SCIM API

Table of Contents

• upsquad/scim/v1/scim.proto

  • Connection

  • Connection.FieldMappingsEntry

  • CreateConnectionRequest

  • CreateConnectionRequest.FieldMappingsEntry

  • CreateConnectionResponse

  • DeleteConnectionRequest

  • DeleteConnectionResponse

  • GetConnectionRequest

  • GetConnectionResponse

  • GetImportJobRequest

  • GetImportJobResponse

  • ImportJob

  • ImportJobError

  • ListConnectionsRequest

  • ListConnectionsResponse

  • ListImportJobsRequest

  • ListImportJobsResponse

  • ListSyncRunsRequest

  • ListSyncRunsResponse

  • RotateBearerTokenRequest

  • RotateBearerTokenResponse

  • SyncRun

  • UpdateConnectionRequest

  • UpdateConnectionRequest.FieldMappingsEntry

  • UpdateConnectionResponse

  • ImportJobKind

  • ImportJobStatus

  • SCIMAdminService

• Scalar Value Types

Top

upsquad/scim/v1/scim.proto

Connection

Field	Type	Label	Description
id	string		id is the UUID of the scim_connections row.
name	string		name is a tenant-chosen label (e.g. "Okta — Finance").
provider	string		provider is one of okta
base_url	string		base_url is the tenant IdP's SCIM base URL, for documentation purposes.
field_mappings	Connection.FieldMappingsEntry	repeated	field_mappings overrides the default Okta-compatible attribute map.
status	string		status is one of active
bearer_token_suffix	string		bearer_token_suffix is the last 4 characters of the raw token, to let humans identify which credential an IdP is using. The full token is never returned on a read.
last_sync_at	google.protobuf.Timestamp		last_sync_at + last_sync_status report the most recent ledger row.
last_sync_status	string
created_at	google.protobuf.Timestamp
updated_at	google.protobuf.Timestamp

Connection.FieldMappingsEntry

Field	Type	Label	Description
key	string
value	string

CreateConnectionRequest

Field	Type	Label	Description
name	string
provider	string
base_url	string
field_mappings	CreateConnectionRequest.FieldMappingsEntry	repeated

CreateConnectionRequest.FieldMappingsEntry

Field	Type	Label	Description
key	string
value	string

CreateConnectionResponse

Field	Type	Label	Description
connection	Connection
bearer_token	string		bearer_token is the raw OAuth2 bearer token. Returned ONCE, and only from Create / RotateBearerToken. Callers MUST persist this into the IdP configuration immediately; it cannot be retrieved again.

DeleteConnectionRequest

Field	Type	Label	Description
id	string

DeleteConnectionResponse

GetConnectionRequest

Field	Type	Label	Description
id	string

GetConnectionResponse

Field	Type	Label	Description
connection	Connection

GetImportJobRequest

Field	Type	Label	Description
id	string

GetImportJobResponse

Field	Type	Label	Description
job	ImportJob

ImportJob

Field	Type	Label	Description
id	string
kind	ImportJobKind
connection_id	string		connection_id populated for SCIM bulk jobs only.
submitted_by	string		submitted_by is the member id that initiated a CSV upload. Empty for SCIM bulk.
status	ImportJobStatus
total_rows	int32
processed_rows	int32
error_rows	int32
errors	ImportJobError	repeated
started_at	google.protobuf.Timestamp
completed_at	google.protobuf.Timestamp
created_at	google.protobuf.Timestamp

ImportJobError

ImportJobError is a single error row from the errors JSONB column.

Field	Type	Label	Description
row_index	int32
code	string
message	string

ListConnectionsRequest

Field	Type	Label	Description
page_size	int32
page_token	int32		0-based offset

ListConnectionsResponse

Field	Type	Label	Description
connections	Connection	repeated
total_count	int32

ListImportJobsRequest

Field	Type	Label	Description
kind_filter	ImportJobKind		UNSPECIFIED = all
page_size	int32
page_token	int32

ListImportJobsResponse

Field	Type	Label	Description
jobs	ImportJob	repeated
total_count	int32

ListSyncRunsRequest

Field	Type	Label	Description
connection_id	string
page_size	int32
page_token	int32

ListSyncRunsResponse

Field	Type	Label	Description
runs	SyncRun	repeated
total_count	int32

RotateBearerTokenRequest

Field	Type	Label	Description
id	string

RotateBearerTokenResponse

Field	Type	Label	Description
connection	Connection
bearer_token	string		bearer_token is the newly-minted raw token. Returned ONCE.

