{"templateId":"markdown","sharedDataIds":{},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Okta Inbound SCIM 2.0 API","description":"Okta Developer API Reference","siteUrl":"https://developer.okta.com","keywords":"okta, api reference docs","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"okta-inbound-scim-20-api","__idx":0},"children":["Okta Inbound SCIM 2.0 API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Okta hosts a SCIM server for each app instance so that an external SCIM client (an HR system, another identity provider, or any system that speaks SCIM) can provision and manage identity data directly into Okta. Okta's inbound SCIM 2.0 API specification is based on ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc7644"},"children":["RFC 7644"]}," (SCIM Protocol) and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc7643"},"children":["RFC 7643"]}," (SCIM Core Schema)."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The SCIM protocol is an app-level REST protocol for provisioning and managing identity data on the web. The protocol supports creation, discovery, retrieval, and modification of core identity resources."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"inbound-compared-with-outbound-scim","__idx":1},"children":["Inbound compared with outbound SCIM"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This reference describes ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["inbound"]}," SCIM, where Okta acts as the SCIM server and an external client provisions identities ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["into"]}," Okta."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you're instead implementing a SCIM server that Okta provisions ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["into"]}," — that is, Okta acts as the SCIM client — see the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/okta-scim/guides/index"},"children":["Okta Outbound SCIM Protocol"]}," reference."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"base-url","__idx":2},"children":["Base URL"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each inbound SCIM connection has its own base URL:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"https://{yourOktaDomain}/{connectionId}/scim/v2\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["connectionId"]}," is a path variable that identifies a single inbound SCIM connection. Okta generates it when you configure an inbound SCIM app instance, and you supply it to the external SCIM client along with the bearer token."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication","__idx":3},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every request must present the connection's bearer token in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Authorization: Bearer {token}\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token is an opaque string. Clients must not attempt to parse or interpret its contents."]}]},"headings":[{"value":"Okta Inbound SCIM 2.0 API","id":"okta-inbound-scim-20-api","depth":1},{"value":"Inbound compared with outbound SCIM","id":"inbound-compared-with-outbound-scim","depth":2},{"value":"Base URL","id":"base-url","depth":2},{"value":"Authentication","id":"authentication","depth":2}],"frontmatter":{"seo":{"title":"Okta Inbound SCIM 2.0 API"}},"lastModified":"2026-09-18T19:36:03.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/openapi/okta-scim/inbound/overview","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}