> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Users

> Use SCIM to standardize the process of granting and removing individual user access to Connect AI.

The System for Cross-domain Identity Management (SCIM) is a standard for managing user provisioning, updates, and deletions in cloud-based applications. It allows you to use your company's identity provider, such as Okta or Entra ID, to provision, update, and delete users securely in Connect AI.

<Note>SSO must be configured on your account before you can enable SCIM Users. To enable SCIM, contact [CData Support](https://www.cdata.com/support/submit.aspx).</Note>

Connect AI currently supports SCIM provisioning with the following identity providers:

* Microsoft Entra ID
* Okta Workforce Identity Cloud
* Custom IdP (configured via SAML or OpenID Connect)

The following SCIM providers are NOT supported:

* PingFederate
* Google Workspace
* Active Directory Federation Services (ADFS)
* Active Directory/LDAP

## SCIM User Provisioning, Updates, and Deprovisioning

When you provision SCIM, CData Support supplies a unique base URL following this format: `https://{your-domain.com}/scim/v2`. The URL endpoint contains the necessary user metadata. All SCIM endpoints require an `Authorization` header with a `Bearer` token.

To provision a new user, `POST` to your unique SCIM endpoint. The system provisions the user in Connect AI. There is no need for the user to verify via email. The new user has a default role of Query user. See [Roles](/en/Roles) for details on system roles. The new user only has access to connections that have user-defined credentials turned on.

To update a SCIM user's name and email, use `PATCH` with the SCIM endpoint. When a SCIM update user request comes in, the system updates the information in Connect AI.

To delete a user, use `DELETE` and your unique SCIM endpoint. The SCIM delete event calls the delete endpoint. For complete deprovisioning, also call `DELETE /users/{id}` from the Management API to revoke PATs and any direct role and permission grants.

The Connect AI [Audit Log](/en/Logs#audit-log) displays SCIM user provisioning, updates, and deletions.

## Roles and Permissions

A user's access in Connect AI is the combination of group-derived roles (from SCIM group assignments), direct role assignments, and direct resource permissions. You can manage direct assignments and fully deprovision users using the Management API (base path `/api/v1/`):

| Method   | Path                                      | Description                                                                                             |
| -------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| `GET`    | `/users`                                  | List all users                                                                                          |
| `GET`    | `/users/{id}`                             | Get a single user including their direct permissions                                                    |
| `PATCH`  | `/users/{id}`                             | Update user attributes                                                                                  |
| `DELETE` | `/users/{id}`                             | Deprovision: revoke all PATs and remove all direct role and permission grants                           |
| `POST`   | `/users/{id}/roles`                       | Assign a role directly to a user                                                                        |
| `GET`    | `/users/{id}/roles`                       | List all roles assigned to a user, showing whether each was assigned directly or inherited from a group |
| `DELETE` | `/users/{id}/roles/{role_id}`             | Remove a direct role assignment                                                                         |
| `POST`   | `/users/{id}/permissions`                 | Assign a resource permission directly to a user                                                         |
| `GET`    | `/users/{id}/permissions`                 | List direct permissions assigned to a user                                                              |
| `DELETE` | `/users/{id}/permissions/{permission_id}` | Remove a direct permission                                                                              |

See [Roles](/en/Roles) for details on system and access roles.