SCIM API user and group provisioning
How the SCIM API creates, updates, deactivates and reactivates Slack users and manages groups: v1.1 versus v2.0, filters and paging, what DELETE and PUT really do, provisioning limits, per-user locking with 429 Retry-After, and org-wide SCIM with IdP groups in an Enterprise org.
Use the SCIM API to manage Slack users and user groups.
~8 min read · 8 practice questions ·
What the exam expects
- Use SCIM to create, update, deactivate and reactivate Slack users from an identity provider or script, and predict the result of a given request.
- Manage groups with SCIM and tell PATCH (add or remove members) from PUT (replace every member).
- Plan a SCIM 1.1 to 2.0 migration: base URL,
Operationsin PATCH bodies, error format. - Name what SCIM cannot do (permanent deletion, full single-channel guest provisioning, group @-handles) and how Enterprise orgs differ (org-wide scope, IdP groups).
- Handle SCIM's per-user and per-group locking when updates collide.
Key terms: SCIM (System for Cross-domain Identity Management, an open REST standard identity providers use to push users and groups); deactivation (the only way SCIM removes a user); IdP group (a group created from the identity provider, which SCIM creates in an Enterprise org); multi-channel guest (restricted); single-channel guest (ultra_restricted).
Key facts
- Detail
- Business+ or Enterprise only
- Detail
- OAuth token with the
adminscope, sent as Bearer
- Detail
/scim/v2; PATCH needsOperations(add, remove, replace)
DELETE /Users/<id>- Detail
- Deactivates; no permanent deletion
- Detail
- Set
activeto true on the existing ID
- Detail
- POST fails even if the holder is deactivated
- Detail
- Ten per page by default;
startIndexandcount
- Detail
restricted= multi-channel,ultra_restricted= single-channel
PUT /Groups/<id>- Detail
- Replaces all members
- Detail
- 15,000 users per call; 5,000 recommended
- Detail
- One per user or group; 429 with
retry-after
- Detail
- Fully provision single-channel guests; set @group handles
Sources for this section (2)
- Why does a rehire's SCIM POST fail when the old account is deactivated?
- When should a connector use PATCH rather than PUT on a group?
- What two changes does a move to SCIM 2.0 require?
- Why does a burst of updates to one user return HTTP 429?
- What does creating a SCIM group do in an Enterprise org?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (8 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams