openapi: 3.2.0
info:
  title: SCIM 2.0 User Management Group API
  description: "System for Cross-domain Identity Management (SCIM) is designed to make managing user identities in cloud-based applications and services easier. It is an [open specification](https://www.simplecloud.info/) that is supported by many user management tools. \n\nThese pages document the specifics of Vendasta's implementation for partners who want to manage users in their own system and them push the changes to the Vendasta platform."
  version: 1.0.0
servers:
- url: https://prod.apigateway.co/scim
  description: Production
- url: https://demo.apigateway.co/scim
  description: Demo
- url: http://localhost:11001/scim
  description: Local
- url: '{local}/scim'
  description: Localhost
security:
- OAuth2Demo:
  - user.admin
- OAuth2Prod:
  - user.admin
tags:
- name: Group
  description: Group resource
paths:
  /{namespace}/Groups:
    parameters:
    - $ref: '#/components/parameters/namespace'
    get:
      tags:
      - Group
      summary: Search Groups
      parameters:
      - name: excludedAttributes
        in: query
        description: Exclude members using `excludedAttributes=members`
        required: false
        schema:
          type: string
      - name: filter
        in: query
        description: Search group using `displayName eq "Platform Admin"`
        required: false
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/ListResponseGroup'
        '404':
          description: User not found
      operationId: ''
      x-lifecycle:
        status: proposed
      description: '[Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Draft`

        '
  /{namespace}/Groups/{id}:
    parameters:
    - $ref: '#/components/parameters/namespace'
    - schema:
        type: string
      name: id
      in: path
      required: true
      description: The id of the group assigned by Vendasta
    get:
      tags:
      - Group
      summary: Get Group
      parameters:
      - name: excludedAttributes
        in: query
        description: Exclude members using `excludedAttributes=members`
        required: false
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Group'
        '404':
          description: User not found
      x-lifecycle:
        status: proposed
      description: '[Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Draft`

        '
    patch:
      tags:
      - Group
      summary: Update Group
      requestBody:
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/PatchOp'
        required: true
      responses:
        '204':
          description: No Content
        '405':
          description: Invalid input
      x-lifecycle:
        status: proposed
      description: '[Status](https://developers.vendasta.com/platform/ZG9jOjEwMTU2NTYy-versioning): `Draft`

        '
components:
  schemas:
    PatchOp:
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
          example:
          - urn:ietf:params:scim:api:messages:2.0:PatchOp
        Operations:
          type: array
          items:
            $ref: '#/components/schemas/Operation'
    Operation:
      type: object
      properties:
        op:
          type: string
          example: Replace
        path:
          type: string
          example: emails[type eq "work"].value
        value:
          type: string
          example: updatedEmail@mail.com
    Group:
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
          example:
          - urn:ietf:params:scim:schemas:core:2.0:Group
        id:
          type: string
          example: e9e30dba-f08f-4109-8486-d5c6a331660a
        displayName:
          type: string
          example: Tour Guides
        members:
          type: array
          items:
            $ref: '#/components/schemas/Member'
        meta:
          $ref: '#/components/schemas/Meta'
      x-examples:
        Example 1:
          schemas:
          - urn:ietf:params:scim:schemas:core:2.0:Group
          id: ba:getStarted:AG-1234567890
          displayName: Get Started for AG-1234567890
          members:
          - value: 2819c223-7f76-453a-919d-413861904646
            display: Babs Jensen
          meta:
            resourceType: Group
    Member:
      type: object
      properties:
        value:
          type: string
          example: 2819c223-7f76-453a-919d-413861904646
        $ref:
          type: string
          format: uri
          example: https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646
        display:
          type: string
          example: Babs Jensen
    ListResponseGroup:
      type: object
      properties:
        schemas:
          type: array
          items:
            type: string
          example:
          - urn:ietf:params:scim:api:messages:2.0:ListResponse
        totalResults:
          type: number
        Resources:
          type: array
          items:
            $ref: '#/components/schemas/Group'
        startIndex:
          type: number
        itemsPerPage:
          type: number
    Meta:
      type: object
      properties:
        resourceType:
          type: string
          example: User
        created:
          type: string
          format: date-time
          example: '2010-01-23T04:56:22Z'
        lastModified:
          type: string
          format: date-time
          example: '2011-05-13T04:42:34Z'
        version:
          type: string
          description: 'The version of the resource being returned.  This value

            must be the same as the entity-tag (ETag) HTTP response header.

            This attribute has "caseExact" as "true".  Service provider support for this

            attribute is optional and subject to the service provider''s

            support for versioning.  If a

            service provider provides "version" (entity-tag) for a

            representation and the generation of that entity-tag does not

            satisfy all of the characteristics of a strong validator, then the origin server MUST mark the

            "version" (entity-tag) as weak by prefixing its opaque value

            with "W/" (case sensitive).'
          example: W/"3694e05e9dff591"
        location:
          type: string
          example: https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646
  parameters:
    namespace:
      name: namespace
      in: path
      required: true
      schema:
        type: string
        example: VUNI
      description: Currently this must be the id of the partner that you wish to manage users for. In the future we plan to support other types of namespaces such as marketplace apps
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: ''
    OAuth2Demo:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://sso-api-demo.apigateway.co/oauth2/auth
          tokenUrl: https://sso-api-demo.apigateway.co/oauth2/token
          scopes:
            user.admin: Read-write access to manage all users
            user.profile:read: Read access to the profile fields of all categories of users
    OAuth2Prod:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://sso-api-prod.apigateway.co/oauth2/auth
          tokenUrl: https://sso-api-prod.apigateway.co/oauth2/token
          scopes:
            user.admin: Read-write access to manage all users
            user.profile:read: Read access to the profile fields of all categories of users