REST API endpoints for SCIM - GitHub Enterprise Server 3.11 Docs

About SCIM

Note

This is an outdated, private beta version of SCIM for GitHub Enterprise Server. Customers must upgrade to 3.14 or newer and use the SCIM beta in order for their SCIM feedback or bug reports to be considered.

Warning

The beta is exclusively for testing and feedback, and no support is available. GitHub recommends testing with a staging instance. For more information, see Setting up a staging instance.

Note

These endpoints only support authentication using a personal access token (classic). For more information, see Managing your personal access tokens.

GitHub provides endpoints for use by SCIM-enabled Identity Providers (IdPs). An integration on the IdP can use the REST API to automatically provision, manage, or deprovision user accounts on a GitHub Enterprise Server instance that uses SAML single sign-on (SSO) for authentication. See Configuring user provisioning with SCIM on GitHub Enterprise Server.

These endpoints are based on SCIM 2.0. For more information, refer to your IdP's documentation or see the specification on the IETF website.

Root URLs

An IdP can use the following root URL to communicate with the endpoints in this category for a GitHub Enterprise Server instance.

http(s)://HOSTNAME/api/v3/scim/v2/

Do not include the enterprises/{enterprise}/ portion of the URLs provided in the endpoint documentation below. This part of the path is not applicable to GitHub Enterprise Server. In the future, this documentation will display the correct URLs for GitHub Enterprise Server.

Endpoints in this category are case-sensitive. For example, the first letter in the Users endpoint must be capitalized.

GET /scim/v2/Users/{scim_user_id}

Authentication

The SCIM integration on the IdP performs actions on behalf of an enterprise owner for the GitHub Enterprise Server instance. For more information, see Roles in an enterprise.

To authenticate API requests, the person who configures SCIM on the IdP must use a personal access token (classic) with the admin:enterprise scope, which the IdP must provide in the request's Authorization header. For more information about personal access tokens (classic), see Managing your personal access tokens.

Note

Enterprise owners must generate and use a personal access token (classic) for authentication of requests to endpoints in this category. Fine-grained personal access token and GitHub app callers are not supported at this time.

Mapping of SAML and SCIM data

The GitHub Enterprise Server instance links each user who authenticates successfully with SAML SSO to a SCIM identity. To link the identities successfully, the SAML IdP and the SCIM integration must use matching SAML NameID and SCIM userName values for each user.

Note

If the GitHub Enterprise Server instance uses Entra ID as a SAML IdP, GitHub will also check the SCIM externalId claim and SAML http://schemas.microsoft.com/identity/claims/objectidentifier claim to match users first, instead of using NameID and userName.

Supported SCIM user attributes

User endpoints in this category support the following attributes within a request's parameters.

Name	Type	Description
`displayName`	String	Human-readable name for a user.
`name.formatted`	String	The user's full name, including all middle names, titles, and suffixes, formatted for display.
`name.givenName`	String	The first name of the user.
`name.familyName`	String	The last name of the user.
`userName`	String	The username for the user, generated by the IdP. Undergoes normalization before being used.
`emails`	Array	List of the user's emails.
`roles`	Array	List of the user's roles.
`externalId`	String	This identifier is generated by an IdP provider. You can find the `externalId` for a user either on the IdP, or by using the List SCIM provisioned identities endpoint and filtering on other known attributes, such as a user's username or email address on the GitHub Enterprise Server instance.
`id`	String