Skip to main content

SCIM provisioning

This recipe shows how to set up SCIM 2.0 (System for Cross-domain Identity Management, RFC 7644) provisioning in FVI. SCIM enables your identity provider (IdP) to automatically provision, update, and deprovision users and groups in FVI as your workforce changes.

Endpoint​

GET  /scim/v2/Users
POST /scim/v2/Users
GET  /scim/v2/Groups
POST /scim/v2/Groups

FVI exposes the standard SCIM 2.0 endpoints for user and group management, compatible with all major IdPs.

Prerequisites​

  • A valid tenantId and bearer JWT.
  • The user must have the tenant_admin role.
  • An SCIM bearer token (generated separately via POST /v1/scim/tokens).

Generate an SCIM token​

curl -X POST https://api.falconveritas.com/v1/scim/tokens \
  -H "Authorization: Bearer $FVI_JWT" \
  -H "X-Tenant-Id: $FVI_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Okta SCIM",
    "description": "SCIM token for Okta provisioning",
    "expires_at": "2027-08-22T00:00:00Z",
    "idempotency_key": "scim-token-fvi-$RANDOM"
  }'

Response​

{
  "id": "scim-token-001",
  "name": "Okta SCIM",
  "token": "scim_abc123def456ghi789jkl012mno345pqr678stu901",
  "base_url": "https://api.falconveritas.com/scim/v2",
  "expires_at": "2027-08-22T00:00:00Z",
  "warning": "Store the token securely. It will not be shown again."
}

Configure your IdP​

In Okta, Entra ID, or Google Workspace, configure the SCIM provisioning with:

  • Base URL: https://api.falconveritas.com/scim/v2
  • Bearer token: the token returned above
  • Unique identifier field for users: userName (typically the email)
  • Push new users: enabled
  • Push profile updates: enabled
  • Push user deactivation: enabled
  • Sync groups: enabled (optional)

SCIM user schema​

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "alice@acmebank.com",
  "name": {
    "givenName": "Alice",
    "familyName": "Anderson"
  },
  "emails": [
    {"value": "alice@acmebank.com", "primary": true}
  ],
  "active": true,
  "title": "Senior Reconciliation Analyst",
  "fviRoles": ["tenant_analyst", "tenant_reviewer"]
}

SCIM group schema​

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "displayName": "recon-analysts",
  "members": [
    {"value": "user-001", "display": "alice@acmebank.com"},
    {"value": "user-002", "display": "bob@acmebank.com"}
  ],
  "fviTenantRole": "tenant_analyst"
}

Provisioning flow​

Use cases​

  • Onboarding — new hires are automatically provisioned in FVI on their first day.
  • Offboarding — departing employees lose FVI access automatically when deactivated in the IdP.
  • Role changes — title or department changes in the IdP propagate to FVI role assignments.
  • Audit readiness — SCIM events create audit trail entries for every provisioning action.

Code samples​

TypeScript​

import { FVI } from '@falconveritas/sdk';

const fvi = new FVI({
  baseUrl: 'https://api.falconveritas.com',
  bearer: process.env.FVI_JWT!,
  tenantId: process.env.FVI_TENANT_ID!,
});

// Generate SCIM token
const token = await fvi.scim.createToken({
  name: 'Okta SCIM',
  expiresAt: '2027-08-22T00:00:00Z',
  idempotencyKey: `scim-token-fvi-${Date.now()}`,
});

console.log('SCIM token (store securely!):', token.token);
console.log('Base URL:', token.base_url);

Python​

from falconveritas import FVI

client = FVI(
  bearer=os.environ["FVI_JWT"],
  tenant_id=os.environ["FVI_TENANT_ID"],
)

token = client.scim.create_token(
  name="Okta SCIM",
  expires_at="2027-08-22T00:00:00Z",
  idempotency_key=f"scim-token-fvi-{int(time.time())}",
)
print("SCIM token (store securely!):", token.token)
print("Base URL:", token.base_url)

Last updated: 2026-08-22 · Page owner: Documentation · Source: src/lib/api/scim.ts.