Introduction

Performio exposes user management over the SCIM 2.0 protocol. SCIM endpoints are served under the /scim/v2 path and allow identity providers to provision, update and query users (Principals) within a tenant.

This document describes common usage of the API, including authentication, HTTP verbs, expected status codes and error responses, along with documentation for the available SCIM resources.

All SCIM requests and responses use the application/scim+json media type.

Overview

HTTP verbs

The SCIM API adheres as closely to REST and SCIM 2.0 conventions as possible in regard to HTTP verbs.

Verb Usage

GET

Used to retrieve a resource or a list of resources

POST

Used to create a new resource

PUT

Used to fully replace an existing resource

PATCH

Used to partially update an existing resource

HTTP status codes

The SCIM API uses conventional HTTP status codes to indicate the result of a request.

Status code Usage

200 OK

The request completed successfully.

201 Created

A new resource was created successfully. The Location header references the created resource.

400 Bad Request

The request was malformed, such as an invalid SCIM filter expression.

401 Unauthorized

The request did not include a valid tenant token.

404 Not Found

The requested resource does not exist.

409 Conflict

The request conflicts with the current state, such as a duplicate userName or externalId.

Authentication

Every request to the SCIM API must identify the calling tenant. The tenant is supplied as a signed JWT in the X-TenantToken request header. The service validates the token’s signature and extracts the tenant context (tenant id and host) used to route the request to the correct tenant database.

Header Description

X-TenantToken

A signed JWT identifying the calling tenant. Required on all SCIM requests. The token’s subject is the tenant id, and its headers carry the tenant host and the acting user.

Requests without a valid X-TenantToken header are rejected. The token is signed with a shared signing key that is configured per environment and must be overridden outside of local development.

Error responses

Errors produced by the SCIM API follow the SCIM 2.0 error format (RFC 7644, Section 3.12). The response uses the SCIM error message schema and carries the HTTP status code in the body alongside an optional scimType and detail.

{
  "schemas": [ "urn:ietf:params:scim:api:messages:2.0:Error" ],
  "status": "400",
  "scimType": "invalidFilter",
  "detail": "The specified filter syntax was invalid."
}
Field Description

schemas

The SCIM error message schema URI.

status

The HTTP status code, as a string.

scimType

A SCIM detail error keyword (present for 400 Bad Request responses), e.g. invalidFilter.

detail

A human-readable description of the error.

SCIM API

Users

The Users endpoint manages the lifecycle of users (Principals) within a tenant. Identity providers use it to provision, retrieve, search, update and deprovision users over SCIM 2.0. All requests and responses use the application/scim+json media type, and the User resource conforms to the urn:ietf:params:scim:schemas:core:2.0:User schema.

Performio extension attributes

Performio-specific attributes live on the schema extension urn:ietf:params:scim:schemas:extension:performio:2.0:User, which must be listed in schemas and supplied as an object under that URN.

Attribute Description

roles

The Performio roles the user holds: administrator (login access) and/or participant (a Performio performer record). Required on POST and PUT — a missing or empty list is rejected with 400. It is optional on PATCH; when no roles operation is present the existing role set is left unchanged.

eid

The participant’s Performio EID. Required when participant is present (400 if missing) and unique across participants (409 on a duplicate). This is distinct from the core externalId, which remains the identity provider’s correlation key.

status

The participant’s status, active or inactive, defaulting to active. This is a participant-level toggle and is distinct from the core active attribute: active gates account-level access by revoking the SCIM-managed roles, whereas status retains the role and the performer record and only marks the participant inactive.

requireChangePassword, allowSingleSignOn

Login options applied to the user’s principal when provided.

location, comments, deactivationDate

Default profile values written to the participant. deactivationDate is a yyyy-MM-dd date and is independent of status.

Two core attributes also feed the participant’s profile rather than the principal: locale, and the mobile entry of phoneNumbers (the entry whose type is mobile). Both are accepted on POST, PUT and PATCH. Because phoneNumbers is multi-valued, replacing it with a set that carries no mobile entry — or removing it — clears the stored mobile number.

Provisioning participant creates the user’s performer record, or reactivates it when one already exists — a participant is never duplicated and never deleted. Removing participant from roles (or deactivating the account with active=false) marks the performer inactive and retains it. Sending roles with participant again — on PUT, or as a PATCH operation — restores the role and reactivates the participant, unless that same request sets status itself.

On read, active is true when the user holds any SCIM-managed role (administrator or participant), and the extension carries back the user’s roles, eid and participant status.

Member-edit attributes

The extension also carries the participant’s Member-edit attributes. Each value is the target’s Performio name — an identity provider never sends dates, and the service applies none either; dating an assignment is left to the Performio application. Targets that allow a participant to hold several entries at once are string arrays; the rest carry a single string.

