openapi: 3.2.0 info: title: Platform - User Provisioning Groups V2 API description: OneTrust supports cross-domain identity management through the SCIM 2.0 specification. System for Cross-Domain Identity Management (SCIM) is an open specification to help facilitate the automated management of user identities and groups in cloud applications using RESTful APIs. This allows organizations to manage and update user information and group information across domains and applications. version: '1.0' contact: name: OneTrust Support url: https://my.onetrust.com/s/contactsupport license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - url: https://{hostname} variables: hostname: default: hostname description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com. tags: - name: Groups V2 description: V2 version APIs to manage Groups. externalDocs: description: OpenAPI 3.1.0 - Download Definition url: https://developer.onetrust.com/onetrust/openapi/platform-user-provisioning.json paths: /api/scim/v2/Groups: get: operationId: listGroupsUsingGET summary: Get List of Groups description: 'Use this API to retrieve a list of SCIM groups from your account. The response will include each unique role-organization combination. For example, if your account has 20 roles and 2 organizations, this API will return 40 unique SCIM groups in the response. This API should only be used when provisioning and managing users from your Identity Provider using the System for Cross-Domain Identity Management (SCIM) standard to facilitate the automated creation of user identities from a third-party identity management application. > 🗒 Things to Know > > - This API supports OneTrust''s Legacy SCIM Integration that leverages SCIM groups, which are unique role-organization combinations that each represent a specific role within a particular organization. For more information, see Legacy SCIM User Provisioning.' tags: - Groups V2 x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/platform-user-provisioning.json parameters: - name: startIndex in: query description: Start index of the groups to be fetched. Minimum and the default values are 1. schema: type: string default: '1' minimum: 1 example: '1' - name: count in: query description: The number of groups to be returned. The default value is 25 and the maximum number of groups returned are 25. schema: type: string default: '25' maximum: 25 minimum: 1 example: '25' responses: '200': description: 'OK Groups retrieved successfully.' content: application/json: schema: $ref: '#/components/schemas/ListResponse' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - SCIM - INTEGRATION /api/scim/v2/Groups/{groupId}: get: operationId: getGroupResourceUsingGET summary: Get Group description: 'Use this API to retrieve details for a specific SCIM group. The response will include details such as the created date, last modified date, and list of users within the SCIM group. This API should only be used when provisioning and managing users from your Identity Provider using the System for Cross-Domain Identity Management (SCIM) standard to facilitate the automated creation of user identities from a third-party identity management application. > 🗒 Things to Know > > - This API supports OneTrust''s Legacy SCIM Integration that leverages SCIM groups, which are unique role-organization combinations that each represent a specific role within a particular organization. For more information, see Legacy SCIM User Provisioning.' tags: - Groups V2 x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/platform-user-provisioning.json parameters: - name: groupId in: path description: 'ID that uniquely identifies the SCIM group. The `groupId` can be obtained using the [Get List of Groups] (/onetrust/reference/listgroupsusingget) API. ' required: true schema: type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 - name: excludedAttributes in: query description: The parameter to exclude the list of group members from the response when retrieving details of a specific group. required: false schema: type: string enum: - members maxLength: 255 responses: '200': description: 'OK Group retrieved successfully.' content: application/json: schema: $ref: '#/components/schemas/GroupResource' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - SCIM - INTEGRATION put: operationId: updateGroupMembersUsingPUT summary: Update Group description: 'Use this API to fully update SCIM group details and SCIM group membership. This API should only be used when provisioning and managing users from your Identity Provider using the System for Cross-Domain Identity Management (SCIM) standard to facilitate the automated creation of user identities from a third-party identity management application. > 🗒 Things to Know > > - This API supports OneTrust''s Legacy SCIM Integration that leverages SCIM groups, which are unique role-organization combinations that each represent a specific role within a particular organization. For more information, see Legacy SCIM User Provisioning. > - When a user is added as a member of a SCIM group, the user is provisioned with that specific role-organization combination. If the user belongs to other SCIM groups, the user will still retain existing membership with those groups as users can be assigned