SCIM 2.0 provisioning endpoints (/scim/v2/*) missing from the published API reference at /api/docs

Area: Integration / API (audit p13) · Surface: /scim/v2/Users, /scim/v2/Groups, /scim/v2/ServiceProviderConfig (15 endpoints) · Dimension: documentation · Severity: minor

The /api/docs Redoc page (spec at /api/openapi.yaml, title 'mobieusCore Public API' v1.4.0) is the authoritative API reference yet contains zero SCIM paths. IdP admins configuring SCIM provisioning against an unfamiliar endpoint cannot consult the API reference for resource shapes or filter syntax; they only have the prose setup article. SCIM is a standardized contract where a precise schema reference matters.

Evidence

ScimController doc block at /home/patrick/mobieus-io/platform/src/Controllers/Learn/ScimController.php:13-39 documents the full SCIM 2.0 surface (ServiceProviderConfig, ResourceTypes, Schemas, Users CRUD+PATCH, Groups CRUD+PATCH). The OpenAPI reference omits it entirely: `curl -s https://support.mobieus.io/api/openapi.yaml | grep -ic scim` returns `0`. (Note: a setup guide DOES exist at /know/learn-scim-setup → HTTP 200, so the wiki side is partially covered; the gap is specifically the machine-readable API reference at /api/docs.)

Suggested fix. Add the /scim/v2/* paths to the OpenAPI spec (or document why SCIM is intentionally excluded as a standards-defined contract and link learn-scim-setup from /api/docs). Cross-link /know/learn-scim-setup to the API reference.

Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.