Attribute Type Resolved against

jobTitles

array

Job title names.

territories

array

Territory names; the participant becomes the territory’s account manager.

teamManager

array

Team names the participant manages.

teamMember

array

Team names the participant is a member of.

leaderboards

array

Leaderboard names.

plans

array

Guided plan names. Note that a plan is stored by its Performio eid; requests send and reads return the plan name, and the translation is internal.

templatedPlans

array

Templated plan names.

otc

string

The participant’s on-target commission. This is an amount rather than a name, so it is stored as sent and not resolved against anything.

segment

string

The participant’s segment.

These attributes hang off the participant’s performer record, so the user must have been provisioned as a participant; sending any of them for a user that never was is rejected with 400. The participant role only grants access: a participant whose role has since been removed keeps its performer, so its attributes are still reported and can still be updated. A name that does not identify exactly one target — because nothing matches it, or because the tenant holds more than one target with that name — is rejected with 422, and the whole request is rolled back.

Reconciliation

Each request states the complete set of values the participant should hold for the attributes it includes. The service reconciles that set against what the participant already holds:

  • a value not yet held is created;

  • a value sent again is left exactly as it is;

  • a value no longer sent is deleted outright — it is not end-dated, and its history is not retained.

The service applies no dates of its own. Dating an assignment is left to the Performio application, and the service neither reads nor writes those dates.

Re-sending an identical request is therefore a no-op: no rows are written or removed. A name repeated within one request provisions a single assignment.

Each attribute is reconciled only when the request includes it. On POST and PUT, an attribute left out of the extension is untouched, and one sent as an empty array (or a blank string, for otc and segment) removes everything held for it. PATCH behaves the same way: an operation naming an attribute reconciles it, and every other attribute is left alone.

On read, GET and the list endpoint report every value the participant holds for each attribute. An attribute holding none is left off the response rather than returned empty.

POST /scim/v2/Users

Use this method to provision (create) a new user.

Request

Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.
Fields
Path Type Description

schemas

Array

SCIM schema URIs for the request. Must include urn:ietf:params:scim:schemas:core:2.0:User.

userName

String

Unique, human-readable identifier for the user within the tenant. Required.

name.givenName

String

The user’s given (first) name.

name.familyName

String

The user’s family (last) name.

emails[].value

String

An email address for the user.

emails[].primary

Boolean

Whether this is the user’s primary email.

active

Boolean

Whether the provisioned user is active. Defaults to true when omitted.

['urn:ietf:params:scim:schemas:extension:performio:2.0:User'].roles

Array

Performio roles the user holds: administrator and/or participant. Required — a missing or empty list is rejected with 400.

['urn:ietf:params:scim:schemas:extension:performio:2.0:User'].eid

String

The participant’s Performio EID. Required when participant is present, and unique across participants (409 on a duplicate).

['urn:ietf:params:scim:schemas:extension:performio:2.0:User'].status

String

The participant’s status, active or inactive. Defaults to active. Distinct from the core active attribute, which gates account access.
Example
$ curl 'https://gateway-domain.performio.co/scim/v2/Users' -i -X POST \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json' \
    -H 'Content-Type: application/scim+json; charset=ISO-8859-1' \
    -d '{
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:performio:2.0:User" ],
  "urn:ietf:params:scim:schemas:extension:performio:2.0:User" : {
    "roles" : [ "administrator", "participant" ],
    "eid" : "EMP-001",
    "status" : "active"
  },
  "userName" : "jane.doe",
  "name" : {
    "givenName" : "Jane",
    "familyName" : "Doe"
  },
  "emails" : [ {
    "value" : "jane.doe@example.com",
    "primary" : true
  } ],
  "active" : true
}'

Response

A successful request returns 201 Created with the persisted user.

Fields
Path Type Description

id

String

Service-provider-assigned unique identifier for the user.

userName

String

The user’s unique identifier within the tenant.

active

Boolean

Whether the user is active.

meta.resourceType

String

The SCIM resource type, always User.
Example
HTTP/1.1 201 Created
Location: https://gateway-domain.performio.co/scim/v2/Users/7
Content-Type: application/scim+json
Content-Length: 655
Keep-Alive: timeout=60
Connection: keep-alive

{
  "meta" : {
    "resourceType" : "User",
    "created" : "2024-01-01T00:00:00",
    "lastModified" : "2024-01-01T00:00:00"
  },
  "id" : "7",
  "active" : true,
  "emails" : [ {
    "type" : null,
    "value" : "jane.doe@example.com",
    "primary" : true
  } ],
  "name" : {
    "familyName" : "Doe",
    "givenName" : "Jane"
  },
  "userName" : "jane.doe",
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:performio:2.0:User" ],
  "urn:ietf:params:scim:schemas:extension:performio:2.0:User" : {
    "roles" : [ "administrator", "participant" ],
    "status" : "active",
    "eid" : "EMP-001"
  }
}

GET /scim/v2/Users/{id}

Use this method to retrieve a single user by identifier.