to multiple roles and multiple organizations. > - When this API is called, the existing list of users that are members of the SCIM group will be replaced with the new list of users defined in the request. If no users are specified, the existing list of users will be removed from the SCIM group.' tags: - Groups V2 x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/platform-user-provisioning.json parameters: - name: groupId in: path description: ID that uniquely identifies the SCIM group. The `groupId` can be obtained using the [Get List of Groups](/onetrust/reference/listgroupsusingget) API. required: true schema: type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/GroupResource' responses: '200': description: 'OK Group members updated successfully.' content: application/json: schema: $ref: '#/components/schemas/GroupResource' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - SCIM - INTEGRATION patch: operationId: updateGroupMembersUsingPATCH summary: Modify Group description: 'Use this API to partially update SCIM group details and/or SCIM group membership. This API should only be used when provisioning and managing users from your Identity Provider using the System for Cross-Domain Identity Management (SCIM) standard to facilitate the automated creation of user identities from a third-party identity management application. > 🗒 Things to Know > > - This API supports OneTrust''s Legacy SCIM Integration that leverages SCIM groups, which are unique role-organization combinations that each represent a specific role within a particular organization. For more information, see Legacy SCIM User Provisioning. > - When a user is added as a member of a SCIM group, the user is provisioned with that specific role-organization combination. If the user belongs to other SCIM groups, the user will still retain existing membership with those groups as users can be assigned to multiple roles and multiple organizations.' tags: - Groups V2 x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/platform-user-provisioning.json parameters: - name: groupId in: path description: 'ID that uniquely identifies the SCIM group. The `groupId` can be obtained using the [Get List of Groups] (/onetrust/reference/listgroupsusingget) API. ' required: true schema: type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PatchGroupResourceRequest' responses: '204': description: 'OK Group members updated successfully.' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - SCIM - INTEGRATION components: schemas: Member: type: object properties: value: description: The unique ID of the user that you want to add to the Group. type: string format: uuid example: 3da9fe38-7845-4658-a96e-00071fa20c2e type: description: The type of the resource. type: string default: User enum: - User $ref: description: A hyperlink to the resource type: string format: url example: /api/scim/v3/Users/1bd418b2-85dd-4f04-955f-e4870e119ef1" readOnly: true required: - value title: Member Operation: type: object properties: op: description: The operation type type: string example: add enum: - add - replace - remove path: description: The path of the attribute being operated on type: string example: members displayName: description: The display name of the group type: string example: Admin Group members: type: array items: $ref: '#/components/schemas/Member' Name: type: object properties: familyName: description: Family name (last name) of the user. type: string example: Smith maxLength: 100 minLength: 1 givenName: description: Given name (first name) of the user. type: string example: John maxLength: 100 minLength: 1 title: Name ResourceTypeResource: type: object properties: id: description: Unique identifier of the resource type type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 name: description: Name of the resource type type: string example: Users enum: - Users - Groups endpoint: description: Resource URL endpoint type: string example: /Users description: description: Description of the resource type type: string example: A user account in the OneTrust system maxLength: 255 minLength: 1 schema: description: Schema URI for the resource type type: string example: urn:ietf:params:scim:schemas:core:2.0:User enum: - urn:ietf:params:scim:schemas:core:2.0:User - urn:ietf:params:scim:schemas:core:2.0:Group meta: $ref: '#/components/schemas/Meta' readOnly: true schemaExtensions: $ref: '#/components/schemas/SchemaExtension' required: - description - endpoint - id - name - schema GroupResource: type: object properties: id: description: Unique identifier for the user created by the OneTrust application. type: string format: uuid example: aeb3d45d-0c05-4ff0-b635-6e3c3b2f86ea maxLength: 100 readOnly: true externalId: description: External Id type: string example: 3PNdoRZES0GLfV+9y1dDwQ== maxLength: 100 meta: $ref: '#/components/schemas/Meta' readOnly: true schemas: type: array items: type: string default: urn:ietf:params:scim:schemas:core:2.0:Group description: A collection of attribute definitions that describe the contents of an entire or partial resource. enum: - urn:ietf:params:scim:schemas:core:2.0:Group - urn:ietf:params:scim:schemas:onetrust:Group example: urn:ietf:params:scim:schemas:core:2.0:Group uniqueItems: true displayName: description: