Developer Docs

SCIM

Provision and manage Trint users and groups from your identity provider using SCIM 2.0.

The SCIM API lets an identity provider create, update and deactivate Trint user accounts and groups automatically, so joiners and leavers are handled without anyone touching the Trint admin UI.

Trint's implementation conforms to SCIM 2.0 as defined by the three RFCs that make up the specification:

  • RFC 7642 — Definitions, Overview, Concepts and Requirements. The use cases and provisioning scenarios SCIM is designed around.
  • RFC 7643 — Core Schema. The User and Group resource definitions, attribute types and common attributes such as meta and externalId.
  • RFC 7644 — Protocol. The endpoints, the application/scim+json media type, filtering, paging and PATCH semantics.

Because it follows the standard, the resource shapes and filter syntax below will look familiar if you have integrated SCIM elsewhere, and off-the-shelf SCIM connectors work against it. Where the specification makes a feature optional, use Service provider configuration to confirm what this deployment supports before relying on it.

For an introduction to what SCIM is and why you would use it, see the SCIM guide.

SCIM is a partner API

Unlike the rest of the Trint API, SCIM is not enabled with a self-service API key. Trint issues OAuth 2.0 client credentials to the identity-provider partner, who uses them to run OAuth flows on behalf of Trint customers. Contact your account manager or support@trint.com to start onboarding.

Base URLs

The SCIM service is deployed per tenant, and each tenant has its own authorization server. Use the pair that matches the customer's tenant — see US vs EU Tenant if you are not sure which that is.

TenantSCIM base URLAuthorization server
UShttps://scim.trint.com/v2https://auth.trint.com
EUhttps://scim.eu.trint.com/v2https://auth.eu.trint.com

Authentication

Every request must carry a bearer token issued by the authorization server for the customer's tenant, using the audience and scopes below.

SettingValue
Audiencehttps://apis.trint.com/scim-api
Scopeshttps://apis.trint.com/scim-api/provisioning, offline_access

Request the token from the tenant's /oauth/token endpoint, then send it as a bearer token:

curl
curl --request GET \
  --url 'https://scim.trint.com/v2/Users?count=10' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Accept: application/scim+json'

SCIM uses its own media type

SCIM requests and responses use application/scim+json rather than application/json, as required by RFC 7644. Send it as your Content-Type on writes and accept it on reads.

Service provider configuration

Discover which parts of SCIM this deployment supports before you rely on them. Trint currently supports PATCH and filtering (up to 100 results), and does not support bulk operations, sorting, ETags or password changes.

Get service provider config

gethttps://scim.trint.com/v2/ServiceProviderConfig
GET /ServiceProviderConfig
curl --request GET \  --url 'https://scim.trint.com/v2/ServiceProviderConfig' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
  ],
  "patch": {
    "supported": true
  },
  "bulk": {
    "supported": false,
    "maxPayloadSize": 0,
    "maxOperations": 0
  },
  "filter": {
    "supported": true,
    "maxResults": 100
  },
  "changePassword": {
    "supported": false
  },
  "sort": {
    "supported": false
  },
  "etag": {
    "supported": false
  },
  "documentationUri": "https://developer.trint.com/reference/scim/",
  "authenticationSchemes": [
    {
      "name": "OAuth 2.0",
      "description": "Authorisation using an OAuth 2.0 issued token",
      "type": "oauth2",
      "primary": true
    }
  ],
  "meta": {
    "location": "https://scim.trint.com/v2/ServiceProviderConfigs",
    "resourceType": "ServiceProviderConfig"
  }
}
200Successful operation
401Unauthorized — the access token is missing, expired or invalid.

Schemas

Retrieve the SCIM resource schemas this deployment exposes, including each attribute's type, mutability and uniqueness. Useful for validating your attribute mapping during onboarding.