Request

Path parameters
Table 1. /scim/v2/Users/{id}
Parameter Description

id

Service-provider-assigned identifier of the user to retrieve.
Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.
Example
$ curl 'https://gateway-domain.performio.co/scim/v2/Users/5' -i -X GET \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json'

Response

Fields
Path Type Description

id

String

Service-provider-assigned unique identifier for the user.

userName

String

The user’s unique identifier within the tenant.

name.givenName

String

The user’s given (first) name.

name.familyName

String

The user’s family (last) name.

emails[].value

String

An email address for the user.

emails[].primary

Boolean

Whether this is the user’s primary email.

active

Boolean

Whether the user is active.

meta.resourceType

String

The SCIM resource type, always User.
Example
HTTP/1.1 200 OK
Location: https://gateway-domain.performio.co/scim/v2/Users/5/5
Content-Type: application/scim+json
Content-Length: 494
Keep-Alive: timeout=60
Connection: keep-alive

{
  "meta" : {
    "resourceType" : "User"
  },
  "id" : "5",
  "active" : false,
  "emails" : [ {
    "type" : null,
    "value" : "jane.doe@example.com",
    "primary" : true
  } ],
  "name" : {
    "familyName" : "Doe",
    "givenName" : "Jane"
  },
  "userName" : "jane.doe",
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:performio:2.0:User" ],
  "urn:ietf:params:scim:schemas:extension:performio:2.0:User" : {
    "roles" : [ ]
  }
}

GET /scim/v2/Users

Use this method to list and search users. Results are returned as a SCIM ListResponse and support filtering and pagination.

Request

Query parameters
Parameter Description

filter

SCIM filter expression, e.g. userName eq "alice". Supported attributes include userName and emails.value.

startIndex

1-based index of the first result to return. Defaults to 1.

count

Maximum number of results to return in this page.
Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.
Example
$ curl 'https://gateway-domain.performio.co/scim/v2/Users?startIndex=1&count=2' -i -X GET \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json'

Response

Fields
Path Type Description

schemas

Array

SCIM schema URIs describing this response (the ListResponse message schema).

totalResults

Number

Total number of users matching the request across all pages.

startIndex

Number

1-based index of the first result in this page.

itemsPerPage

Number

Number of results actually returned in this page.

Resources[].id

String

Service-provider-assigned identifier of the user.

Resources[].userName

String

The user’s unique identifier within the tenant.
Example
HTTP/1.1 200 OK
Content-Type: application/scim+json
Content-Length: 1096
Keep-Alive: timeout=60
Connection: keep-alive

{
  "totalResults" : 3,
  "startIndex" : 1,
  "itemsPerPage" : 2,
  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:ListResponse" ],
  "Resources" : [ {
    "meta" : {
      "resourceType" : "User"
    },
    "id" : "2",
    "active" : false,
    "emails" : [ {
      "type" : null,
      "value" : "alice@example.com",
      "primary" : true
    } ],
    "name" : { },
    "userName" : "alice",
    "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:performio:2.0:User" ],
    "urn:ietf:params:scim:schemas:extension:performio:2.0:User" : {
      "roles" : [ ]
    }
  }, {
    "meta" : {
      "resourceType" : "User"
    },
    "id" : "3",
    "active" : false,
    "emails" : [ {
      "type" : null,
      "value" : "bob@example.com",
      "primary" : true
    } ],
    "name" : { },
    "userName" : "bob",
    "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:performio:2.0:User" ],
    "urn:ietf:params:scim:schemas:extension:performio:2.0:User" : {
      "roles" : [ ]
    }
  } ]
}

PUT /scim/v2/Users/{id}

Use this method to replace an existing user. All mutable attributes are overwritten with the values supplied.

Request

Path parameters
Table 2. /scim/v2/Users/{id}
Parameter Description

id

Service-provider-assigned identifier of the user to replace.
Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.
Fields
Path Type Description

schemas

Array

SCIM schema URIs for the request. Must include urn:ietf:params:scim:schemas:core:2.0:User.

userName

String

The replacement unique identifier for the user.

name.givenName

String

The replacement given (first) name.

name.familyName

String

The replacement family (last) name.

['urn:ietf:params:scim:schemas:extension:performio:2.0:User'].roles

Array

The replacement set of Performio roles. Required — a missing or empty list is rejected with 400.
Example
$ curl 'https://gateway-domain.performio.co/scim/v2/Users/1' -i -X PUT \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json' \
    -H 'Content-Type: application/scim+json; charset=ISO-8859-1' \
    -d '{
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:performio:2.0:User" ],
  "urn:ietf:params:scim:schemas:extension:performio:2.0:User" : {
    "roles" : [ "administrator" ]
  },
  "userName" : "updated.user",
  "name" : {
    "givenName" : "Updated",
    "familyName" : "User"
  }
}'

Response

Fields
Path Type Description

id

String

Service-provider-assigned unique identifier for the user.

userName

String

The user’s unique identifier within the tenant after replacement.

