---
schema_version: "1"
id: 64057367bed6c5eea3695f2fa0f53a1a3cecb568cf5ef95eda49f44dd139c8f7
title: SCIM and REST API Reference Sheet
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/identity_scim_rest_api.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: aa98a48083985259c47af66c327add1d0b949251252f7b95b086bae2afc0a06b
description: To manage Salesforce user objects with SCIM, you can send REST API create, read, update, and disable (CRUD) operations to SCIM endpoints. You must supply an OAuth 2.0 access token to perform these operations.
products:
  - Security
  - Cross Cloud
release: "264"
---
# SCIM and REST API Reference Sheet

To manage Salesforce user objects with SCIM, you can send REST API create, read, update, and disable (CRUD) operations to SCIM endpoints. You must supply an OAuth 2.0 access token to perform these operations.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

For help with configuring your REST API operations, refer to these sections.

- [SCIM Endpoints and CRUD Operations](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&release=264.0.0&type=5)
- [Operation Rules](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&release=264.0.0&type=5)
- [Supported SCIM Extensions](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&release=264.0.0&type=5)
- [REST API Mappings to SCIM Attributes](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&release=264.0.0&type=5)

## SCIM Endpoints and CRUD Operations

This table lists the SCIM endpoints and their supported operations.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:44.44444444444444%">
          <col style="width:28.455284552845526%">
          <col style="width:27.10027100271003%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d69842e108">SCIM Endpoint</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d69842e111">Description</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d69842e114">Supported Operations</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="SCIM Endpoint" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e108 ">
              <samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/scim/v2/ServiceProviderConfigs</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e111 ">Request the capabilities of the Salesforce SCIM implementation.</td>

            <td data-label="Supported Operations" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e114 ">Read: <code>GET</code></td>

          </tr>
          <tr class="">
            <td data-label="SCIM Endpoint" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e108 ">
              <samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/scim/v2/Schemas</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e111 ">Introspect resources and attribute extensions.</td>

            <td data-label="Supported Operations" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e114 ">Read: <code>GET</code></td>

          </tr>
          <tr class="">
            <td data-label="SCIM Endpoint" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e108 ">
              <samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/scim/v2/ResourceTypes</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e111 ">Discover the types of resources available, such as users and entitlements.</td>

            <td data-label="Supported Operations" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e114 ">Read: <code>GET</code></td>

          </tr>
          <tr class="">
            <td data-label="SCIM Endpoint" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e108 ">
              <samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/scim/v2/Entitlements</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e111 ">
              <p>View support entitlements, such as profiles and permission sets, assigned to
                users.</p>
              <p style="margin-bottom:0;">When querying for all entitlements in an org, this endpoint returns a maximum of
                200 records. To view more than 200 records, query for specific entitlements.</p>
            </td>

            <td data-label="Supported Operations" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e114 ">Read: <code>GET</code></td>

          </tr>
          <tr class="">
            <td data-label="SCIM Endpoint" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e108 ">
              <samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/scim/v2/Roles</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e111 ">View roles assigned to users.</td>

            <td data-label="Supported Operations" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e114 ">Read: <code>GET</code></td>

          </tr>
          <tr class="">
            <td data-label="SCIM Endpoint" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e108 ">
              <p>
                <samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com</samp>
              </p>
              <p>
                <samp class="filepath">/services/scim/v2/Users</samp>
              </p>
              <p style="margin-bottom:0;">
                <samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/scim/v2/Users/&lt;user_Id&gt;</samp>
              </p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e111 ">Provision and manage user objects.</td>

            <td data-label="Supported Operations" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e114 ">
              <p>Create: <code>POST</code></p>
              <p>Read: <code>GET</code></p>
              <p>Update: <code>PATCH</code></p>
              <p style="margin-bottom:0;">Deactivate: <code>PATCH</code> or <code>DELETE</code></p>
            </td>

          </tr>
          <tr class="">
            <td data-label="SCIM Endpoint" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e108 ">
              <samp class="filepath">https://<var>MyDomainName</var>.my.salesforce.com/services/scim/v2/Groups</samp>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e111 ">View and manage public groups to which users belong.</td>

            <td data-label="Supported Operations" class="slds-cell-wrap" style="vertical-align:top;" headers="d69842e114 ">
              <p>Read: <code>GET</code></p>
              <p style="margin-bottom:0;">Update: <code>PATCH</code></p>
            </td>

          </tr>
        </tbody>
      </table>

## Operation Rules

When writing SCIM operations, keep these rules in mind.

