This version of GitHub Enterprise Server was discontinued on 2025-04-03. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise Server. For help with the upgrade, contact GitHub Enterprise support.

The REST API is now versioned. For more information, see "About API versioning."

REST API endpoints for SCIM

Use the REST API to automate user creation and team memberships with SCIM.

About SCIM

Note

This is an outdated, private beta version of SCIM for GitHub Enterprise Server. Customers must upgrade to 3.14 or newer and use the SCIM beta in order for their SCIM feedback or bug reports to be considered.

Warning

The beta is exclusively for testing and feedback, and no support is available. GitHub recommends testing with a staging instance. For more information, see Setting up a staging instance.

Note

These endpoints only support authentication using a personal access token (classic). For more information, see Managing your personal access tokens.

GitHub provides endpoints for use by SCIM-enabled Identity Providers (IdPs). An integration on the IdP can use the REST API to automatically provision, manage, or deprovision user accounts on a GitHub Enterprise Server instance that uses SAML single sign-on (SSO) for authentication. See Configuring user provisioning with SCIM on GitHub Enterprise Server.

These endpoints are based on SCIM 2.0. For more information, refer to your IdP's documentation or see the specification on the IETF website.

Root URLs

An IdP can use the following root URL to communicate with the endpoints in this category for a GitHub Enterprise Server instance.

http(s)://HOSTNAME/api/v3/scim/v2/

Do not include the enterprises/{enterprise}/ portion of the URLs provided in the endpoint documentation below. This part of the path is not applicable to GitHub Enterprise Server. In the future, this documentation will display the correct URLs for GitHub Enterprise Server.

Endpoints in this category are case-sensitive. For example, the first letter in the Users endpoint must be capitalized.

GET /scim/v2/Users/{scim_user_id}

Authentication

The SCIM integration on the IdP performs actions on behalf of an enterprise owner for the GitHub Enterprise Server instance. For more information, see Roles in an enterprise.

To authenticate API requests, the person who configures SCIM on the IdP must use a personal access token (classic) with the admin:enterprise scope, which the IdP must provide in the request's Authorization header. For more information about personal access tokens (classic), see Managing your personal access tokens.

Note

Enterprise owners must generate and use a personal access token (classic) for authentication of requests to endpoints in this category. Fine-grained personal access token and GitHub app callers are not supported at this time.

Mapping of SAML and SCIM data

After a GitHub Enterprise Server user successfully authenticates using SAML SSO, GitHub links the user to a SCIM provisioned identity. To link the identities successfully, the SAML identity provider and the SCIM integration must use matching unique identifiers.

When a mismatch between a user's SAML and SCIM data occurs, GitHub will return an error stating which attributes from SAML and SCIM did not match. For more information on this error, see Troubleshooting identity and access management for your enterprise.

GitHub requires the following SAML claim and SCIM attribute to successfully match the user with the identity provisioned by SCIM. Identity providers may differ in the field used to uniquely identify a user.

Microsoft Entra ID for SAML

To use Entra ID (previously known as Azure AD) for SAML, the following SAML claims and SCIM attribute must match.

SAML claim	Matching SCIM attribute
`http://schemas.microsoft.com/identity/claims/objectidentifier`	`externalId`

Other IdPs for SAML

To use other IdPs for SAML, GitHub will use the "Username" attribute configured in your SAML "User attributes" to match against the SCIM attribute listed below. If left blank, the "Username" attribute in your SAML "User attributes" will default to the SAML NameID. For more information about SAML configurations, see Configuring SAML single sign-on for your enterprise.

SAML claim	Matching SCIM attribute
"Username" attribute configured in your SAML "User attributes", or `NameID` if left blank	`userName`

Supported SCIM user attributes

User endpoints in this category support the following attributes within a request's parameters.

Name	Type	Description
`displayName`	String	Human-readable name for a user.
`name.formatted`	String	The user's full name, including all middle names, titles, and suffixes, formatted for display.
`name.givenName`	String	The first name of the user.
`name.familyName`	String	The last name of the user.
`userName`	String	The username for the user, generated by the IdP. Undergoes normalization before being used.
`emails`	Array	List of the user's emails.
`roles`	Array	List of the user's roles.
`externalId`	String	This identifier is generated by an IdP provider. You can find the `externalId` for a user either on the IdP, or by using the List SCIM provisioned identities endpoint and filtering on other known attributes, such as a user's username or email address on the GitHub Enterprise Server instance.
`id`	String	Identifier generated by the instance's SCIM endpoint.
`active`	Boolean	Indicates whether the identity is active (`true`) or should be suspended (`false`).

List provisioned SCIM groups for an enterprise

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Lists provisioned SCIM groups in an enterprise.

You can improve query search time by using the excludedAttributes query parameter with a value of members to exclude members from the response.

Fine-grained access tokens for "List provisioned SCIM groups for an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise SCIM" business permissions (read)

Parameters for "List provisioned SCIM groups for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name. You can also substitute this value with the enterprise id.

Query parameters
Name, Type, Description
`filter` string If specified, only results that match the specified filter will be returned. Multiple filters are not supported. Possible filters are `externalId`, `id`, and `displayName`. For example, `?filter=externalId eq "9138790-10932-109120392-12321"`.
`excludedAttributes` string Excludes the specified attribute from being returned in the results. Using this parameter can speed up response time.
`startIndex` integer Used for pagination: the starting index of the first result to return when paginating through values. Default: `1`
`count` integer Used for pagination: the number of results to return per page. Default: `30`

HTTP response status codes for "List provisioned SCIM groups for an enterprise"

Status code	Description
`200`	Success, either groups were found or not found
`400`	Bad request
`401`	Authorization failure
`403`	Permission denied
`429`	Too many requests
`500`	Internal server error

Code samples for "List provisioned SCIM groups for an enterprise"

Request example

get/scim/v2/enterprises/{enterprise}/Groups

curl -L \
  -H "Accept: application/scim+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  http(s)://HOSTNAME/api/v3/scim/v2/enterprises/ENTERPRISE/Groups

Success, either groups were found or not found

Status: 200

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 1,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "externalId": "8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159",
      "id": "24b28bbb-5fc4-4686-a153-a020debb1155",
      "displayName": "Engineering",
      "members": [
        {
          "value": "879db59-3bdf-4490-ad68-ab880a2694745",
          "$+ref": "https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745",
          "displayName": "User 1"
        },
        {
          "value": "0db508eb-91e2-46e4-809c-30dcbda0c685",
          "$+ref": "https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685",
          "displayName": "User 2"
        }
      ],
      "meta": {
        "resourceType": "Group",
        "created": "2012-03-27T19:59:26.000Z",
        "lastModified": "2018-03-27T19:59:26.000Z",
        "location": "https://api.github.localhost/scim/v2/Groups/24b28bbb-5fc4-4686-a153-a020debb1155"
      }
    }
  ],
  "startIndex": 1,
  "itemsPerPage": 20
}

Provision a SCIM enterprise group

Note

The SCIM API endpoints for enterprise accounts are currently in private preview and are subject to change.

Creates a SCIM group for an enterprise.

If members are included as part of the group provisioning payload, they will be created as external group members. It is up to a provider to store a mapping between the externalId and id of each user.

Fine-grained access tokens for "Provision a SCIM enterprise group"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise SCIM" business permissions (write)