SyncRun

Field	Type	Label	Description
id	string
connection_id	string
started_at	google.protobuf.Timestamp
completed_at	google.protobuf.Timestamp
users_created	int32
users_updated	int32
users_deleted	int32
groups_created	int32
groups_updated	int32
status	string

UpdateConnectionRequest

Field	Type	Label	Description
id	string
name	string
base_url	string
field_mappings	UpdateConnectionRequest.FieldMappingsEntry	repeated
status	string

UpdateConnectionRequest.FieldMappingsEntry

Field	Type	Label	Description
key	string
value	string

UpdateConnectionResponse

Field	Type	Label	Description
connection	Connection

ImportJobKind

ImportJobKind enumerates how a job was submitted.

Name	Number	Description
IMPORT_JOB_KIND_UNSPECIFIED	0
IMPORT_JOB_KIND_SCIM_BULK	1	RFC 7644 §3.7 /Bulk endpoint
IMPORT_JOB_KIND_CSV_USERS	2	admin-portal CSV → members
IMPORT_JOB_KIND_CSV_GROUPS	3	admin-portal CSV → org_units

ImportJobStatus

ImportJobStatus tracks job lifecycle.

Name	Number	Description
IMPORT_JOB_STATUS_UNSPECIFIED	0
IMPORT_JOB_STATUS_QUEUED	1
IMPORT_JOB_STATUS_RUNNING	2
IMPORT_JOB_STATUS_SUCCEEDED	3
IMPORT_JOB_STATUS_PARTIAL	4
IMPORT_JOB_STATUS_FAILED	5

SCIMAdminService

SCIMAdminService is the admin-portal-facing management surface for SCIM integrations. Tenant-scoped operations only; the wire-level /scim/v2/* endpoints live on the HTTP gateway and are served by either the hand-rolled handler or the elimity adapter.

Method Name	Request Type	Response Type	Description
CreateConnection	CreateConnectionRequest	CreateConnectionResponse	CreateConnection registers a new SCIM IdP integration. Mints and returns the raw bearer token ONCE — the response MUST be captured by the caller and propagated to the IdP.
GetConnection	GetConnectionRequest	GetConnectionResponse	GetConnection returns a connection's metadata WITHOUT the raw bearer token (only bearer_token_suffix is exposed).
ListConnections	ListConnectionsRequest	ListConnectionsResponse	ListConnections returns all non-deleted SCIM integrations for the caller's tenant.
UpdateConnection	UpdateConnectionRequest	UpdateConnectionResponse	UpdateConnection mutates non-credential fields (name, base_url, field_mappings, status). Never rotates the bearer token.
DeleteConnection	DeleteConnectionRequest	DeleteConnectionResponse	DeleteConnection soft-deletes the integration; pauses subsequent bearer-token auth lookups. scim_sync_runs rows are preserved for audit.
RotateBearerToken	RotateBearerTokenRequest	RotateBearerTokenResponse	RotateBearerToken mints a new bearer token, replacing the hash + vault-ref atomically. Returns the new raw token ONCE.
ListSyncRuns	ListSyncRunsRequest	ListSyncRunsResponse	ListSyncRuns returns a paginated view of the scim_sync_runs ledger for the admin dashboard.
ListImportJobs	ListImportJobsRequest	ListImportJobsResponse	ListImportJobs returns the per-tenant import_jobs ledger (CSV + SCIM bulk) for the admin dashboard. Works for both handler paths.
GetImportJob	GetImportJobRequest	GetImportJobResponse	GetImportJob returns a single import_job by ID (tenant-scoped).

Scalar Value Types

.proto Type	Notes	C++	Java	Python	Go	C#	PHP	Ruby
double		double	double	float	float64	double	float	Float
float		float	float	float	float32	float	float	Float
int32	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
int64	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead.	int64	long	int/long	int64	long	integer/string	Bignum
uint32	Uses variable-length encoding.	uint32	int	int/long	uint32	uint	integer	Bignum or Fixnum (as required)
uint64	Uses variable-length encoding.	uint64	long	int/long	uint64	ulong	integer/string	Bignum or Fixnum (as required)
sint32	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sint64	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s.	int64	long	int/long	int64	long	integer/string	Bignum
fixed32	Always four bytes. More efficient than uint32 if values are often greater than 2^28.	uint32	int	int	uint32	uint	integer	Bignum or Fixnum (as required)
fixed64	Always eight bytes. More efficient than uint64 if values are often greater than 2^56.	uint64	long	int/long	uint64	ulong	integer/string	Bignum
sfixed32	Always four bytes.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sfixed64	Always eight bytes.	int64	long	int/long	int64	long	integer/string	Bignum
bool		bool	boolean	boolean	bool	bool	boolean	TrueClass/FalseClass
string	A string must always contain UTF-8 encoded or 7-bit ASCII text.	string	String	str/unicode	string	string	string	String (UTF-8)
bytes	May contain any arbitrary sequence of bytes.	string	ByteString	str	[]byte	ByteString	string	String (ASCII-8BIT)