GitHub Provisioning API

openapi: 3.2.0
info:
  version: 1.1.4
  title: GitHub SCIM Provisioning API
  description: The GitHub SCIM (System for Cross-domain Identity Management) API enables automated user provisioning and deprovisioning for GitHub Enterprise Cloud organizations through identity providers like Azure AD, Okta, or OneLogin. This API allows IT administrators to programmatically manage user identities, group memberships, and access permissions by synchronizing user data from their organization's identity management system directly to GitHub. With SCIM, you can automatically create new users when employees join, update user information when it changes in your identity provider, remove access when employees leave, and manage team memberships based on directory groups—streamlining user lifecycle management and ensuring consistent access control across your organization's GitHub resources.
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  contact:
    name: Support
    url: https://support.github.com/contact?tags=dotcom-rest-api
  x-github-plan: ghes
  x-github-release: 3.9
servers:
- url: '{protocol}://{hostname}/api/v3'
  variables:
    hostname:
      description: Self-hosted Enterprise Server hostname
      default: HOSTNAME
    protocol:
      description: Self-hosted Enterprise Server protocol
      default: http
tags:
- name: Provisioning
paths:
  /scim/v2/Groups/{scim_group_id}:
    get:
      summary: GitHub Get Scim Provisioning Information for an Enterprise Group
      description: '**Note:** The SCIM API endpoints for enterprise accounts are currently in *private* beta and are subject to change.


        Gets information about a SCIM group.'
      operationId: getScimProvisioningInformationForAnEnterpriseGroup
      tags:
      - Provisioning
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/enterprise-admin/scim#get-scim-provisioning-information-for-an-enterprise-group
      parameters:
      - $ref: '#/components/parameters/scim-group-id'
      - $ref: '#/components/parameters/excluded-attributes'
      responses:
        '200':
          description: Success, a group was found
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/scim-enterprise-group-response'
              examples:
                default:
                  $ref: '#/components/examples/scim-enterprise-group'
        '400':
          $ref: '#/components/responses/scim_bad_request'
        '401':
          $ref: '#/components/responses/authorization_failure'
        '403':
          $ref: '#/components/responses/permission_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '429':
          $ref: '#/components/responses/scim_too_many_requests'
        '500':
          $ref: '#/components/responses/scim_internal_error'
      x-github:
        enabledForGitHubApps: true
        githubCloudOnly: true
        category: enterprise-admin
        subcategory: scim
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /scim/v2/Users/{scim_user_id}:
    get:
      summary: GitHub Get Scim Provisioning Information for an Enterprise User
      description: '**Note:** The SCIM API endpoints for enterprise accounts are currently in *private* beta and are subject to change.


        Gets information about a SCIM user.'
      operationId: getScimProvisioningInformationForAnEnterpriseUser
      tags:
      - Provisioning
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/enterprise-admin/scim#get-scim-provisioning-information-for-an-enterprise-user
      parameters:
      - $ref: '#/components/parameters/scim-user-id'
      responses:
        '200':
          description: Success, a user was found
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/scim-enterprise-user-response'
              examples:
                default:
                  $ref: '#/components/examples/scim-enterprise-user'
        '400':
          $ref: '#/components/responses/scim_bad_request'
        '401':
          $ref: '#/components/responses/authorization_failure'
        '403':
          $ref: '#/components/responses/permission_denied'
        '404':
          $ref: '#/components/responses/not_found'
        '429':
          $ref: '#/components/responses/scim_too_many_requests'
        '500':
          $ref: '#/components/responses/scim_internal_error'
      x-github:
        enabledForGitHubApps: true
        githubCloudOnly: true
        category: enterprise-admin
        subcategory: scim
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    user-emails-response:
      type: array
      description: The emails for the user.
      items:
        type: object
        required:
        - value
        properties:
          value:
            type: string
            description: The email address.
            example: mlisa@example.com
          type:
            type: string
            description: The type of email address.
            example: work
          primary:
            type: boolean
            description: Whether this email address is the primary address.
            example: true
    user-role:
      type: array
      description: The roles assigned to the user.
      items:
        type: object
        required:
        - value
        properties:
          display:
            type: string
          type:
            type: string
          value:
            type: string
            description: The role value representing a user role in GitHub.
