# Understanding PAM360 SCIM APIs

## Introduction

SCIM APIs serve as the foundation for seamlessly integrating identity management processes across various systems and applications. With [SCIM implementation](https://www.manageengine.com/privileged-access-management/help/scim-config.html) in PAM360, SCIM APIs enable administrators to automate user and group provisioning tasks, ensuring efficient management of access to critical resources. SCIM APIs use the GET, POST, PUT, PATCH, and DELETE methods to offer a wide range of CRUD operations.

To access PAM360 SCIM APIs, authentication from PAM360 is required. This involves creating a REST API user account with the respective role and using the generated user authentication token for authentication purposes. The generated authentication token can be sent in two ways for authentication:

- As an Authentication Token header, similar to REST APIs.
- As a Bearer Token in the Authorization header.
- As an authentication token in the authorization header

This document will help you understand the supported SCIM endpoints, APIs, and attributes. The supported SCIM endpoints are listed below:

| Users |  |
|---|---|
|  | - [Get User](#get_user)<br>- [Get All Users](#get_all_users)<br>- [Create a New User](#create_a_new_user)<br>- [Update User Details](#update_user_details)<br>- [Patch User Details](#patch_user_details) |

| Groups |  |
|---|---|
|  | - [Get Details of a Group](#get_details_of_a_group)<br>- [Get Details of All Groups](#get_details_of_all_groups)<br>- [Create a Group](#create_a_group)<br>- [Update Group Details](#update_group_details)<br>- [Patch Group](#patch_group)<br>- [Delete Group](#delete_group) |

| SCIM Configuration |  |
|---|---|
| [SCIM Configuration](#serviceproviderconfig) | - [Get SCIM Implementation Details](#get_scim_implementation_details) |
| [Schemas](#schemas) | - [Get a Schema](#get_a_schema)<br>- [Get All Schemas](#get_all_schemas) |
| [ResourceTypes](#resourcetypes) | - [Get a Resource Type](#get_a_resource_type)<br>- [Get all Resource Types](#get_all_resource_types) |

## 1. Users

To manage users in PAM360, you can make use of the PAM360 SCIM APIs provided in this section.

### Supported Core Attributes

| Attributes | Data type | Required? (for POST) | Required? (for PUT) |
|---|---|---|---|
| userName | String | Yes | No |
| givenName | String | Yes | Yes |
| familyName | String | Yes | Yes |
| emails | Array | Yes | Yes |
| password | String | No | No |
| roles | Array | Yes | No |
| active | Boolean | Yes | No |

### Supported Custom Schema Extension Attributes

urn:ietf:params:scim:schemas:extension:pam360_domain:2.0:User:userType  
urn:ietf:params:scim:schemas:extension:pam360_domain:2.0:User:domain

| Attributes | Types | Descriptions |
|---|---|---|
| userType | 0 \| 1 \| 2 \| 3 | Types of users. 0 - Local, 1 - AD, 2 - Entra ID, 3 - LDAP. |
| domain | String | Domain to which the domain user is affiliated. |

Below are the PAM360 SCIM APIs for the User endpoint:

### 1.1 Get User

**Description**

To get the details of a user in PAM360.

**URL**

```
https://<Host-Name-of-PAM360-Server OR IP address>:<Port>/scim/v2/Users/{userId}
```

**HTTP Method**

GET

**Sample Request**

```
https://<Host-Name-of-PAM360-Server OR IP address>:<Port>/scim/v2/Users/2101
```

**Sample Response**

```json
{
  "emails": [
    {
      "type": "work",
      "value": "john@teams.com",
      "primary": true
    }
  ],
  "roles": [
    {
      "value": "Privileged Administrator",
      "primary": true
    }
  ],
  "meta": {
    "created": "2024-02-29 13:54:37.451",
    "location": "https://192.168.176.251:8282/scim/v2/Users/2101",
    "resourceType": "User"
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "name": {
    "givenName": "John",
    "familyName": "G"
  },
  "active": true,
  "id": 2101,
  "userName": "john@teams.onmicrosoft.com",
  "urn:ietf:params:scim:schemas:extension:pam360_domain:2.0:User": {
    "userType": "0"
  }
}
```