active

Boolean

Whether the user is active.
Example
HTTP/1.1 200 OK
Location: https://gateway-domain.performio.co/scim/v2/Users/1/1
Content-Type: application/scim+json
Content-Length: 498
Keep-Alive: timeout=60
Connection: keep-alive

{
  "meta" : {
    "resourceType" : "User",
    "created" : "2024-01-01T00:00:00",
    "lastModified" : "2024-01-01T00:00:00"
  },
  "id" : "1",
  "active" : true,
  "name" : {
    "familyName" : "User",
    "givenName" : "Updated"
  },
  "userName" : "updated.user",
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:performio:2.0:User" ],
  "urn:ietf:params:scim:schemas:extension:performio:2.0:User" : {
    "roles" : [ "administrator" ]
  }
}

PATCH /scim/v2/Users/{id}

Use this method to partially update a user with a sequence of add, replace and remove operations. This is how identity providers typically deactivate a user (replace active with false).

Request

Path parameters
Table 3. /scim/v2/Users/{id}
Parameter Description

id

Service-provider-assigned identifier of the user to patch.
Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.
Fields
Path Type Description

schemas

Array

SCIM schema URIs for the request. Must include urn:ietf:params:scim:api:messages:2.0:PatchOp.

Operations[].op

String

The patch operation: add, replace, or remove.

Operations[].path

String

Attribute path the operation targets, e.g. active.

Operations[].value

Boolean

The value to apply for add/replace operations.
Example
$ curl 'https://gateway-domain.performio.co/scim/v2/Users/6' -i -X PATCH \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json' \
    -H 'Content-Type: application/scim+json; charset=ISO-8859-1' \
    -d '{
  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:PatchOp" ],
  "Operations" : [ {
    "op" : "replace",
    "path" : "active",
    "value" : false
  } ]
}'

Response

Fields
Path Type Description

id

String

Service-provider-assigned unique identifier for the user.

userName

String

The user’s unique identifier within the tenant.

active

Boolean

Whether the user is active after the patch.
Example
HTTP/1.1 200 OK
Location: https://gateway-domain.performio.co/scim/v2/Users/6/6
Content-Type: application/scim+json
Content-Length: 481
Keep-Alive: timeout=60
Connection: keep-alive

{
  "meta" : {
    "resourceType" : "User",
    "created" : "2024-01-01T00:00:00",
    "lastModified" : "2024-01-01T00:00:00"
  },
  "id" : "6",
  "active" : false,
  "name" : {
    "familyName" : "User",
    "givenName" : "Active"
  },
  "userName" : "active.user",
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:performio:2.0:User" ],
  "urn:ietf:params:scim:schemas:extension:performio:2.0:User" : {
    "roles" : [ ]
  }
}
To deprovision a user, deactivate it with a PATCH that replaces active with false. This revokes the user’s SCIM-managed roles and clears their group assignments, and marks any participant inactive. Hard deletion (DELETE /scim/v2/Users/{id}) is not currently supported.

Groups

The Groups endpoint exposes Performio’s access groups to identity providers over SCIM 2.0. Two kinds of group are represented, distinguished by the custom groupType attribute on the urn:performio:params:scim:schemas:extension:group:2.0:Group extension:

  • User Group — a fine-grained access (FGA) user group

  • Organizational Unit — an organizational unit that scopes an administrator’s data access

Groups are defined in Performio, not by the identity provider. The provider may only list and read groups and manage their membership; creating, renaming and deleting groups is not permitted over SCIM. Each group id is prefixed with its type, e.g. USER_GROUP:admin_group or ORGANIZATIONAL_UNIT:42.

GET /scim/v2/Groups

Use this method to list and search groups. Both FGA user groups and organizational units are returned as a SCIM ListResponse, each carrying its groupType. Supports filtering on displayName and pagination.

Request

Query parameters
Parameter Description

filter

SCIM filter expression on displayName, e.g. displayName sw "User Group -".

startIndex

1-based index of the first result to return. Defaults to 1.

count

Maximum number of results to return in this page.
Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.
Example
$ curl 'https://gateway-domain.performio.co/scim/v2/Groups?startIndex=1&count=10' -i -X GET \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json'

Response

Fields
Path Type Description

schemas

Array

SCIM schema URIs describing this response (the ListResponse message schema).

totalResults

Number

Total number of groups matching the request across all pages.

startIndex

Number

1-based index of the first result in this page.

itemsPerPage

Number

Number of results actually returned in this page.

Resources[].id

String

Group identifier, prefixed with its type (USER_GROUP: or ORGANIZATIONAL_UNIT:).