            enum:
            - user
            - 27d9891d-2c17-4f45-a262-781a0e55c80a
            - guest_collaborator
            - 1ebc4a02-e56c-43a6-92a5-02ee09b90824
            - enterprise_owner
            - 981df190-8801-4618-a08a-d91f6206c954
            - ba4987ab-a1c3-412a-b58c-360fc407cb10
            - billing_manager
            - 0e338b8c-cc7f-498a-928d-ea3470d7e7e3
            - e6be2762-e4ad-4108-b72d-1bbe884a0f91
            example: user
          primary:
            type: boolean
            description: Is the role a primary role for the user.
            example: false
    scim-error:
      title: Scim Error
      description: Scim Error
      type: object
      properties:
        message:
          type:
          - string
          - 'null'
          example: Example body text
        documentation_url:
          type:
          - string
          - 'null'
          example: https://api.github.com/repos/octocat/Hello-World
        detail:
          type:
          - string
          - 'null'
          example: example_value
        status:
          type: integer
          example: 42
        scimType:
          type:
          - string
          - 'null'
          example: User
        schemas:
          type: array
          items:
            type: string
    user-response:
      type: object
      required:
      - schemas
      - active
      - emails
      properties:
        schemas:
          type: array
          description: The URIs that are used to indicate the namespaces of the SCIM schemas.
          items:
            type: string
            enum:
            - urn:ietf:params:scim:schemas:core:2.0:User
          example:
          - urn:ietf:params:scim:schemas:core:2.0:User
        externalId:
          type:
          - string
          - 'null'
          description: A unique identifier for the resource as defined by the provisioning client.
          example: E012345
        active:
          type: boolean
          description: Whether the user active in the IdP.
          example: true
        userName:
          type: string
          description: The username for the user.
          example: E012345
        name:
          $ref: '#/components/schemas/user-name-response'
        displayName:
          type:
          - string
          - 'null'
          description: A human-readable name for the user.
          example: Mona Lisa
        emails:
          $ref: '#/components/schemas/user-emails-response'
        roles:
          $ref: '#/components/schemas/user-role'
    scim-enterprise-user-response:
      allOf:
      - $ref: '#/components/schemas/user-response'
      - type: object
        required:
        - id
        - meta
        properties:
          id:
            type: string
            description: The internally generated id for the user object.
            example: 7fce0092-d52e-4f76-b727-3955bd72c939
          groups:
            type: array
            items:
              type: object
              properties:
                value:
                  type: string
                $ref:
                  type: string
                display:
                  type: string
            description: Provisioned SCIM groups that the user is a member of.
          meta:
            $ref: '#/components/schemas/meta'
    basic-error:
      title: Basic Error
      description: Basic Error
      type: object
      properties:
        message:
          type: string
          example: Example body text
        documentation_url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        status:
          type: string
          example: open
    scim-enterprise-group-response:
      allOf:
      - $ref: '#/components/schemas/group-response'
      - type: object
        properties:
          id:
            type: string
            description: The internally generated id for the group object.
            example: 7fce0092-d52e-4f76-b727-3955bd72c939
          members:
            type: array
            items:
              type: object
              properties:
                value:
                  type: string
                $ref:
                  type: string
                display:
                  type: string
            description: The security group members.
            example:
            - value: 879db59-3bdf-4490-ad68-ab880a2694745
              $+ref: https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745
              displayName: User 1
            - value: 0db508eb-91e2-46e4-809c-30dcbda0c685
              $+ref: https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685
              displayName: User 2
          meta:
            $ref: '#/components/schemas/meta'
    user-name-response:
      type: object
      properties:
        formatted:
          type: string
          description: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display.
          example: Ms. Mona Lisa Octocat
        familyName:
          type: string
          description: The family name of the user.
          example: Octocat
        givenName:
          type: string
          description: The given name of the user.
          example: Mona
        middleName:
          type: string
          description: The middle name(s) of the user.
          example: Lisa
    group-response:
      type: object
      required:
      - schemas
      properties:
        schemas:
          type: array
          description: The URIs that are used to indicate the namespaces of the SCIM schemas.
          items:
            type: string
            enum:
            - urn:ietf:params:scim:schemas:core:2.0:Group
            - urn:ietf:params:scim:api:messages:2.0:ListResponse
          example:
          - urn:ietf:params:scim:schemas:core:2.0:Group
        externalId:
          type:
          - string
          - 'null'
          description: A unique identifier for the resource as defined by the provisioning client.
