SCIM (Admin) API

Table of Contents

• upsquad/scim/admin/v1/admin.proto

  • Connection

  • Connection.FieldMappingsEntry

  • CreateConnectionRequest

  • CreateConnectionRequest.FieldMappingsEntry

  • CreateConnectionResponse

  • GetConnectionRequest

  • GetConnectionResponse

  • GetSyncRunRequest

  • GetSyncRunResponse

  • ListConnectionsRequest

  • ListConnectionsResponse

  • ListSyncRunsRequest

  • ListSyncRunsResponse

  • RevokeConnectionRequest

  • RevokeConnectionResponse

  • RotateTokenRequest

  • RotateTokenResponse

  • SyncError

  • SyncRun

  • UpdateConnectionRequest

  • UpdateConnectionRequest.FieldMappingsEntry

  • UpdateConnectionResponse

  • SCIMAdminService

• Scalar Value Types

Top

upsquad/scim/admin/v1/admin.proto

Connection

Connection mirrors a row of scim_connections (minus the raw token).

Field	Type	Label	Description
id	string
name	string
provider	string		provider is one of: "okta"
base_url	string
status	string		status is one of: "active"
field_mappings	Connection.FieldMappingsEntry	repeated
last_sync_at	google.protobuf.Timestamp
last_sync_status	string
token_masked	string		token_masked is a stable display identifier of the form "scim_***<hash[:4]>" derived from the stored HMAC hash.
created_at	google.protobuf.Timestamp
updated_at	google.protobuf.Timestamp

Connection.FieldMappingsEntry

Field	Type	Label	Description
key	string
value	string

CreateConnectionRequest

Field	Type	Label	Description
name	string
provider	string
base_url	string
field_mappings	CreateConnectionRequest.FieldMappingsEntry	repeated

CreateConnectionRequest.FieldMappingsEntry

Field	Type	Label	Description
key	string
value	string

CreateConnectionResponse

Field	Type	Label	Description
connection	Connection
bearer_token	string		bearer_token is returned EXACTLY ONCE on create. Stored as HMAC hash server-side; never retrievable again. Paste into IdP immediately.

GetConnectionRequest

Field	Type	Label	Description
id	string

GetConnectionResponse

Field	Type	Label	Description
connection	Connection

GetSyncRunRequest

Field	Type	Label	Description
id	string

GetSyncRunResponse

Field	Type	Label	Description
run	SyncRun

ListConnectionsRequest

Field	Type	Label	Description
page_size	int32
page_token	string

ListConnectionsResponse

Field	Type	Label	Description
connections	Connection	repeated
next_page_token	string

ListSyncRunsRequest

Field	Type	Label	Description
connection_id	string		connection_id optional — filter to runs for one connection.
status	string		status optional — one of "running"
from	google.protobuf.Timestamp
to	google.protobuf.Timestamp
page_size	int32
page_token	string

ListSyncRunsResponse

Field	Type	Label	Description
runs	SyncRun	repeated
next_page_token	string

RevokeConnectionRequest

Field	Type	Label	Description
id	string

RevokeConnectionResponse

RotateTokenRequest

Field	Type	Label	Description
id	string

RotateTokenResponse

Field	Type	Label	Description
connection	Connection
bearer_token	string

SyncError

Field	Type	Label	Description
resource_type	string
external_id	string
message	string

SyncRun

SyncRun is one execution of a scheduled or manual SCIM sync.

Field	Type	Label	Description
id	string
connection_id	string
started_at	google.protobuf.Timestamp
completed_at	google.protobuf.Timestamp
users_created	int32
users_updated	int32
users_deleted	int32
groups_created	int32
groups_updated	int32
status	string		status is one of: "running"
errors	SyncError	repeated

UpdateConnectionRequest

Field	Type	Label	Description
id	string
name	string	optional	Optional fields — presence controls whether they are updated.
status	string	optional
base_url	string	optional
field_mappings	UpdateConnectionRequest.FieldMappingsEntry	repeated
clear_field_mappings	bool		clear_field_mappings=true empties the map regardless of field_mappings value (replaces with {}). If false and field_mappings is non-empty, the new map replaces the old.

UpdateConnectionRequest.FieldMappingsEntry

Field	Type	Label	Description
key	string
value	string

UpdateConnectionResponse

Field	Type	Label	Description
connection	Connection

SCIMAdminService

SCIMAdminService exposes Connect-RPC endpoints for tenant admins to manage their SCIM connections and view sync history. All RPCs are RBAC-gated: scim.admin for writes, scim.read for reads.

Method Name	Request Type	Response Type	Description
CreateConnection	CreateConnectionRequest	CreateConnectionResponse	CreateConnection creates a new connection and returns the bearer token EXACTLY ONCE. The caller (tenant admin) pastes this token into their IdP (Okta/Azure AD/Google) as the outbound bearer.
ListConnections	ListConnectionsRequest	ListConnectionsResponse	ListConnections returns a paginated list of the caller tenant's SCIM connections. Tokens are always masked in the response.
GetConnection	GetConnectionRequest	GetConnectionResponse	GetConnection returns a single connection by ID. Token always masked.
UpdateConnection	UpdateConnectionRequest	UpdateConnectionResponse	UpdateConnection mutates name / status / base_url / field_mappings. Cannot change the bearer token — use RotateToken for that.
RotateToken	RotateTokenRequest	RotateTokenResponse	RotateToken issues a new bearer token and invalidates the old one. Returns the new raw token EXACTLY ONCE.
RevokeConnection	RevokeConnectionRequest	RevokeConnectionResponse	RevokeConnection soft-deletes the connection. External SCIM calls using its token will return 401 after this returns.
ListSyncRuns	ListSyncRunsRequest	ListSyncRunsResponse	ListSyncRuns returns paginated sync history, filterable by connection_id / status / date range.
GetSyncRun	GetSyncRunRequest	GetSyncRunResponse	GetSyncRun returns a single sync run with its full error list.

Scalar Value Types

.proto Type	Notes	C++	Java	Python	Go	C#	PHP	Ruby
double		double	double	float	float64	double	float	Float
float		float	float	float	float32	float	float	Float
int32	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
int64	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead.	int64	long	int/long	int64	long	integer/string	Bignum
uint32	Uses variable-length encoding.	uint32	int	int/long	uint32	uint	integer	Bignum or Fixnum (as required)
uint64	Uses variable-length encoding.	uint64	long	int/long	uint64	ulong	integer/string	Bignum or Fixnum (as required)
sint32	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sint64	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s.	int64	long	int/long	int64	long	integer/string	Bignum
fixed32	Always four bytes. More efficient than uint32 if values are often greater than 2^28.	uint32	int	int	uint32	uint	integer	Bignum or Fixnum (as required)
fixed64	Always eight bytes. More efficient than uint64 if values are often greater than 2^56.	uint64	long	int/long	uint64	ulong	integer/string	Bignum
sfixed32	Always four bytes.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sfixed64	Always eight bytes.	int64	long	int/long	int64	long	integer/string	Bignum
bool		bool	boolean	boolean	bool	bool	boolean	TrueClass/FalseClass
string	A string must always contain UTF-8 encoded or 7-bit ASCII text.	string	String	str/unicode	string	string	string	String (UTF-8)
bytes	May contain any arbitrary sequence of bytes.	string	ByteString	str	[]byte	ByteString	string	String (ASCII-8BIT)