Resources[].displayName

String

Human-readable group name, prefixed with its group type.
Example
HTTP/1.1 200 OK
Content-Type: application/scim+json
Content-Length: 937
Keep-Alive: timeout=60
Connection: keep-alive

{
  "totalResults" : 2,
  "startIndex" : 1,
  "itemsPerPage" : 2,
  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:ListResponse" ],
  "Resources" : [ {
    "meta" : {
      "resourceType" : "Group"
    },
    "id" : "USER_GROUP:admin_group",
    "displayName" : "User Group - Admin group",
    "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:Group", "urn:performio:params:scim:schemas:extension:group:2.0:Group" ],
    "urn:performio:params:scim:schemas:extension:group:2.0:Group" : {
      "groupType" : "User Group"
    }
  }, {
    "meta" : {
      "resourceType" : "Group"
    },
    "id" : "ORGANIZATIONAL_UNIT:42",
    "displayName" : "Organizational Unit - APAC",
    "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:Group", "urn:performio:params:scim:schemas:extension:group:2.0:Group" ],
    "urn:performio:params:scim:schemas:extension:group:2.0:Group" : {
      "groupType" : "Organizational Unit"
    }
  } ]
}

GET /scim/v2/Groups/{id}

Use this method to retrieve a single group by its type-prefixed identifier.

Request

Path parameters
Table 4. /scim/v2/Groups/{id}
Parameter Description

id

Type-prefixed group identifier, e.g. USER_GROUP:admin_group or ORGANIZATIONAL_UNIT:42.
Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.
Example
$ curl 'https://gateway-domain.performio.co/scim/v2/Groups/USER_GROUP%3Aadmin_group' -i -X GET \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json'

Response

Fields
Path Type Description

id

String

Type-prefixed group identifier.

displayName

String

Human-readable group name, prefixed with its group type.

schemas

Array

SCIM schema URIs for the resource, including the Performio group-type extension.

['urn:performio:params:scim:schemas:extension:group:2.0:Group'].groupType

String

Custom attribute distinguishing the group: User Group (FGA) or Organizational Unit.

meta.resourceType

String

The SCIM resource type, always Group.
Example
HTTP/1.1 200 OK
Location: https://gateway-domain.performio.co/scim/v2/Groups/USER_GROUP%3Aadmin_group/USER_GROUP:admin_group
Content-Type: application/scim+json
Content-Length: 362
Keep-Alive: timeout=60
Connection: keep-alive

{
  "meta" : {
    "resourceType" : "Group"
  },
  "id" : "USER_GROUP:admin_group",
  "displayName" : "User Group - Admin group",
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:Group", "urn:performio:params:scim:schemas:extension:group:2.0:Group" ],
  "urn:performio:params:scim:schemas:extension:group:2.0:Group" : {
    "groupType" : "User Group"
  }
}

PATCH /scim/v2/Groups/{id}

Use this method to change a group’s membership. This is the primary group operation: add grants the group to a user and remove revokes it. Adding a member to a User Group grants its FGA permissions (and login access); adding a member to an Organizational Unit widens that administrator’s data scope. Membership changes are idempotent, and a user may belong to several groups at once.

Request

Path parameters
Table 5. /scim/v2/Groups/{id}
Parameter Description

id

Type-prefixed group identifier whose membership is being changed.
Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.
Fields
Path Type Description

schemas

Array

SCIM schema URIs for the request. Must include urn:ietf:params:scim:api:messages:2.0:PatchOp.

Operations[].op

String

The membership operation: add or remove.

Operations[].path

String

Targets group members. Use members to add, or members[value eq "{id}"] to remove.

Operations[].value[].value

String

Identifier of the user (Principal) to add as a member.
Example
$ curl 'https://gateway-domain.performio.co/scim/v2/Groups/USER_GROUP%3Aadmin_group' -i -X PATCH \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json' \
    -H 'Content-Type: application/scim+json; charset=ISO-8859-1' \
    -d '{
  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:PatchOp" ],
  "Operations" : [ {
    "op" : "add",
    "path" : "members",
    "value" : [ {
      "value" : "1"
    } ]
  } ]
}'

Response

A successful request returns 200 OK with the group.

Example
HTTP/1.1 200 OK
Location: https://gateway-domain.performio.co/scim/v2/Groups/USER_GROUP%3Aadmin_group/USER_GROUP:admin_group
Content-Type: application/scim+json
Content-Length: 362
Keep-Alive: timeout=60
Connection: keep-alive

{
  "meta" : {
    "resourceType" : "Group"
  },
  "id" : "USER_GROUP:admin_group",
  "displayName" : "User Group - Admin group",
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:Group", "urn:performio:params:scim:schemas:extension:group:2.0:Group" ],
  "urn:performio:params:scim:schemas:extension:group:2.0:Group" : {
    "groupType" : "User Group"
  }
}

Unsupported operations

Because groups are owned by Performio, creating and deleting them over SCIM is rejected with 403 Forbidden and a SCIM error; no group is created or removed.

