# SCIM API user and group provisioning

*Slack Developer Study Guide · APIs for Managing Your Slack · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-developer/apis-for-managing-your-slack/scim-api-user-and-group-provisioning*

How the SCIM API creates, updates, deactivates and reactivates Slack users and manages groups: v1.1 versus v2.0, filters and paging, what DELETE and PUT really do, provisioning limits, per-user locking with 429 Retry-After, and org-wide SCIM with IdP groups in an Enterprise org.

- Certification: Salesforce Slack Developer
- Exam section: APIs for Managing Your Slack
- Study guide: https://www.certifyforce.com/study-guide/slack-developer

**Official exam objective:**

> Use the SCIM API to manage Slack users and user groups.

## What the exam expects

- Use SCIM to create, update, deactivate and reactivate Slack users from an identity provider or script, and predict the result of a given request.
- Manage groups with SCIM and tell PATCH (add or remove members) from PUT (replace every member).
- Plan a SCIM 1.1 to 2.0 migration: base URL, `Operations` in PATCH bodies, error format.
- Name what SCIM cannot do (permanent deletion, full single-channel guest provisioning, group @-handles) and how Enterprise orgs differ (org-wide scope, IdP groups).
- Handle SCIM's per-user and per-group locking when updates collide.

Key terms: **SCIM** (System for Cross-domain Identity Management, an open REST standard identity providers use to push users and groups); **deactivation** (the only way SCIM removes a user); **IdP group** (a group created from the identity provider, which SCIM creates in an Enterprise org); **multi-channel guest** (`restricted`); **single-channel guest** (`ultra_restricted`).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Plans | Business+ or Enterprise only | [Using the SCIM API](https://docs.slack.dev/admins/scim-api/) |
| Token | OAuth token with the `admin` scope, sent as Bearer | [Using the SCIM API](https://docs.slack.dev/admins/scim-api/) |
| 2.0 changes | `/scim/v2`; PATCH needs `Operations` (add, remove, replace) | [Using the SCIM API](https://docs.slack.dev/admins/scim-api/) |
| `DELETE /Users/<id>` | Deactivates; no permanent deletion | [SCIM API reference](https://docs.slack.dev/reference/scim-api/) |
| Reactivation | Set `active` to true on the existing ID | [SCIM API reference](https://docs.slack.dev/reference/scim-api/) |
| Duplicate email | POST fails even if the holder is deactivated | [Using the SCIM API](https://docs.slack.dev/admins/scim-api/) |
| Paging | Ten per page by default; `startIndex` and `count` | [SCIM API reference](https://docs.slack.dev/reference/scim-api/) |
| Guest filters | `restricted` = multi-channel, `ultra_restricted` = single-channel | [SCIM API reference](https://docs.slack.dev/reference/scim-api/) |
| `PUT /Groups/<id>` | Replaces all members | [SCIM API reference](https://docs.slack.dev/reference/scim-api/) |
| Group batch size | 15,000 users per call; 5,000 recommended | [SCIM API reference](https://docs.slack.dev/reference/scim-api/) |
| Concurrent updates | One per user or group; 429 with `retry-after` | [SCIM API reference](https://docs.slack.dev/reference/scim-api/) |
| Cannot do | Fully provision single-channel guests; set @group handles | [Using the SCIM API](https://docs.slack.dev/admins/scim-api/) |

## Check yourself

- Why does a rehire's SCIM POST fail when the old account is deactivated?
- When should a connector use PATCH rather than PUT on a group?
- What two changes does a move to SCIM 2.0 require?
- Why does a burst of updates to one user return HTTP 429?
- What does creating a SCIM group do in an Enterprise org?

## Sources

- [Using the Slack SCIM API](https://docs.slack.dev/admins/scim-api/)
- [SCIM API reference](https://docs.slack.dev/reference/scim-api/)
- [Efficiently Manage Slack Users and Groups with SCIM API](https://trailhead.salesforce.com/content/learn/modules/slack-apis-for-automating-and-managing-your-org/provision-users-and-groups-with-scim)
- [admin.conversations.restrictAccess.addGroup method](https://docs.slack.dev/reference/methods/admin.conversations.restrictAccess.addGroup)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Slack Developer pack (USD $19): https://www.certifyforce.com/practice-exams