Okta hosts a SCIM server for each app instance so that an external SCIM client (an HR system, another identity provider, or any system that speaks SCIM) can provision and manage identity data directly into Okta. Okta's inbound SCIM 2.0 API specification is based on RFC 7644 (SCIM Protocol) and RFC 7643 (SCIM Core Schema).
The SCIM protocol is an app-level REST protocol for provisioning and managing identity data on the web. The protocol supports creation, discovery, retrieval, and modification of core identity resources.
This reference describes inbound SCIM, where Okta acts as the SCIM server and an external client provisions identities into Okta.
If you're instead implementing a SCIM server that Okta provisions into — that is, Okta acts as the SCIM client — see the Okta Outbound SCIM Protocol reference.
Each inbound SCIM connection has its own base URL:
https://{yourOktaDomain}/{connectionId}/scim/v2connectionId is a path variable that identifies a single inbound SCIM connection. Okta generates it when you configure an inbound SCIM app instance, and you supply it to the external SCIM client along with the bearer token.
Every request must present the connection's bearer token in the Authorization header:
Authorization: Bearer {token}The token is an opaque string. Clients must not attempt to parse or interpret its contents.