mobieusKnow API: SCIM 2.0 Provisioning History #637

Revision #637

Approved CURRENT VERSION
All revisions
Author
Patrick Bass
Submitted
Sep 5, 2026 4:34am
Summary
Family meal sharing tickets: the conditions behind the share button and the Share with family? switch, reading a "logged but not shared" report back to a member, sharing a saved meal without logging it, and what to escalate

API: SCIM 2.0 Provisioning

mobieusCore implements SCIM 2.0 so your identity provider can provision and deprovision users automatically. SCIM is part of mobieusLearn and is available on Pro, Creator, Creator Plus, and Sovereign plans once the mobieusLearn SCIM feature is enabled.

Two things differ from the rest of the API, and both will bite an integration that assumes otherwise:

  • A separate credential. The SCIM token is not an mc_live_ API key and carries no scopes. Mint it at /admin/learn/scim-credentials.
  • Errors use the SCIM envelope, not the platform one. It looks like {"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"status":"401","detail":"…"}. Parsers written against error.code / error.request_id will not match.

When the mobieusLearn SCIM feature is switched off, every /scim/v2/* path returns 404, not 403. The surface's existence is deliberately not disclosed to an unauthenticated probe. A 404 therefore means either "no such resource" or "SCIM is off", and the two are indistinguishable by design.

Base URL

https://{tenant}.mobieus.io/scim/v2

Authentication

Mint a SCIM token at Admin → mobieusLearn → SCIM credentials (/admin/learn/scim-credentials). The token is shown once. Pass it as:

Authorization: Bearer <token>

Supported endpoints

Method Path Description
GET /scim/v2/ServiceProviderConfig Service provider capabilities
GET /scim/v2/ResourceTypes Supported resource types
GET /scim/v2/Schemas Supported schemas
GET /scim/v2/Users List users
POST /scim/v2/Users Create user
GET/PUT/PATCH /scim/v2/Users/{id} Manage user
DELETE /scim/v2/Users/{id} Deactivate user
GET/POST /scim/v2/Groups List / create groups
GET/PUT/PATCH/DELETE /scim/v2/Groups/{id} Manage group

See also: mobieusLearn SCIM setup.

## API: SCIM 2.0 Provisioning

mobieusCore implements SCIM 2.0 so your identity provider can provision and deprovision users automatically. SCIM is part of mobieusLearn and is available on Pro, Creator, Creator Plus, and Sovereign plans once the mobieusLearn SCIM feature is enabled.

Two things differ from the rest of the API, and both will bite an integration that assumes otherwise:

- **A separate credential.** The SCIM token is not an `mc_live_` API key and carries no scopes. Mint it at `/admin/learn/scim-credentials`.
- **Errors use the SCIM envelope**, not the platform one. It looks like `{"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"status":"401","detail":"…"}`. Parsers written against `error.code` / `error.request_id` will not match.

When the mobieusLearn SCIM feature is switched off, every `/scim/v2/*` path returns **404**, not 403. The surface's existence is deliberately not disclosed to an unauthenticated probe. A 404 therefore means either "no such resource" or "SCIM is off", and the two are indistinguishable by design.

### Base URL

```
https://{tenant}.mobieus.io/scim/v2
```

### Authentication

Mint a SCIM token at **Admin → mobieusLearn → SCIM credentials** (`/admin/learn/scim-credentials`). The token is shown once. Pass it as:

```
Authorization: Bearer <token>
```

### Supported endpoints

| Method | Path | Description |
|---|---|---|
| GET | `/scim/v2/ServiceProviderConfig` | Service provider capabilities |
| GET | `/scim/v2/ResourceTypes` | Supported resource types |
| GET | `/scim/v2/Schemas` | Supported schemas |
| GET | `/scim/v2/Users` | List users |
| POST | `/scim/v2/Users` | Create user |
| GET/PUT/PATCH | `/scim/v2/Users/{id}` | Manage user |
| DELETE | `/scim/v2/Users/{id}` | Deactivate user |
| GET/POST | `/scim/v2/Groups` | List / create groups |
| GET/PUT/PATCH/DELETE | `/scim/v2/Groups/{id}` | Manage group |

See also: [mobieusLearn SCIM setup](/know/learn-scim-setup).