Skip to content
TriedDocs
Account

SCIM 2.0 endpoints

Provision workspace users and groups from your identity provider with SCIM 2.0.

GEThttps://api.tried.com.au/scim/v2/Users

Tried implements SCIM 2.0 Users and Groups so your identity provider can add, update and remove workspace members. SCIM users map to workspace members, and group names set their role. Authenticate with the token from Create SCIM token as Authorization: Bearer <token>.

Request#

Field Type Required Description
filter string No One attr eq "value" expression. See Filters.
startIndex integer No 1-based index of the first result. Default 1.
count integer No Results per page, 0 to 200. Default 100.

The example on this page lists users. The other routes are described below.

Example request#

curl "https://api.tried.com.au/scim/v2/Users?filter=userName%20eq%20%22jordan%40harbourdental.com.au%22" \
  -H "Authorization: Bearer $TRIED_SCIM_TOKEN"
const filter = encodeURIComponent('userName eq "jordan@harbourdental.com.au"');
const res = await fetch(`https://api.tried.com.au/scim/v2/Users?filter=${filter}`, {
  headers: { Authorization: `Bearer ${process.env.TRIED_SCIM_TOKEN}` },
});
const list = await res.json();
import os, requests

res = requests.get(
    "https://api.tried.com.au/scim/v2/Users",
    params={"filter": 'userName eq "jordan@harbourdental.com.au"'},
    headers={"Authorization": f"Bearer {os.environ['TRIED_SCIM_TOKEN']}"},
)
users = res.json()

Response#

200 OK with content type application/scim+json.

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 1,
  "startIndex": 1,
  "itemsPerPage": 1,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "id": "scim_user_1c3e5a7b9d2f4a6c8e0b2d4f",
      "externalId": "00u1a2b3c4d5e6f7g8h9",
      "userName": "jordan@harbourdental.com.au",
      "name": {
        "givenName": "Jordan",
        "familyName": "Price",
        "formatted": "Jordan Price"
      },
      "displayName": "Jordan Price",
      "emails": [
        {
          "value": "jordan@harbourdental.com.au",
          "primary": true,
          "type": "work"
        }
      ],
      "active": true,
      "groups": [
        {
          "value": "scim_group_8a0c2e4b6d8f0a2c4e6b8d0f",
          "display": "Tried Developers",
          "$ref": "https://api.tried.com.au/scim/v2/Groups/scim_group_8a0c2e4b6d8f0a2c4e6b8d0f"
        }
      ],
      "meta": {
        "resourceType": "User",
        "created": "2026-10-12T03:15:00.000Z",
        "lastModified": "2026-10-12T03:15:00.000Z",
        "location": "https://api.tried.com.au/scim/v2/Users/scim_user_1c3e5a7b9d2f4a6c8e0b2d4f"
      }
    }
  ]
}

Routes#

All routes live under /scim/v2 and use the workspace SCIM token, not an API key.

Method Path Does Success
GET /ServiceProviderConfig Capabilities: PATCH and filter supported (max 200 results); bulk, sort, ETag and change password not supported; auth scheme oauthbearertoken. Needs no token. 200
GET /ResourceTypes The User and Group resource types. Needs no token. 200
GET /Users List users, with filter, startIndex and count. 200
POST /Users Create a user and add them to the workspace. 201
GET /Users/{id} Get one user. 200
PUT /Users/{id} Replace a user's attributes. 200
PATCH /Users/{id} Change attributes with Operations, for example active: false to deactivate. 200
DELETE /Users/{id} Delete the user, remove the membership and remove them from every group. 204
GET /Groups List groups, with filter, startIndex and count. 200
POST /Groups Create a group. 201
GET /Groups/{id} Get one group. 200
PUT /Groups/{id} Replace a group's name and members. 200
PATCH /Groups/{id} Add, remove or replace members, or rename the group. 200
DELETE /Groups/{id} Delete the group. 204

User IDs start with scim_user_ and group IDs with scim_group_.

User attributes#

Attribute Type Notes
userName string Required, 3 to 320 characters.
externalId string Optional, up to 500 characters.
name.givenName, name.familyName string Optional, up to 100 characters each.
emails array Optional [{ value, primary }]. The primary email (or the first, or userName) must be an email address and becomes the Tried user.
displayName string Optional, up to 200 characters. Sets the user's name.
active boolean Default true. false removes the workspace membership and signs the user out.

PATCH /Users/{id} accepts replace, add and remove operations on active, userName, externalId, name.givenName and name.familyName, either with a path or as an object value without one.

Group attributes and roles#

Attribute Type Notes
displayName string Required, 1 to 200 characters.
externalId string Optional, up to 500 characters.
members array [{ value: "<scim user id>" }]. Unknown IDs are dropped.

The group name sets a role. A name containing admin grants admin; one containing developer or dev grants developer; one containing member grants member. Other names grant no role. A user's role is the highest role among their groups, and a user in no role group joins as member. The last admin of a workspace is never demoted or removed by SCIM.

PATCH /Groups/{id} supports add on members, remove on members or members[value eq "<id>"], replace on members, and replace on displayName.

Filters#

filter takes a single attr eq "value" expression.

Resource Attributes
Users userName (case-insensitive), externalId, emails.value (or emails)
Groups displayName (case-insensitive), externalId

Other expressions return 400 with scimType: "invalidFilter".

Errors#

SCIM errors use the SCIM error schema, not the usual Tried body:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "409",
  "scimType": "uniqueness",
  "detail": "User jordan@harbourdental.com.au already exists"
}
Status When
400 Invalid body or JSON (invalidSyntax), Unsupported filter: <filter> (invalidFilter), userName or emails must be an email address (invalidValue), or an unsupported PATCH operation.
401 Missing bearer token or Invalid SCIM token.
404 User <id> not found or Group <id> not found.
409 User <userName> already exists (uniqueness).
429 Rate limit exceeded for the IP address. See Rate limits.

Request bodies can be sent as application/scim+json or application/json.