex, the       attribute name must be a path to a sub-attribute in standard       attribute notation (Section 3.10), e.g., "sortBy=name.givenName".       For all attribute types, if there is no data for the specified       "sortBy" value, they are sorted via the "sortOrder" parameter,       i.e., they are ordered last if ascending and first if descending.'
    sortOrder:
      name: sortOrder
      in: query
      required: false
      schema:
        type: string
      description: 'The order in which the "sortBy" parameter is applied.       Allowed values are "ascending" and "descending".  If a value for       "sortBy" is provided and no "sortOrder" is specified, "sortOrder"       SHALL default to ascending.  String type attributes are case       insensitive by default, unless the attribute type is defined as a       case-exact string.  "sortOrder" MUST sort according to the       attribute type; i.e., for case-insensitive attributes, sort the       result using case-insensitive Unicode alphabetic sort order with       no specific locale implied, and for case-exact attribute types,       sort the result using case-sensitive Unicode alphabetic sort       order.'
    startIndex:
      name: startIndex
      in: query
      required: false
      schema:
        type: integer
        default: 1
      description: The 1-based index of the first query result.  A value less than 1 SHALL be interpreted as 1.
    count:
      name: count
      in: query
      required: false
      schema:
        type: string
      description: |-
        Non-negative integer.      
        Specifies the desired      
        maximum number of query    
        results per page, e.g.,
        10.  A negative value
        SHALL be interpreted as    
        "0".  A value of "0"
        indicates that no resource 
        results are to be returned 
        except for "totalResults". 

        There is no default value.  
        When specified
        the service provider    
        MUST NOT return more    
        results than specified
        although it MAY return  
        fewer results.  If      
        unspecified, the
        maximum number of       
        results is set by the   
        service provider.   
    If-Match:
      name: If-Match
      in: header
      required: false
      schema:
        type: string
      description: It is optional for service providers to support ETags. If supported clients may send the ETag value they recived previously in the If-Match header to prevent accientally overwritting changes made by another system.
  headers:
    ETag:
      required: false
      schema:
        type: string
        example: W/"lha5bbazU3fNvfe5"
      description: |-
        The SCIM protocol supports resource versioning via standard HTTP
        ETags (Section 2.3 of [RFC7232]).  Service providers MAY support weak
        ETags as the preferred mechanism for performing conditional
        retrievals and ensuring that clients do not inadvertently overwrite
        each other's changes, respectively.  When supported, SCIM ETags MUST
        be specified as an HTTP header and SHOULD be specified within the
        'version' attribute contained in the resource's 'meta' attribute.
        The value in the ETag header should exactly match the value in `meta.version`
    Location:
      required: true
      schema:
        type: string
        format: uri
        example: 'https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646'
      description: |-
        The value in the Location header must exactly match the value in `meta.location`
        It should identify the URI at which this resource may be retrieved from. In the case of the special "/Me" alais, it should return the actual User ID.
    Content-Type:
      required: true
      schema:
        type: string
        default: application/scim+json
        enum:
          - application/scim+json; charset=utf-8
          - application/scim+json
          - application/json
        example: application/scim+json
      description: Indicates that the response body contains content formated according to SCIM rules
  requestBodies: {}
  responses:
    error:
      description: 'https://www.rfc-editor.org/rfc/rfc7644#section-3.12 details the expected values along with some tables describing their usage.'
      headers:
        Content-Type:
          $ref: '#/components/headers/Content-Type'
      content:
        application/scim+json:
          schema:
            $ref: '#/components/schemas/MessageError'
    error-uniqueness:
      description: Another resouce exists with the same key attributes
      headers:
        Content-Type:
          $ref: '#/components/headers/Content-Type'
      content:
        application/scim+json:
          schema:
            type: object
            properties:
              schemas:
                type: array
                description: Documents that the error response contains the core error message attributes
                items:
                  type: string
                  enum:
                    - 'urn:ietf:params:scim:api:messages:2.0:Error'
                  default: 'urn:ietf:params:scim:api:messages:2.0:Error'
              status:
                type: string
                description: The HTTP status code that represents the error. This will always be 409 Conflict
                default: '409'
              scimType:
                type: string
                description: Will always be `uniqueness` - One or more of the attribute values are already in use or are reserved.
                default: uniqueness
              detail:
                type: string
                description: A detailed human-readable message.  OPTIONAL.
                example: The userName of "myCoolUser" is already in use or are reserved.
            required:
              - schemas
              - status
  examples: {}
security:
  - OAuth2Demo:
      - user.admin
  - OAuth2Prod:
      - user.admin