POST /scim/v2/Groups

HTTP/1.1 403 Forbidden
Content-Type: application/scim+json
Content-Length: 166
Keep-Alive: timeout=60
Connection: keep-alive

{
  "detail" : "Groups are defined in Performio and cannot be created via SCIM",
  "status" : "403",
  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:Error" ]
}

DELETE /scim/v2/Groups/{id}

HTTP/1.1 403 Forbidden
Content-Type: application/scim+json
Content-Length: 166
Keep-Alive: timeout=60
Connection: keep-alive

{
  "detail" : "Groups are defined in Performio and cannot be deleted via SCIM",
  "status" : "403",
  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:Error" ]
}

Schemas

The Schemas endpoint is a SCIM discovery endpoint that describes the resource types and attributes supported by the service provider. Identity providers use it to discover the shape of the User resource before provisioning.

The Performio extension attributes are not listed here. Apache SCIMple 1.0.0-M1 does not advertise registered schema extensions at this endpoint, so the extension is documented under Performio extension attributes instead. It is registered with the service, retained on inbound requests and returned on every user read.

GET /scim/v2/Schemas

Use this method to retrieve all SCIM schemas supported by the service provider.

Request

Headers
Name Description

X-TenantToken

Tenant-scoped JWT identifying the calling tenant. Required on all SCIM requests.

Example

$ curl 'https://gateway-domain.performio.co/scim/v2/Schemas' -i -X GET \
    -H 'X-TenantToken: <redacted>' \
    -H 'Accept: application/scim+json'

Response

Fields
Path Type Description

schemas

Array

SCIM schema URIs describing this response (the ListResponse message schema).

totalResults

Number

Total number of schemas supported by the service provider.

Resources

Array

The list of supported SCIM schema definitions.
Example
HTTP/1.1 200 OK
Content-Type: application/scim+json
Transfer-Encoding: chunked
Keep-Alive: timeout=60
Connection: keep-alive
Content-Length: 35200