Assessments Manager - ADFS type: string example: Test Group maxLength: 255 minLength: 1 members: type: array items: $ref: '#/components/schemas/Member' urn:ietf:params:scim:schemas:onetrust:Group: $ref: '#/components/schemas/OneTrustGroup' required: - displayName title: GroupResource Email: type: object properties: value: description: Email of the user. type: string format: email example: gpburdell@onetrust.com minLength: 1 display: description: Email of the user. type: string format: email example: gpburdell@onetrust.com readOnly: true primary: description: Is the email the user's primary. Always `true` in the OneTrust application. type: boolean example: true default: 'true' readOnly: true $ref: description: Reference for the attribute type: string format: string type: description: The type of the email. In the OneTrust application, type is always 'work'. type: string example: work default: work required: - value Supported: type: object properties: supported: description: Indicates whether the service provider supports the operation type: boolean example: false SchemaExtension: type: object properties: schema: description: The schema extension schema type: string example: urn:ietf:params:scim:schemas:onetrust:Group required: description: True if the schema extension is required type: boolean example: true required: - required - schema AuthenticationScheme: type: object properties: name: description: Name of the authentication scheme type: string example: Oauth2 Bearer description: description: Description of the authentication scheme type: string example: OAuth2 Bearer access token is used for authorization. specUrl: description: URI of the specification for the authentication scheme type: string example: http://tools.ietf.org/html/rfc6749 documentationUrl: description: URI to retrieve more information about the authentication scheme type: string example: http://oauth.net/2/ type: description: Type of the authentication scheme type: string example: oauthbearertoken primary: description: Indicates whether the authentication scheme is primary type: boolean example: true ServiceProviderConfig: type: object properties: schemas: description: A collection of resource types supported by the service provider type: array items: type: string description: A collection of resource types supported by the service provider example: '["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"]' example: - urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig uniqueItems: true patch: $ref: '#/components/schemas/Supported' bulk: $ref: '#/components/schemas/BulkSupported' filter: $ref: '#/components/schemas/FilterSupported' changePassword: $ref: '#/components/schemas/Supported' sort: $ref: '#/components/schemas/Supported' etag: $ref: '#/components/schemas/Supported' xmlDataFormat: $ref: '#/components/schemas/Supported' authenticationSchemes: type: array items: $ref: '#/components/schemas/AuthenticationScheme' meta: $ref: '#/components/schemas/Meta' readOnly: true title: ServiceProviderConfig FilterSupported: type: object properties: supported: description: Indicates whether the service provider supports the operation type: boolean example: false maxResults: type: integer format: int32 ListResponse: type: object properties: schemas: type: array items: type: string description: List of Schemas. example: urn:ietf:params:scim:schemas:core:2.0:User uniqueItems: true totalResults: description: The total number of results in the list. type: integer format: int32 example: 2 minimum: 0 startIndex: description: TThe starting point of the result list. type: integer format: int32 example: 1 minimum: 1 itemsPerPage: description: The number of items per results page. type: integer format: int32 example: 25 minimum: 0 Resources: type: array items: type: object anyOf: - $ref: '#/components/schemas/GroupResource' - $ref: '#/components/schemas/UserResource' - $ref: '#/components/schemas/ResourceTypeResource' - $ref: '#/components/schemas/ServiceProviderConfig' description: Resources. UserGroup: type: object properties: value: description: Unique identifier of a group in the application. type: string example: 5175be33-9b8d-4483-9d8b-1a9fb78bd97d display: description: Name of the User Group in the application. type: string example: R&D readOnly: true title: Group PatchGroupResourceRequest: allOf: - $ref: '#/components/schemas/AbstractBaseResource' - type: object properties: schemas: type: array items: type: string default: urn:ietf:params:scim:schemas:core:2.0:Group description: A collection of attribute definitions that describe the contents of an entire or partial resource. enum: - urn:ietf:params:scim:schemas:core:2.0:Group - urn:ietf:params:scim:schemas:onetrust:Group example: urn:ietf:params:scim:schemas:core:2.0:Group uniqueItems: true displayName: description: Display name of the group type: string example: Administrators maxLength: 255 minLength: 1 members: type: array items: $ref: '#/components/schemas/Member' readOnly: true readOnly: true urn:ietf:params:scim:schemas:onetrust:Group: $ref: '#/components/schemas/OneTrustGroup' Operations: type: array items: $ref: '#/components/schemas/Operation' OneTrustGroup: type: object properties: category: description: The display name of the group type: string example: HR maxLength: 