This guide is written by the team that builds Casdoor and describes the standards as published (listed under Sources), with notes on how Casdoor implements them as of October 21, 2026. Spotted a mistake? Tell us.
SCIM (System for Cross-domain Identity Management) is a standard REST API for keeping user accounts in sync between systems. When someone joins a company, changes teams or leaves, the identity provider uses SCIM to create, update or deactivate their account in every connected app, without anyone doing it by hand.
SCIM 2.0 is defined by two IETF standards from 2015: RFC 7643 (the schema for users and groups) and RFC 7644 (the protocol).
SCIM and SSO: two halves of the job
- SSO (SAML or OpenID Connect) answers "who is signing in right now?" It happens at sign-in time.
- SCIM answers "which accounts should exist, with what attributes and groups?" It happens whenever the directory changes.
With SSO alone, an app usually creates the account the first time someone signs in (just-in-time provisioning), and it never learns when that person leaves. With SCIM, the account exists before the first sign-in, group memberships stay current, and offboarding takes effect immediately.
How SCIM works
The app that holds accounts is the SCIM service provider; the identity provider or directory that pushes changes is the SCIM client. The service provider exposes standard endpoints:
| Endpoint | What it's for |
|---|---|
/Users, /Users/{id} |
Create, read, replace, update and delete users |
/Groups, /Groups/{id} |
The same for groups and their members |
/ServiceProviderConfig, /Schemas, /ResourceTypes |
What this server supports |
A new hire is a POST:
POST /scim/Users
Content-Type: application/scim+json
Authorization: Bearer <token>
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"userName": "alice",
"name": {"givenName": "Alice", "familyName": "Smith"},
"emails": [{"value": "alice@example.com", "primary": true}],
"active": true
}
A change is a PATCH with operations such as replace, add or remove, and someone leaving is usually a PATCH that sets active to false, or a DELETE. Clients can also list users with startIndex and count to reconcile.
Why B2B apps need SCIM
Enterprise customers who buy your app expect it to fit into their identity lifecycle: "Do you support SSO?" is usually followed by "Do you support SCIM?". Without it, their IT team has to remember to remove leavers from your app by hand, which security reviews flag. Supporting SCIM is often a requirement for larger deals, and many vendors charge per SCIM connection for it.
SCIM with Casdoor
Casdoor works on both sides of SCIM:
- As a SCIM 2.0 service provider, it exposes
/scim/Usersand/scim/GroupswithGET,POST,PUT,PATCHandDELETE, plus the discovery endpoints, so a directory can provision users into Casdoor. The organization of a user is passed in the enterprise user extension. - As a SCIM client, its SCIM syncer pulls users from any SCIM 2.0 directory, alongside syncers for Active Directory, LDAP, Entra ID, Google Workspace, Okta, Keycloak and databases.
Because the users then sign in to your apps through Casdoor over OIDC or SAML, your apps get SSO and up-to-date accounts without implementing SCIM themselves. SCIM is included in every plan, with no per-connection fee. Self-host Casdoor for free, or run it on Casdoor Cloud from $24/month billed yearly. See also What is SSO.
FAQ
Is SCIM the same as LDAP? No. LDAP is a protocol for querying a directory, used at sign-in time. SCIM pushes account changes from a directory to apps over HTTPS and JSON.
What's the difference between SCIM and just-in-time provisioning? Just-in-time provisioning creates an account at first sign-in from the SSO assertion. It can't remove accounts or update people who don't sign in; SCIM can.
Is SCIM 1.1 still used? Rarely. New integrations use SCIM 2.0.
How is a SCIM endpoint secured? Usually with a bearer token or OAuth 2.0 credentials that the identity provider is configured with, over HTTPS.
Sources
Product names are trademarks of their respective owners.