{
  "totalResults" : 2,
  "startIndex" : 1,
  "itemsPerPage" : 2,
  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:ListResponse" ],
  "Resources" : [ {
    "id" : "urn:ietf:params:scim:schemas:core:2.0:Group",
    "name" : "Group",
    "description" : "Top level ScimGroup",
    "attributes" : [ {
      "name" : "displayName",
      "type" : "string",
      "multiValued" : false,
      "description" : "A human-readable name for the Group.",
      "required" : true,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "externalId",
      "type" : "string",
      "multiValued" : false,
      "description" : "",
      "required" : false,
      "caseExact" : true,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "id",
      "type" : "string",
      "multiValued" : false,
      "description" : "A unique identifier for a SCIM resource as defined by the service provider.",
      "required" : true,
      "caseExact" : false,
      "mutability" : "readOnly",
      "returned" : "always",
      "uniqueness" : "server"
    }, {
      "name" : "members",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "$ref",
        "type" : "reference",
        "multiValued" : false,
        "description" : "The URI corresponding to a SCIM resource that is a member of this Group.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "immutable",
        "returned" : "default",
        "uniqueness" : "none",
        "referenceTypes" : [ "User", "Group" ]
      }, {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "complex",
        "subAttributes" : [ ],
        "multiValued" : false,
        "description" : "A label indicating the type of resource, e.g., 'User' or 'Group'.",
        "required" : false,
        "canonicalValues" : [ "Group", "User" ],
        "caseExact" : false,
        "mutability" : "immutable",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "string",
        "multiValued" : false,
        "description" : "Identifier of the member of this Group.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "immutable",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "A list of members of the Group.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "meta",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "created",
        "type" : "dateTime",
        "multiValued" : false,
        "description" : "The DateTime that the resource was added to the service provider.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "lastModified",
        "type" : "dateTime",
        "multiValued" : false,
        "description" : "The most recent DateTime that the details of this resource were updated at the service provider.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "location",
        "type" : "string",
        "multiValued" : false,
        "description" : "The URI of the resource being returned.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "resourceType",
        "type" : "string",
        "multiValued" : false,
        "description" : "The name of the resource type of the resource.",
        "required" : false,
        "caseExact" : true,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "version",
        "type" : "string",
        "multiValued" : false,
        "description" : "The version of the resource being returned.  This value must be the same as the entity-tag (ETag) HTTP response header",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : false,
      "description" : "",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "always",
      "uniqueness" : "none"
    } ],
    "meta" : {
      "resourceType" : "Schema",
      "location" : "https://gateway-domain.performio.co/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group"
    }
  }, {
    "id" : "urn:ietf:params:scim:schemas:core:2.0:User",
    "name" : "User",
    "description" : "Top level ScimUser",
    "attributes" : [ {
      "name" : "active",
      "type" : "boolean",
      "multiValued" : false,
      "description" : "A Boolean value indicating the User's administrative status.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "addresses",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "country",
        "type" : "string",
        "multiValued" : false,
        "description" : "The two letter ISO 3166-1 alpha-2 country code",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "formatted",
        "type" : "string",
        "multiValued" : false,
        "description" : "The full mailing address, formatted for display or use with a mailing label. This attribute MAY contain newlines.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "locality",
        "type" : "string",
        "multiValued" : false,
        "description" : "The city or locality component.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "postalCode",
        "type" : "string",
        "multiValued" : false,
        "description" : "The zipcode or postal code component.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "primary",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "region",
        "type" : "string",
        "multiValued" : false,
        "description" : "The state or region component.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "streetAddress",
        "type" : "string",
        "multiValued" : false,
        "description" : "The full street address component, which may include house number, street name, PO BOX, and multi-line extended street address information. This attribute MAY contain newlines.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "string",
        "multiValued" : false,
        "description" : "A label indicating the attribute's function; e.g., 'aim', 'gtalk', 'mobile' etc.",
        "required" : false,
        "canonicalValues" : [ "other", "work", "home" ],
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "A physical mailing address for this User, as described in (address Element). Canonical Type Values of work, home, and other. The value attribute is a complex type with the following sub-attributes.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "displayName",
      "type" : "string",
      "multiValued" : false,
      "description" : "The name of the User, suitable for display to end-users. The name SHOULD be the full name of the User being described if known",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "emails",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "primary",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "string",
        "multiValued" : false,
        "description" : "A label indicating the attribute's function; e.g., 'work' or 'home'.",
        "required" : false,
        "canonicalValues" : [ "other", "work", "home" ],
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "string",
        "multiValued" : false,
        "description" : "E-mail addresses for the user. The value SHOULD be canonicalized by the Service Provider, e.g. bjensen@example.com instead of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and other.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "E-mail addresses for the user. The value SHOULD be canonicalized by the Service Provider, e.g. bjensen@example.com instead of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and other.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "entitlements",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "primary",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "string",
        "multiValued" : false,
        "description" : "A label indicating the attribute's function.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "string",
        "multiValued" : false,
        "description" : "The value of an entitlement.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "An entitlement may be an additional right to a thing, object, or service",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "externalId",
      "type" : "string",
      "multiValued" : false,
      "description" : "",
      "required" : false,
      "caseExact" : true,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "groups",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "$ref",
        "type" : "reference",
        "multiValued" : false,
        "description" : "The URI of the corresponding 'Group' resource to which the user belongs.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none",
        "referenceTypes" : [ "User", "Group" ]
      }, {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human-readable name, primarily used for display purposes.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "complex",
        "subAttributes" : [ ],
        "multiValued" : false,
        "description" : "A label indicating the attribute's function, e.g., 'direct' or 'indirect'.",
        "required" : false,
        "canonicalValues" : [ "indirect", "direct" ],
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "string",
        "multiValued" : false,
        "description" : "The identifier of the User's group.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "A list of groups that the user belongs to, either thorough direct membership, nested groups, or dynamically calculated",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "id",
      "type" : "string",
      "multiValued" : false,
      "description" : "A unique identifier for a SCIM resource as defined by the service provider.",
      "required" : true,
      "caseExact" : false,
      "mutability" : "readOnly",
      "returned" : "always",
      "uniqueness" : "server"
    }, {
      "name" : "ims",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "primary",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "string",
        "multiValued" : false,
        "description" : "A label indicating the attribute's function; e.g., 'aim', 'gtalk', 'mobile' etc.",
        "required" : false,
        "canonicalValues" : [ "qq", "skype", "qtalk", "aim", "icq", "yahoo", "msn", "xmpp" ],
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "string",
