Discovery Endpoints

Discovery endpoints let SCIM (System for Cross-domain Identity Management, the standard for syncing users and groups between systems) clients learn about the service provider's capabilities, supported resources, and schema definitions. They are defined by the SCIM 2.0 protocol and return the resource shapes described in the SCIM 2.0 core schema.

Service Provider Configuration

GET /orgs/\{orgId\}/api/v1/scim2.0/ServiceProviderConfig

Returns the service provider's configuration including supported features and authentication schemes. This endpoint does not require authentication.

curl -X GET "https://app.lumoauth.dev/orgs/acme-corp/api/v1/scim2.0/ServiceProviderConfig"

Response

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
  "documentationUri": "https://app.lumoauth.dev/orgs/acme-corp/api/v1/scim2.0/docs",
  "patch": {"supported": true},
  "bulk": {
    "supported": true,
    "maxOperations": 100,
    "maxPayloadSize": 1048576
  },
  "filter": {
    "supported": true,
    "maxResults": 200
  },
  "changePassword": {"supported": true},
  "sort": {"supported": true},
  "etag": {"supported": true},
  "softDelete": {"supported": true},
  "authenticationSchemes": [
    {
      "name": "OAuth Bearer Token",
      "description": "Authentication using OAuth 2.0 Bearer Token",
      "type": "oauthbearertoken",
      "specUri": "https://tools.ietf.org/html/rfc6750",
      "primary": true
    }
  ]
}

changePassword applies to /Users/{id} (the password must meet the organization's password policy); /Me never changes a password. filter.supported means the grammar in Filter Syntax; anything outside it returns 400 invalidFilter.

The advertised authenticationSchemes lists only OAuth Bearer Token, but HTTP Basic authentication is also accepted (it is used throughout these docs for brevity, e.g. -u "admin@acme.com:password"). The authenticated principal must hold the scim.manage permission to call the provisioning endpoints; the discovery endpoints below are public.

Basic auth is a single factor

HTTP Basic authentication carries a password only, so it is refused (generic 401) for any account that has multi-factor authentication enrolled — otherwise SCIM would be an MFA bypass for administrator accounts. Production integrations (Okta, Entra ID, custom provisioning jobs) should authenticate with the organization's SCIM provisioning bearer token (Portal → Integrations → SCIM) or an OAuth access token instead of an administrator's password.

Resource Types

GET /orgs/\{orgId\}/api/v1/scim2.0/ResourceTypes

Lists all supported resource types (User, Group, and the PAM resource types) and their schemas. A single resource type is available at GET /orgs/{orgId}/api/v1/scim2.0/ResourceTypes/{name} (for example /ResourceTypes/User).

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 4,
  "Resources": [
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
      "id": "User",
      "name": "User",
      "endpoint": "/Users",
      "description": "User Account",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
      "schemaExtensions": [
        {
          "schema": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
          "required": false
        },
        {
          "schema": "urn:ietf:params:scim:schemas:extension:password:2.0:User",
          "required": false
        }
      ]
    },
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
      "id": "Group",
      "name": "Group",
      "endpoint": "/Groups",
      "description": "Group",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:Group"
    },
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
      "id": "Container",
      "name": "Container",
      "endpoint": "/Containers",
      "description": "PAM Container for organizing privileged data",
      "schema": "urn:ietf:params:scim:schemas:pam:1.0:Container"
    },
    {
      "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
      "id": "PrivilegedData",
      "name": "PrivilegedData",
      "endpoint": "/PrivilegedData",
      "description": "PAM Privileged Data resource",
      "schema": "urn:ietf:params:scim:schemas:pam:1.0:PrivilegedData"
    }
  ]
}

PAM resource types

Container and PrivilegedData are Privileged Access Management (PAM) resource types exposed over SCIM. They are provisioned through /Containers and /PrivilegedData and surfaced here for discovery; the standard /Users and /Groups resources cover most directory-sync use cases.

Schemas

GET /orgs/\{orgId\}/api/v1/scim2.0/Schemas

Returns the full schema definitions for all supported resource types, including attributes, types, mutability, and other metadata.

GET /orgs/\{orgId\}/api/v1/scim2.0/Schemas/\{schemaUrn\}

Get a specific schema by its URN:

# Get User schema
GET /scim2.0/Schemas/urn:ietf:params:scim:schemas:core:2.0:User

# Get Group schema  
GET /scim2.0/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group

# Get Enterprise User extension
GET /scim2.0/Schemas/urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

# Get Password extension
GET /scim2.0/Schemas/urn:ietf:params:scim:schemas:extension:password:2.0:User

Supported Schemas

Schema URN	Description
urn:ietf:params:scim:schemas:core:2.0:User	Core User schema (SCIM 2.0 core schema)
urn:ietf:params:scim:schemas:core:2.0:Group	Core Group schema (SCIM 2.0 core schema)
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User	Enterprise User extension (SCIM 2.0 core schema)
urn:ietf:params:scim:schemas:extension:password:2.0:User	Password lifecycle extension (passwordLastChanged, mustChangePassword, isLocked, …)

These four URNs are the ones returned by GET /Schemas, and each is individually retrievable via GET /Schemas/{schemaUrn}.

Standards used on this page

Plain name	Standard
SCIM 2.0 (user and group provisioning)	RFC 7642, RFC 7643 and RFC 7644
Bearer tokens	RFC 6750

See the standards reference for what each one covers and how LumoAuth uses it.