GitHub Attribute API

openapi: 3.2.0
info:
  version: 1.1.4
  title: GitHub SCIM Attribute API
  description: The GitHub SCIM (System for Cross-domain Identity Management) API enables automated user provisioning and deprovisioning for GitHub Enterprise Cloud organizations through identity providers like Azure AD, Okta, or OneLogin. This API allows IT administrators to programmatically manage user identities, group memberships, and access permissions by synchronizing user data from their organization's identity management system directly to GitHub. With SCIM, you can automatically create new users when employees join, update user information when it changes in your identity provider, remove access when employees leave, and manage team memberships based on directory groups—streamlining user lifecycle management and ensuring consistent access control across your organization's GitHub resources.
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  contact:
    name: Support
    url: https://support.github.com/contact?tags=dotcom-rest-api
  x-github-plan: ghes
  x-github-release: 3.9
servers:
- url: '{protocol}://{hostname}/api/v3'
  variables:
    hostname:
      description: Self-hosted Enterprise Server hostname
      default: HOSTNAME
    protocol:
      description: Self-hosted Enterprise Server protocol
      default: http
tags:
- name: Attribute
paths:
  /scim/v2/Groups/{scim_group_id}:
    patch:
      summary: GitHub Update an Attribute for Scim Enterprise Group
      description: '**Note:** The SCIM API endpoints for enterprise accounts are currently in *private* beta and are subject to change.


        Update a provisioned group’s individual attributes.


        To change a group’s values, you must provide a specific Operations JSON format that contains at least one of the add, remove, or replace operations. For examples and more information on the SCIM operations format, see the [SCIM specification](https://tools.ietf.org/html/rfc7644#section-3.5.2).  Update can also be used to add group memberships.


        Group memberships can be sent one at a time or in batches for faster performance. **Note**: The memberships are referenced through a local user `id`, and the user will need to be created before they are referenced here.'
      operationId: updateAnAttributeForScimEnterpriseGroup
      tags:
      - Attribute
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/enterprise-admin/scim#update-an-attribute-for-a-scim-enterprise-group
      parameters:
      - $ref: '#/components/parameters/scim-group-id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/patch-schema'
            examples:
              updateGroup:
                summary: Update Group
                value:
                  schemas:
                  - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                  - op: replace
                    path: displayName
                    value: Employees
              addMembers:
                summary: Add Members
                value:
                  schemas:
                  - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                  - op: add
                    path: members
                    value:
                    - value: 879db59-3bdf-4490-ad68-ab880a2694745
                    - value: 0db508eb-91e2-46e4-809c-30dcbda0c685
      responses:
        '200':
          description: Success, group was updated
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/scim-enterprise-group-response'
              examples:
                updateGroup:
                  $ref: '#/components/examples/scim-enterprise-group'
                addMembers:
                  $ref: '#/components/examples/scim-enterprise-group'
        '204':
          description: Response
        '400':
          $ref: '#/components/responses/scim_bad_request'
        '401':
          $ref: '#/components/responses/authorization_failure'
        '403':
          $ref: '#/components/responses/permission_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '409':
          $ref: '#/components/responses/duplicate_record_detected'
        '429':
          $ref: '#/components/responses/scim_too_many_requests'
        '500':
          $ref: '#/components/responses/scim_internal_error'
      x-github:
        enabledForGitHubApps: true
        githubCloudOnly: true
        category: enterprise-admin
        subcategory: scim
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /scim/v2/Users/{scim_user_id}:
    patch:
      summary: GitHub Update an Attribute for Scim Enterprise User