          example: 8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159
        displayName:
          type:
          - string
          - 'null'
          description: A human-readable name for a security group.
          example: Engineering
        members:
          type: array
          description: The group members.
          items:
            type: object
            required:
            - value
            - $ref
            properties:
              value:
                type: string
                description: The local unique identifier for the member
                example: 23a35c27-23d3-4c03-b4c5-6443c09e7173
              $ref:
                type: string
              display:
                type: string
                description: The display name associated with the member
                example: Monalisa Octocat
    meta:
      type: object
      description: The metadata associated with the creation/updates to the user.
      required:
      - resourceType
      properties:
        resourceType:
          type: string
          description: A type of a resource
          enum:
          - User
          - Group
          example: User
        created:
          type: string
          description: A date and time when the user was created.
          example: '2022-03-27T19:59:26.000Z'
        lastModified:
          type: string
          description: A data and time when the user was last modified.
          example: '2022-03-27T19:59:26.000Z'
        location:
          type: string
          description: A URL location of an object
          example: example_value
  responses:
    scim_bad_request:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/scim-error'
        application/scim+json:
          schema:
            $ref: '#/components/schemas/scim-error'
    not_found:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    scim_internal_error:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/scim-error'
        application/scim+json:
          schema:
            $ref: '#/components/schemas/scim-error'
    permission_denied:
      description: Permission denied
    authorization_failure:
      description: Authorization failure
    scim_too_many_requests:
      description: Too many requests
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/scim-error'
        application/scim+json:
          schema:
            $ref: '#/components/schemas/scim-error'
  examples:
    scim-enterprise-user:
      value:
        schemas:
        - urn:ietf:params:scim:schemas:core:2.0:User
        id: 7fce0092-d52e-4f76-b727-3955bd72c939
        externalId: E012345
        active: true
        userName: E012345
        name:
          formatted: Ms. Mona Lisa Octocat
          familyName: Octocat
          givenName: Mona
          middleName: Lisa
        displayName: Mona Lisa
        emails:
        - value: mlisa@example.com
          type: work
          primary: true
        roles:
        - value: User
          primary: false
        meta:
          resourceType: User
          created: '2012-03-27T19:59:26.000Z'
          lastModified: '2018-03-27T19:59:26.000Z'
          location: https://api.github.localhost/scim/v2/Users/7fce0092-d52e-4f76-b727-3955bd72c939
    scim-enterprise-group:
      value:
        schemas:
        - urn:ietf:params:scim:schemas:core:2.0:Group
        id: abcd27f8-a9aa-11ea-8221-f59b2be9cccc
        externalId: 8aa1a0c0-c4c3-4bc0-b4a5-2ef676900159
        displayName: Engineering
        members:
        - value: 879db59-3bdf-4490-ad68-ab880a2694745
          $+ref: https://api.github.localhost/scim/v2/Users/879db59-3bdf-4490-ad68-ab880a2694745
          displayName: User 1
        - value: 0db508eb-91e2-46e4-809c-30dcbda0c685
          $+ref: https://api.github.localhost/scim/v2/Users/0db508eb-91e2-46e4-809c-30dcbda0c685
          displayName: User 2
        meta:
          resourceType: Group
          created: '2012-03-27T19:59:26.000Z'
          lastModified: '2018-03-27T19:59:26.000Z'
          location: https://api.github.localhost/scim/v2/Groups/927fa2c08dcb4a7fae9e
  parameters:
    scim-user-id:
      name: scim_user_id
      description: The unique identifier of the SCIM user.
      in: path
      required: true
      schema:
        type: string
    scim-group-id:
      name: scim_group_id
      description: A unique identifier of the SCIM group.
      in: path
      required: true
      schema:
        type: string
        example: 7fce0092-d52e-4f76-b727-3955bd72c939
    excluded-attributes:
      name: excludedAttributes
      description: Excludes the specified attribute from being returned in the results. Using this parameter can speed up response time.
      in: query
      required: false
      schema:
        type: string
        example: members
  securitySchemes:
    bearerHttpAuthentication:
      description: Bearer Token
      type: http
      scheme: Bearer
externalDocs:
  description: GitHub Enterprise Developer Docs
  url: https://docs.github.com/enterprise-server@3.9/rest/