Revision #463

## API: SCIM 2.0 Provisioning

mobieusCore implements SCIM 2.0 so your identity provider can provision and deprovision users automatically. SCIM is part of mobieusLearn and is available on Pro, Creator, Creator Plus, and Sovereign plans once the mobieusLearn SCIM feature is enabled.

Two things differ from the rest of the API, and both will bite an integration that assumes otherwise:

- **A separate credential.** The SCIM token is not an `mc_live_` API key and carries no scopes. Mint it at `/admin/learn/scim-credentials`.
- **Errors use the SCIM envelope**, not the platform one — `{"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"status":"401","detail":"…"}`. Parsers written against `error.code` / `error.request_id` will not match.

When the mobieusLearn SCIM feature is switched off, every `/scim/v2/*` path returns **404**, not 403 — the surface's existence is deliberately not disclosed to an unauthenticated probe. A 404 therefore means either "no such resource" or "SCIM is off", and the two are indistinguishable by design.

### Base URL

```
https://{tenant}.mobieus.io/scim/v2
```

### Authentication

Mint a SCIM token at **Admin → mobieusLearn → SCIM credentials** (`/admin/learn/scim-credentials`). The token is shown once. Pass it as:

```
Authorization: Bearer <token>
```

### Supported endpoints

| Method | Path | Description |
|---|---|---|
| GET | `/scim/v2/ServiceProviderConfig` | Service provider capabilities |
| GET | `/scim/v2/ResourceTypes` | Supported resource types |
| GET | `/scim/v2/Schemas` | Supported schemas |
| GET | `/scim/v2/Users` | List users |
| POST | `/scim/v2/Users` | Create user |
| GET/PUT/PATCH | `/scim/v2/Users/{id}` | Manage user |
| DELETE | `/scim/v2/Users/{id}` | Deactivate user |
| GET/POST | `/scim/v2/Groups` | List / create groups |
| GET/PUT/PATCH/DELETE | `/scim/v2/Groups/{id}` | Manage group |

See also: [mobieusLearn SCIM setup](/know/learn-scim-setup).