      description: "**Note:** The SCIM API endpoints for enterprise accounts are currently in *private* beta and are subject to change.\n\nUpdate a provisioned user's individual attributes.\n\nTo change a user's values, you must provide a specific `Operations` JSON format that contains at least one of the `add`, `remove`, or `replace` operations. For examples and more information on the SCIM operations format, see the [SCIM specification](https://tools.ietf.org/html/rfc7644#section-3.5.2).\n\n**Note:** Complicated SCIM `path` selectors that include filters are not supported. For example, a `path` selector defined as `\"path\": \"emails[type eq \\\"work\\\"]\"` will not work.\n\n**Warning:** Setting `active: false` will suspend a user and obfuscate the user handle and user email. Since the implementation is a generic SCIM implementation and does not differentiate yet between different IdP providers, for Okta, the user GDPR data will not be purged and the credentials will not be removed.\n```\n{\n  \"Operations\":[{\n    \"op\":\"replace\",\n    \"value\":{\n      \"active\":false\n    }\n  }]\n}\n```"
      operationId: updateAnAttributeForScimEnterpriseUser
      tags:
      - Attribute
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/enterprise-admin/scim#update-an-attribute-for-a-scim-enterprise-user
      parameters:
      - $ref: '#/components/parameters/scim-user-id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/patch-schema'
            examples:
              userMultiValuedProperties:
                summary: Multi Valued Property
                value:
                  schemas:
                  - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                  - op: replace
                    path: emails[type eq 'work'].value
                    value: updatedEmail@microsoft.com
                  - op: replace
                    path: name.familyName
                    value: updatedFamilyName
              userSingleValuedProperties:
                summary: Single Valued Property
                value:
                  schemas:
                  - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                  - op: replace
                    path: userName
                    value: 5b50642d-79fc-4410-9e90-4c077cdd1a59@testuser.com
                  - op: replace
                    path: displayName
                    value: Monalisa Octocat
              disableUser:
                summary: Disable User
                value:
                  schemas:
                  - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                  - op: replace
                    path: active
                    value: false
      responses:
        '200':
          description: Success, user was updated
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/scim-enterprise-user-response'
              examples:
                userMultiValuedProperties:
                  $ref: '#/components/examples/scim-enterprise-user'
                userSingleValuedProperties:
                  $ref: '#/components/examples/scim-enterprise-user'
                disableUser:
                  $ref: '#/components/examples/scim-enterprise-user'
        '400':
          $ref: '#/components/responses/scim_bad_request'
        '401':
          $ref: '#/components/responses/authorization_failure'
        '403':
          $ref: '#/components/responses/permission_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '409':
          $ref: '#/components/responses/duplicate_record_detected'
        '429':
          $ref: '#/components/responses/scim_too_many_requests'
        '500':
          $ref: '#/components/responses/scim_internal_error'
      x-github:
        enabledForGitHubApps: true
        githubCloudOnly: true
        category: enterprise-admin
        subcategory: scim
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    user-emails-response:
      type: array
      description: The emails for the user.
      items:
        type: object
        required:
        - value
        properties:
          value:
            type: string
            description: The email address.
            example: mlisa@example.com
          type:
            type: string
            description: The type of email address.
            example: work
          primary:
            type: boolean
            description: Whether this email address is the primary address.
            example: true
    user-role:
      type: array
      description: The roles assigned to the user.
      items:
        type: object
        required:
        - value
        properties:
          display:
            type: string
          type:
            type: string
          value:
            type: string
            description: The role value representing a user role in GitHub.
            enum:
            - user
            - 27d9891d-2c17-4f45-a262-781a0e55c80a
            - guest_collaborator
            - 1ebc4a02-e56c-43a6-92a5-02ee09b90824
            - enterprise_owner
            - 981df190-8801-4618-a08a-d91f6206c954
            - ba4987ab-a1c3-412a-b58c-360fc407cb10
            - billing_manager
            - 0e338b8c-cc7f-498a-928d-ea3470d7e7e3
            - e6be2762-e4ad-4108-b72d-1bbe884a0f91
            example: user
          primary:
            type: boolean
            description: Is the role a primary role for the user.
