⌘ K
OpenAPI

ENTERPRISE

SCIM security

Keep enterprise provisioning tenant-bound and operationally safe.

Security requirements

  • Use the organization-bound bearer token only from a directory backend.
  • Never place SCIM tokens in browser code or source control.
  • Validate SCIM content type and object size limits.
  • Treat 401, 403, 409, and 429 as actionable classifications; do not retry invalid data.
  • Use request IDs and bounded backoff for transient 5xx/network failures.