- In a clause, `AND` doesn’t have precedence over `OR`. If a clause contains both `AND` and `OR`, explicitly add brackets to the clauses.
- In a clause, attribute names and operators are case-sensitive.
- Filter these fields on their own.
    - Users: entitlements, groups
    - Groups: members
    - Entitlements: members

## Supported SCIM Extensions

Salesforce supports these Salesforce User extensions under the URN `urn:salesforce:schemas:extension:2.0`.

- `alias`
- `callCenterId`
- `extension`
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note In the context of this URN, the `extension` field describes the user’s phone extension, not a SCIM schema extension.

Salesforce also supports these Enterprise User extensions, which show up under the URN `urn:scim:schemas:extension:enterprise:2.0`.

- `organization`
- `employeeNumber`
- `department`
- `manager` (`managerId` and `displayName`)
- `delegatedApprover` (`delegatedApproverId` and `displayName`)
- `division`

Salesforce also supports custom fields, which show up under the URN `urn:salesforce:schemas:extension:18CHARORGID`.

These supported extensions for Experience Cloud and Salesforce Customer Identity users show up under the URN `urn:salesforce:schemas:extension:external:2.0`. Customer Identity users have the Entitlements `profileId` of type `external identity`. Likewise, Experience Cloud users have the Entitlements `profileId` of type `community`.

- `accountId`
- `contactId`
- `community`

If `accountId` or `contactId` values aren't provided, Salesforce creates contact and account records for the user. The new account name is in the format `usernameJITUserAccount`. For example: `user@corpname.orgJITUserAccount`.

These extensions show up under the URN `urn:salesforce:schemas:extension:communities`.

- `networkID`
- `networkName`

## REST API Mappings to SCIM Attributes

This table shows the supported mappings of REST API object fields to SCIM schema attributes. Use this sheet as a quick reference. For a more detailed view of the supported attributes for each schema, including characteristics, send a GET request to the https://MyDomainName.my.salesforce.com/services/scim/v2/Schemas endpoint. See [Understand the SCIM Implementation](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_implementation.htm&type=5&language=en_US).

 
| REST API Object Field | SCIM Schema Attribute |
| --- | --- |
| `City` | `address.[type eq "work"].locality` |
| `CommunityNickname` | `nickName` |
| `CompanyName` | Not compatible |
| `Country` | `address.[type eq "work"].country` |
| `CreatedDate` | `created` |
| `Department` | `department` |
| `Division` | `division` |
| `Email` | `emails` |
| `EmailEncodingKey` | `emailEncodingKey` |
| `EmployeeNumber` | `employeeNumber` |
| `FederationIdentifier` | `ExternalID` |
| `FirstName` | `name.givenName` |
| `Id` | `Id` |
| `IsActive` | `active` |
| `LanguageLocaleKey` | `preferredLanguage` |
| `LastModifiedDate` | `lastModified` |
| `LastName` | `name.familyName` |
| `LocaleSidKey` | `locale` |
| `ManagerId` | `manager` |
| `MobilePhone` | `phoneNumbers.[type eq "mobile"].value` |
| `PermisisonSets` | `Entitlement` |
| `Phone` | `phoneNumbers.[type eq "work"].value` |
| `PostalCode` | `address.[type eq "work"].postalCode` |
| `ProfileId` | `Entitlement` |
| `ProfileName` | `Entitlement` |
| `State` | `address.[type eq "work"].region` |
| `TimeZoneSidKey` | `timezone` |
| `Title` | `title` |
| `Username` | `userName` |
| `UserPermissionsCallCenterAutoLogin` | Not compatible |
| `UserPermissionsMarketingUser` | Not compatible |
| `UserPermissionsOfflineUser` | Not compatible |
| `UserRoleId` | `Role` |