SCIM (System for Cross-domain Identity Management, RFC 7643/7644) is a standard for automating the exchange of user identity information between identity domains and applications. It defines a common schema and a RESTful API for provisioning and managing users and groups.
SCIM
SCIM, the System for Cross-domain Identity Management, is an open standard (RFC 7643 and RFC 7644) for automating how user and group identities move between identity providers and the applications that consume them. It pairs a common identity schema with a RESTful API, so that creating, updating, deactivating, and deleting accounts becomes a predictable set of HTTP operations rather than a pile of bespoke integrations.
- A common identity schema - RFC 7643 defines core
UserandGroupresources so every party agrees on what an identity looks like. - A RESTful provisioning API - RFC 7644 specifies the endpoints and operations for creating, reading, updating, and removing those resources.
- Lifecycle automation - Joiner, mover, and leaver events propagate automatically from the identity source to downstream applications.
- Interoperability - Because it is a shared standard, one SCIM implementation works across many identity providers and SaaS applications.
In real API operations, SCIM is how an enterprise keeps its SaaS footprint in sync with its directory: when an employee is hired, moved, or offboarded, the identity provider pushes those changes over SCIM so access is granted and, crucially, revoked without manual tickets. For API providers, shipping a SCIM endpoint is a concrete enterprise-readiness signal that sits alongside single sign-on. It is also a governance surface worth scoring, because reliable de-provisioning is one of the clearest markers of operational maturity around identity and access.