            example: false
    scim-error:
      title: Scim Error
      description: Scim Error
      type: object
      properties:
        message:
          type:
          - string
          - 'null'
          example: Example body text
        documentation_url:
          type:
          - string
          - 'null'
          example: https://api.github.com/repos/octocat/Hello-World
        detail:
          type:
          - string
          - 'null'
          example: example_value
        status:
          type: integer
          example: 42
        scimType:
          type:
          - string
          - 'null'
          example: User
        schemas:
          type: array
          items:
            type: string
    user-response:
      type: object
      required:
      - schemas
      - active
      - emails
      properties:
        schemas:
          type: array
          description: The URIs that are used to indicate the namespaces of the SCIM schemas.
          items:
            type: string
            enum:
            - urn:ietf:params:scim:schemas:core:2.0:User
          example:
          - urn:ietf:params:scim:schemas:core:2.0:User
        externalId:
          type:
          - string
          - 'null'
          description: A unique identifier for the resource as defined by the provisioning client.
          example: E012345
        active:
          type: boolean
          description: Whether the user active in the IdP.
          example: true
        userName:
          type: string
          description: The username for the user.
          example: E012345
        name:
          $ref: '#/components/schemas/user-name-response'
        displayName:
          type:
          - string
          - 'null'
          description: A human-readable name for the user.
          example: Mona Lisa
        emails:
          $ref: '#/components/schemas/user-emails-response'
        roles:
          $ref: '#/components/schemas/user-role'
    scim-enterprise-user-response:
      allOf:
      - $ref: '#/components/schemas/user-response'
      - type: object
        required:
        - id
        - meta
        properties:
          id:
            type: string
            description: The internally generated id for the user object.
            example: 7fce0092-d52e-4f76-b727-3955bd72c939
          groups:
            type: array
            items:
              type: object
              properties:
                value:
                  type: string
                $ref:
                  type: string
                display:
                  type: string
            description: Provisioned SCIM groups that the user is a member of.
          meta:
            $ref: '#/components/schemas/meta'
    basic-error:
      title: Basic Error
      description: Basic Error
      type: object
      properties:
        message:
          type: string
          example: Example body text
        documentation_url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        status:
          type: string
          example: open
    scim-enterprise-group-response:
      allOf:
      - $ref: '#/components/schemas/group-response'
      - type: object
        properties:
          id:
            type: string
            description: The internally generated id for the group object.
            example: 7fce0092-d52e-4f76-b727-3955bd72c939
          members:
            type: array
            items:
              type: object
              properties:
                value:
                  type: string
                $ref:
                  type: string
                display:
                  type: string
            description: The security group members.
            example:
            - value: 879db59-3bdf-4490-ad68-ab880a2694745
              $+ref: https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745
              displayName: User 1
            - value: 0db508eb-91e2-46e4-809c-30dcbda0c685
              $+ref: https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685
              displayName: User 2
          meta:
            $ref: '#/components/schemas/meta'
    user-name-response:
      type: object
      properties:
        formatted:
          type: string
          description: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display.
          example: Ms. Mona Lisa Octocat
        familyName:
          type: string
          description: The family name of the user.
          example: Octocat
        givenName:
          type: string
          description: The given name of the user.
          example: Mona
        middleName:
          type: string
          description: The middle name(s) of the user.
          example: Lisa
    patch-schema:
      type: object
      required:
      - Operations
      - schemas
      properties:
        Operations:
          type: array
          description: patch operations list
          items:
            type: object
            required:
            - op
            properties:
              op:
                type: string
                enum:
                - add
                - replace
                - remove
              path:
                type: string
              value:
                type: string
                description: Corresponding 'value' of that field specified by 'path'
        schemas:
          type: array
          items:
            type: string
            enum:
            - urn:ietf:params:scim:api:messages:2.0:PatchOp
    group-response:
      type: object
      required:
      - schemas
      properties:
        schemas:
          type: array
          description: The URIs that are used to indicate the namespaces of the SCIM schemas.
          items:
            type: string
            enum:
            - urn:ietf:params:scim:schemas:core:2.0:Group
            - urn:ietf:params:scim:api:messages:2.0:ListResponse
          example:
          - urn:ietf:params:scim:schemas:core:2.0:Group
        externalId:
          type:
          - string
          - 'null'
          description: A unique identifier for the resource as defined by the provisioning client.
