SCIM API Reference

This page documents the SCIM 2.0 endpoints axe Account exposes for user and group provisioning. In most cases your identity provider's SCIM connector calls these endpoints for you; this reference is for teams building a custom integration or validating behavior directly.

axe implements the SCIM 2.0 standard (RFC 7643 / RFC 7644). This page focuses on axe-specific behavior. For the generic protocol, refer to the SCIM specifications.

Base URL and authentication

All endpoints are served under /api/scim/v2 on your regional or private base URL:

https://axe.deque.com/api/scim/v2

Authenticate every request with your SCIM API key:

-H "X-API-Key: <API_KEY>"
# or
-H "Authorization: <API_KEY>"

See Prerequisites & Setup to obtain a key and base URL.

Conventions

• Content type: application/json
• Error responses use the SCIM error schema:

  {
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
    "detail": "<message>",
    "status": <code>
  }

• Pagination (Users): startIndex (1-based) and count (1–100).
• Filtering (Users, Groups): filter using the eq operator, e.g. userName eq "user@example.com".

Users

List users

GET /api/scim/v2/Users

Returns members of your enterprise. Supports pagination and filtering.

Query parameters

Example

curl -H "X-API-Key: $KEY" \
  "https://axe.deque.com/api/scim/v2/Users?count=10&startIndex=1"

Response 200 OK

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 42,
  "itemsPerPage": 10,
  "startIndex": 1,
  "Resources": [
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
      "id": "5f3e...c2",
      "userName": "user@example.com",
      "active": true,
      "name": { "givenName": "Alex", "familyName": "Doe" },
      "emails": [
        { "primary": true, "value": "user@example.com", "type": "work", "display": "user@example.com" }
      ],
      "groups": [
        { "value": "grp-1", "display": "Axe Monitor", "$ref": "/Groups/grp-1" }
      ],
      "meta": { "resourceType": "User", "location": "/Users/5f3e...c2" }
    }
  ]
}

Errors

Get a user

GET /api/scim/v2/Users/{id}

Returns a single user by their axe user ID. active reflects enterprise membership.

Response 200 OK — a User resource (see above).

Errors

Create a user

POST /api/scim/v2/Users

Provisions a user: creates the axe account, adds them to your enterprise, and sends an invitation email. A groups value in the body is ignored — assign product access separately via PATCH /Groups.

Request body

Example

curl -X POST -H "X-API-Key: $KEY" -H "Content-Type: application/json" \
  -d '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "userName": "user@example.com",
    "name": { "givenName": "Alex", "familyName": "Doe" },
    "emails": [{ "type": "work", "value": "user@example.com", "primary": true }],
    "active": true
  }' \
  "https://axe.deque.com/api/scim/v2/Users"

Response 201 Created — the created User resource.

Errors

Replace a user

PUT /api/scim/v2/Users/{id}

Updates a user's name and email.

Request body

Response 200 OK — the updated User resource.

Errors

Activate or deactivate a user

PATCH /api/scim/v2/Users/{id}

Sets enterprise membership. active: true adds the user to the enterprise; active: false deprovisions them (removes membership; the account is retained).

Request body

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    { "op": "replace", "value": { "active": false } }
  ]
}

Response 204 No Content

Errors

Deprovision a user

DELETE /api/scim/v2/Users/{id}

Removes the user from your enterprise (soft removal — the account is retained).

Response 204 No Content

Errors

Groups

Groups are either product subscriptions (grant a product seat) or teams (organize users). See How SCIM Works with axe Account.

List groups

GET /api/scim/v2/Groups

Returns all product subscriptions and teams for your enterprise. This endpoint is not paginated.

Query parameters

Response 200 OK

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 5,
  "startIndex": 1,
  "itemsPerPage": 5,
  "Resources": [
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
      "id": "grp-1",
      "displayName": "Axe Monitor",
      "members": [
        { "value": "5f3e...c2", "display": "user@example.com", "$ref": "/Users/5f3e...c2" }
      ]
    }
  ]
}

Get a group

GET /api/scim/v2/Groups/{id}

Response 200 OK — a Group resource.

Errors

Create a group

POST /api/scim/v2/Groups

Creates a team. If displayName exactly matches the name of a product your enterprise holds an active subscription for, no team is created — the existing product subscription group is returned instead (201, with its id and Location), and any members in the request body are ignored. Manage that group's membership through PATCH /Groups/{id}.

Matching is case-sensitive and exact. If the name matches a product whose subscription is not active, a regular team is created with that name instead — it will not grant product seats.

Request body

Response 201 Created — the created Group resource, with a Location header.

Errors

Update group membership

PATCH /api/scim/v2/Groups/{id}

Adds or removes members. For a subscription group, this grants or revokes a product seat. For a team group, this changes team membership.

Request body

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    { "op": "add", "path": "members", "value": [ { "value": "5f3e...c2" } ] }
  ]
}

Use op: "remove" with a path to remove members. A replace with an empty array removes all members.

Response 204 No Content

Errors

Delete a group

DELETE /api/scim/v2/Groups/{id}

Deletes a team. Delete requests against a product subscription group are ignored (returns 204).

Response 204 No Content

Errors

Update a group (not supported)

PUT /api/scim/v2/Groups/{id}

Not supported. Returns 405 Method not allowed. Use PATCH to modify membership.

Discovery endpoints

These support automatic connector configuration. All return 200 OK.

Related

• How SCIM Works with axe Account
• Configuring Your Identity Provider
• Troubleshooting