255 minLength: 1 description: description: The description of the group type: string example: HR User Group maxLength: 255 minLength: 1 title: UserGroup UserResource: type: object allOf: - $ref: '#/components/schemas/AbstractBaseResource' - type: object properties: schemas: type: array items: description: A collection of attribute definitions that describe the contents of an entire or partial resource. enum: - urn:ietf:params:scim:schemas:core:2.0:User example: urn:ietf:params:scim:schemas:core:2.0:User uniqueItems: true userName: description: Username of the user in the OneTrust application. type: string format: email example: gpburdell@onetrust.com maxLength: 256 name: $ref: '#/components/schemas/Name' userType: description: Type of the user. type: string example: Internal enum: - Internal - External active: description: The flag to check whether the user is an active or an inactive user. type: boolean example: true groups: type: array items: $ref: '#/components/schemas/UserGroup' readOnly: true readOnly: true emails: type: array items: $ref: '#/components/schemas/Email' roles: type: array items: format: json description: Role of the user within the OneTrust application. examples: - '["Auditor","Business Owner","Employee","Privacy Officer","Site Admin"]' title: description: Job title of the user type: string example: Product Manager maxLength: 255 urn:ietf:params:scim:schemas:extension:enterprise:2.0:User: description: Enterprise user details $ref: '#/components/schemas/EnterpriseUser' required: - name title: UserResource Meta: type: object properties: created: description: The date and time when the resource was created type: string format: date-time example: '2022-05-27T15:28:14.298Z' lastModified: description: The date and time when the resource was last modified type: string format: date-time example: '2022-05-27T15:28:14.298Z' location: description: The URL for the resource type: string format: uri example: /api/scim/v3/Users/53b1325c-081f-4f05-b41b-ba8cbdb7bae9 maxLength: 2083 minLength: 1 version: description: The version of the resource type: string example: W/"f0f2a936" maxLength: 100 minLength: 1 attributes: type: array items: description: The set of attributes example: - active - emails - userName uniqueItems: true resourceType: description: The resource type type: string example: Group enum: - User - Group - ResourceType - ServiceProviderConfig - Schema maxLength: 100 minLength: 1 readOnly: true title: Meta EnterpriseUser: type: object properties: businessUnit: description: User's business unit. type: string example: ESG maxLength: 255 division: description: The division with which the user is associated. type: string example: North America maxLength: 255 employeeNumber: description: User's employee number or ID. type: string example: '8675309' maxLength: 255 officeLocation: description: The office location of the user. type: string example: New York maxLength: 255 department: description: The department with which the user is associated. type: string example: R&D maxLength: 255 manager: $ref: '#/components/schemas/Manager' organization: description: Organization of the user within the OneTrust application. type: string example: OneTrust maxLength: 255 legacyManager: description: The legacy manager of the user. type: string example: legacy manager maxLength: 255 title: Additional Attributes Manager: type: object properties: value: description: The manager's GUID or `id` in the OneTrust application. Leverage the [Get List of Users](/onetrust/reference/getusers) API to obtain a list of users. Use the manager's `id` to populate `value`. type: string example: 23498234-9283-4620-8204-652982504620 maxLength: 100 minLength: 1 displayName: description: Manager's full name in the application. type: string example: John Doe readOnly: true $ref: description: Reference URL to the user type: string format: url example: /api/scim/v3/Users/23498234-9283-4620-8204-652982504620 readOnly: true required: - value title: Manager BulkSupported: type: object properties: supported: description: Indicates whether the service provider supports the operation type: boolean example: false maxOperations: type: integer format: int32 maxPayloadSize: type: integer format: int32 AbstractBaseResource: type: object properties: id: description: Unique identifier for the user created by the OneTrust application. type: string format: uuid example: aeb3d45d-0c05-4ff0-b635-6e3c3b2f86ea maxLength: 100 readOnly: true externalId: description: External Id type: string example: 3PNdoRZES0GLfV+9y1dDwQ== maxLength: 100 meta: $ref: '#/components/schemas/Meta' readOnly: true schemas: type: array items: type: string uniqueItems: true writeOnly: true title: AbstractBaseResource securitySchemes: OAUTH2: type: oauth2 flows: clientCredentials: tokenUrl: https://{hostname}/api/access/v1/oauth/token scopes: SCIM: Grants full access to the SCIM APIs for User Provisioning. This includes all the endpoints under Users, Groups, Resources, Schemas and Service Provider. x-onetrust: spec-label: OpenAPI 3.1.0 links: - '{''SCIM User & Group Provisioning'': ''https://my.onetrust.com/s/article/UUID-93f936ef-8076-280c-a58e-ba2d3437dfad?topicId=0TO1Q000000ItSxWAK''}' x-readme: explorer-enabled: false proxy-enabled: false metrics-enabled: false