Custom SCIM 2.0 Provisioning

Use this guide when your identity provider or provisioning client supports SCIM 2.0 but is not covered by the Okta, OneLogin, or Microsoft Entra guides. SAML support alone does not imply SCIM support.

Before You Start

• The provisioning client must support HTTPS SCIM 2.0 and static HTTP Bearer authentication.
• Create and test the matching SAML provider in Revspire first.
• The Revspire organization must have an active Revspire Deal Room entitlement.
• Have View SSO Settings, Edit SSO Providers, and Generate API Tokens permissions.
• Configure a default internal profile unless the client sends an explicit profile mapping, and configure an eligible default product when users should be created active.
• Start with a non-production user and group.

Step 1: Copy Revspire SCIM Values

In Revspire > Setup > SSO, select the required provider and click SCIM Config.

Base URL = <Revspire SCIM Base URL>
Authentication = Bearer token
Token = <generate and copy once>

Authorization: Bearer <SCIM_TOKEN>
Accept: application/scim+json
Content-Type: application/scim+json

Step 2: Discover Capabilities

GET <BASE_URL>/ServiceProviderConfig
GET <BASE_URL>/Schemas
GET <BASE_URL>/ResourceTypes

Revspire supports SCIM Users and Groups with filtering and PATCH. Bulk operations, password synchronization, sorting, and ETags are not supported.

Step 3: Configure User Mapping

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "userName": "person@example.com",
  "externalId": "immutable-idp-user-id",
  "name": {
    "givenName": "Example",
    "familyName": "Person"
  },
  "emails": [
    {
      "value": "person@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true
}

userName and a non-empty primary email are required. If no email is marked primary, the first entry must be non-empty. Use an immutable provider identifier for externalId.

Optional Profile Mapping

The recommended configuration is a default profile in Revspire. A client that supports custom schema extensions can instead send:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User",
    "urn:ietf:params:scim:schemas:extension:revspire:2.0:User"
  ],
  "urn:ietf:params:scim:schemas:extension:revspire:2.0:User": {
    "profileName": "Sales"
  }
}

The selected profile must be active, internal, and unambiguous. Product entitlement is managed in Revspire; a provider default supplies an eligible product when required, while an existing valid assignment may be retained.

Step 4: Configure Group Mapping

Create or discover the users first, then use the Revspire user IDs returned by SCIM as group member values.

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "displayName": "Revenue Team",
  "externalId": "immutable-idp-group-id",
  "members": [
    { "value": "<REVSPIRE_SCIM_USER_ID>" }
  ]
}

Supported Resources and Filters

Users:
POST /Users
GET /Users
GET /Users/{id}
PUT /Users/{id}
PATCH /Users/{id}
DELETE /Users/{id}

User filters:
userName eq "value"
id eq "value"
emails.value eq "value"
externalId eq "value"

Groups:
POST /Groups
GET /Groups
GET /Groups/{id}
PUT /Groups/{id}
PATCH /Groups/{id}
DELETE /Groups/{id}

Group filters:
displayName eq "value"
id eq "value"
externalId eq "value"

Lifecycle and Error Handling

• DELETE soft-deactivates users and groups.
• 400 indicates an invalid payload, missing email, invalid profile mapping, or invalid same-provider membership reference.
• 401 means the Bearer token or its stored provider scope is invalid, inactive, expired, revoked, or no longer available.
• 403 indicates an attempt to modify a resource not owned by this provider connection.
• 409 indicates a uniqueness conflict, ambiguous profile name, or unavailable product seat. Do not retry without correcting the source data or capacity.
• 422 indicates missing or misconfigured defaults, product dependency configuration, or incomplete organization defaults.

See the SCIM Provisioning overview for provider ownership and rollout guidance.