        "multiValued" : false,
        "description" : "Instant messaging address for the User.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "Instant messaging address for the User.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "locale",
      "type" : "string",
      "multiValued" : false,
      "description" : "Used to indicate the User's default location for purposes of localizing items such as currency, date time format, numerical representations, etc.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "meta",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "created",
        "type" : "dateTime",
        "multiValued" : false,
        "description" : "The DateTime that the resource was added to the service provider.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "lastModified",
        "type" : "dateTime",
        "multiValued" : false,
        "description" : "The most recent DateTime that the details of this resource were updated at the service provider.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "location",
        "type" : "string",
        "multiValued" : false,
        "description" : "The URI of the resource being returned.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "resourceType",
        "type" : "string",
        "multiValued" : false,
        "description" : "The name of the resource type of the resource.",
        "required" : false,
        "caseExact" : true,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "version",
        "type" : "string",
        "multiValued" : false,
        "description" : "The version of the resource being returned.  This value must be the same as the entity-tag (ETag) HTTP response header",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : false,
      "description" : "",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "always",
      "uniqueness" : "none"
    }, {
      "name" : "name",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "familyName",
        "type" : "string",
        "multiValued" : false,
        "description" : "The family name of the User, or Last Name in most Western languages (e.g. Jensen given the full name Ms. Barbara J Jensen, III.).",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "formatted",
        "type" : "string",
        "multiValued" : false,
        "description" : "The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g. Ms. Barbara J Jensen, III.).",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "givenName",
        "type" : "string",
        "multiValued" : false,
        "description" : "The given name of the User, or First Name in most Western languages (e.g. Barbara given the full name Ms. Barbara J Jensen, III.).",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "honorificPrefix",
        "type" : "string",
        "multiValued" : false,
        "description" : "The honorific prefix(es) of the User, or Title in most Western languages (e.g. Ms. given the full name Ms. Barbara J Jensen, III.).",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "honorificSuffix",
        "type" : "string",
        "multiValued" : false,
        "description" : "The honorific suffix(es) of the User, or Suffix in most Western languages (e.g. III. given the full name Ms. Barbara J Jensen, III.).",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "middleName",
        "type" : "string",
        "multiValued" : false,
        "description" : "The middle name(s) of the User (e.g. Robert given the full name Ms. Barbara J Jensen, III.).",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : false,
      "description" : "The components of the user's real name. Providers MAY return just the full name as a single string in the formatted sub-attribute, or they MAY return just the individual component attributes using the other sub-attributes, or they MAY return both. If both variants are returned, they SHOULD be describing the same name, with the formatted name indicating how the component attributes should be combined.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "nickName",
      "type" : "string",
      "multiValued" : false,
      "description" : "The casual way to address the user in real life, e.g.'Bob' or 'Bobby' instead of 'Robert'. This attribute SHOULD NOT be used to represent a User's username (e.g. bjensen or mpepperidge)",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "password",
      "type" : "string",
      "multiValued" : false,
      "description" : "The User's clear text password.  This attribute is intended to be used as a means to specify an initial password when creating a new User or to reset an existing User's password.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "never",
      "uniqueness" : "none"
    }, {
      "name" : "phoneNumbers",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "primary",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred phone number or primary phone number. The primary attribute value 'true' MUST appear no more than once.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "string",
        "multiValued" : false,
        "description" : "A label indicating the attribute's function; e.g., 'work' or 'home' or 'mobile' etc.",
        "required" : false,
        "canonicalValues" : [ "other", "pager", "work", "mobile", "fax", "home" ],
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "string",
        "multiValued" : false,
        "description" : "Phone number of the User",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "Phone numbers for the User.  The value SHOULD be canonicalized by the Service Provider according to format in RFC3966 e.g. 'tel:+1-201-555-0123'.  Canonical Type values of work, home, mobile, fax, pager and other.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "photos",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "primary",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "string",
        "multiValued" : false,
        "description" : "A label indicating the attribute's function; e.g., 'photo' or 'thumbnail'.",
        "required" : false,
        "canonicalValues" : [ "thumbnail", "photo" ],
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "reference",
        "multiValued" : false,
        "description" : "URL of a photo of the User.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none",
        "referenceTypes" : [ "external" ]
      } ],
      "multiValued" : true,
      "description" : "URLs of photos of the User.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "preferredLanguage",
      "type" : "string",
      "multiValued" : false,
      "description" : "Indicates the User's preferred written or spoken language.  Generally used for selecting a localized User interface. e.g., 'en_US' specifies the language English and country US.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "profileUrl",
      "type" : "reference",
      "multiValued" : false,
      "description" : "A fully qualified URL to a page representing the User's online profile",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none",
      "referenceTypes" : [ "external" ]
    }, {
      "name" : "roles",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "primary",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "string",
        "multiValued" : false,
        "description" : "A label indicating the attribute's function.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "string",
        "multiValued" : false,
        "description" : "The value of a role.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "A list of roles for the User that collectively represent who the User is; e.g., 'Student', 'Faculty'.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "timezone",
      "type" : "string",
      "multiValued" : false,
      "description" : "The User's time zone in the 'Olson' timezone database format; e.g.,'America/Los_Angeles'",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "title",
      "type" : "string",
      "multiValued" : false,
      "description" : "The user's title, such as \"Vice President.\"",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "userName",
      "type" : "string",
      "multiValued" : false,
      "description" : "Unique identifier for the User typically used by the user to directly authenticate to the service provider. Each User MUST include a non-empty userName value.  This identifier MUST be unique across the Service Consumer's entire set of Users.  REQUIRED",
      "required" : true,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "server"
    }, {
      "name" : "userType",
      "type" : "string",
      "multiValued" : false,
      "description" : "Used to identify the organization to user relationship. Typical values used might be 'Contractor', 'Employee', 'Intern', 'Temp', 'External', and 'Unknown' but any value may be used.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    }, {
      "name" : "x509Certificates",
      "type" : "complex",
      "subAttributes" : [ {
        "name" : "display",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "primary",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "type",
        "type" : "string",
        "multiValued" : false,
        "description" : "A label indicating the attribute's function.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }, {
        "name" : "value",
        "type" : "string",
        "multiValued" : false,
        "description" : "The value of a X509 certificate.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      } ],
      "multiValued" : true,
      "description" : "A list of certificates issued to the User.",
      "required" : false,
      "caseExact" : false,
      "mutability" : "readWrite",
      "returned" : "default",
      "uniqueness" : "none"
    } ],
    "meta" : {
      "resourceType" : "Schema",
      "location" : "https://gateway-domain.performio.co/scim/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User"
    }
  } ]
}