          example: 8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159
        displayName:
          type:
          - string
          - 'null'
          description: A human-readable name for a security group.
          example: Engineering
        members:
          type: array
          description: The group members.
          items:
            type: object
            required:
            - value
            - $ref
            properties:
              value:
                type: string
                description: The local unique identifier for the member
                example: 23a35c27-23d3-4c03-b4c5-6443c09e7173
              $ref:
                type: string
              display:
                type: string
                description: The display name associated with the member
                example: Monalisa Octocat
    meta:
      type: object
      description: The metadata associated with the creation/updates to the user.
      required:
      - resourceType
      properties:
        resourceType:
          type: string
          description: A type of a resource
          enum:
          - User
          - Group
          example: User
        created:
          type: string
          description: A date and time when the user was created.
          example: '2022-03-27T19:59:26.000Z'
        lastModified:
          type: string
          description: A data and time when the user was last modified.
          example: '2022-03-27T19:59:26.000Z'
        location:
          type: string
          description: A URL location of an object
          example: example_value
  responses:
    scim_bad_request:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/scim-error'
        application/scim+json:
          schema:
            $ref: '#/components/schemas/scim-error'
    not_found:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    scim_internal_error:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/scim-error'
        application/scim+json:
          schema:
            $ref: '#/components/schemas/scim-error'
    permission_denied:
      description: Permission denied
    duplicate_record_detected:
      description: Duplicate record detected
    authorization_failure:
      description: Authorization failure
    scim_too_many_requests:
      description: Too many requests
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/scim-error'
        application/scim+json:
          schema:
            $ref: '#/components/schemas/scim-error'
  examples:
    scim-enterprise-user:
      value:
        schemas:
        - urn:ietf:params:scim:schemas:core:2.0:User
        id: 7fce0092-d52e-4f76-b727-3955bd72c939
        externalId: E012345
        active: true
        userName: E012345
        name:
          formatted: Ms. Mona Lisa Octocat
          familyName: Octocat
          givenName: Mona
          middleName: Lisa
        displayName: Mona Lisa
        emails:
        - value: mlisa@example.com
          type: work
          primary: true
        roles:
        - value: User
          primary: false
        meta:
          resourceType: User
          created: '2012-03-27T19:59:26.000Z'
          lastModified: '2018-03-27T19:59:26.000Z'
          location: https://api.github.localhost/scim/v2/Users/7fce0092-d52e-4f76-b727-3955bd72c939
    scim-enterprise-group:
      value:
        schemas:
        - urn:ietf:params:scim:schemas:core:2.0:Group
        id: abcd27f8-a9aa-11ea-8221-f59b2be9cccc
        externalId: 8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159
        displayName: Engineering
        members:
        - value: 879db59-3bdf-4490-ad68-ab880a2694745
          $+ref: https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745
          displayName: User 1
        - value: 0db508eb-91e2-46e4-809c-30dcbda0c685
          $+ref: https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685
          displayName: User 2
        meta:
          resourceType: Group
          created: '2012-03-27T19:59:26.000Z'
          lastModified: '2018-03-27T19:59:26.000Z'
          location: https://api.github.localhost/scim/v2/Groups/927fa2c08dcb4a7fae9e
  parameters:
    scim-group-id:
      name: scim_group_id
      description: A unique identifier of the SCIM group.
      in: path
      required: true
      schema:
        type: string
        example: 7fce0092-d52e-4f76-b727-3955bd72c939
    scim-user-id:
      name: scim_user_id
      description: The unique identifier of the SCIM user.
      in: path
      required: true
      schema:
        type: string
  securitySchemes:
    bearerHttpAuthentication:
      description: Bearer Token
      type: http
      scheme: Bearer
externalDocs:
  description: GitHub Enterprise Developer Docs
  url: https://docs.github.com/enterprise-server@3.9/rest/