Get information about supported resource schemas

gethttps://scim.trint.com/v2/Schemas
GET /Schemas
curl --request GET \  --url 'https://scim.trint.com/v2/Schemas' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 2,
  "Resources": [
    {
      "id": "urn:ietf:params:scim:schemas:core:2.0:User",
      "name": "User",
      "description": "User Account",
      "meta": {
        "resourceType": "Schema",
        "location": "/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User"
      },
      "attributes": [
        {
          "name": "userName",
          "type": "string",
          "multiValued": false,
          "description": "Unique identifier for the User, typically used by the user to directly authenticate to the service provider. Each User MUST include a non-empty userName value. This identifier MUST be unique across the service provider's entire set of Users. REQUIRED",
          "caseExact": false,
          "required": true,
          "mutability": "immutable",
          "returned": "default",
          "uniqueness": "server"
        },
        {
          "name": "name",
          "type": "complex",
          "multiValued": false,
          "description": "The components of the user's real name.",
          "required": true,
          "subAttributes": [
            {
              "name": "familyName",
              "type": "string",
              "multiValued": false,
              "description": "The family name of the User, or last name in most Western languages (e.g., 'Jensen' given the full name 'Ms. Barbara J Jensen, III'",
              "required": true,
              "caseExact": false,
              "mutability": "readWrite",
              "returned": "default",
              "uniqueness": "none"
            },
            {
              "name": "givenName",
              "type": "string",
              "multiValued": false,
              "description": "The given name of the User, or first name in most Western languages (e.g., 'Barabara' given the full name 'Ms. Barbara J Jensen, III'",
              "required": true,
              "caseExact": false,
              "mutability": "readWrite",
              "returned": "default",
              "uniqueness": "none"
            }
          ],
          "returned": "default"
        },
        {
          "name": "emails",
          "type": "complex",
          "multiValued": true,
          "description": "Email addresses for the user.  The value SHOULD be canonicalized by the service provider, e.g., 'bjensen@example.com' instead of 'bjensen@EXAMPLE.COM'. Canonical type values of 'work', 'home', and 'other'.",
          "required": false,
          "subAttributes": [
            {
              "name": "value",
              "type": "string",
              "multiValued": false,
              "description": "Email addresses for the user.  The value SHOULD be canonicalized by the service provider, e.g., 'bjensen@example.com' instead of 'bjensen@EXAMPLE.COM'. Canonical type values of 'work', 'home', and 'other'.",
              "required": false,
              "caseExact": false,
              "mutability": "readWrite",
              "returned": "default",
              "uniqueness": "none"
            },
            {
              "name": "type",
              "type": "string",
              "multiValued": false,
              "description": "A label indicating the attribute's function, e.g., 'work' or 'home'.",
              "required": false,
              "caseExact": false,
              "canonicalValues": [
                "work",
                "home",
                "other"
              ],
              "mutability": "readWrite",
              "returned": "default",
              "uniqueness": "none"
            },
            {
              "name": "primary",
              "type": "boolean",
              "multiValued": false,
              "description": "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g., the preferred mailing address or primary email address.  The primary attribute value 'true' MUST appear no more than once.",
              "required": false,
              "mutability": "readWrite",
              "returned": "default"
            }
          ],
          "mutability": "readWrite",
          "returned": "default",
          "uniqueness": "none"
        },
        {
          "name": "active",
          "type": "boolean",
          "multiValued": false,
          "description": "A Boolean value indicating the User's administrative status.",
          "required": false,
          "mutability": "readWrite",
          "returned": "default"
        },
        {
          "name": "externalId",
          "type": "string",
          "multiValued": false,
          "description": "An identifier for the resource as defined by the provisioning client",
          "required": false,
          "mutability": "readWrite",
          "caseExact": true,
          "returned": "default",
          "uniqueness": "none"
        }
      ]
    },
    {
      "id": "urn:ietf:params:scim:schemas:core:2.0:Group",
      "name": "Group",
      "description": "Group",
      "meta": {
        "resourceType": "Schema",
        "location": "/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group"
      },
      "attributes": [
        {
          "name": "displayName",
          "type": "string",
          "multiValued": false,
          "description": "A human-readable name for the Group. REQUIRED",
          "required": true,
          "caseExact": false,
          "mutability": "readWrite",
          "returned": "default",
          "uniqueness": "none"
        },
        {
          "name": "members",
          "type": "complex",
          "multiValued": true,
          "description": "A list of members of the Group.",
          "required": false,
          "mutability": "readWrite",
          "returned": "default",
          "subAttributes": [
            {
              "name": "value",
              "type": "string",
              "multiValued": false,
              "description": "Identifier of the members of this Group.",
              "required": false,
              "caseExact": false,
              "mutability": "immutable",
              "returned": "default",
              "uniqueness": "none"
            },
            {
              "name": "$ref",
              "type": "reference",
              "referenceTypes": [
                "User"
              ],
              "multiValued": false,
              "description": "The URI corresponding to a SCIM resource that is a member of this Group.",
              "required": false,
              "caseExact": false,
              "mutability": "immutable",
              "returned": "default",
              "uniqueness": "none"
            },
            {
              "name": "type",
              "type": "string",
              "multiValued": false,
              "description": "A label indicating the type of resource, e.g Group",
              "required": false,
              "caseExact": false,
              "canonicalValues": [
                "User"
              ],
              "mutability": "immutable",
              "returned": "default",
              "uniqueness": "none"
            }
          ]
        }
      ]
    }
  ]
}
200Successful operation
401Unauthorized — the access token is missing, expired or invalid.
500Internal server error

Get a resource schema by Id

gethttps://scim.trint.com/v2/Schemas/{id}

Path parameters

idstringrequired

User Id

Allowed: User, Group, urn:ietf:params:scim:schemas:core:2.0:User, urn:ietf:params:scim:schemas:core:2.0:Group

GET /Schemas/{id}
curl --request GET \  --url 'https://scim.trint.com/v2/Schemas/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "id": "urn:ietf:params:scim:schemas:core:2.0:User",
  "name": "User",
  "description": "User Account",
  "meta": {
    "resourceType": "Schema",
    "location": "/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User"
  },
  "attributes": [
    {
      "name": "userName",
      "type": "string",
      "multiValued": false,
      "description": "Unique identifier for the User, typically used by the user to directly authenticate to the service provider. Each User MUST include a non-empty userName value. This identifier MUST be unique across the service provider's entire set of Users. REQUIRED",
      "caseExact": false,
      "required": true,
      "mutability": "immutable",
      "returned": "default",
      "uniqueness": "server"
    },
    {
      "name": "name",
      "type": "complex",
      "multiValued": false,
      "description": "The components of the user's real name.",
      "required": true,
      "subAttributes": [
        {
          "name": "familyName",
          "type": "string",
          "multiValued": false,
          "description": "The family name of the User, or last name in most Western languages (e.g., 'Jensen' given the full name 'Ms. Barbara J Jensen, III'",
          "required": true,
          "caseExact": false,
          "mutability": "readWrite",
          "returned": "default",
          "uniqueness": "none"
        },
        {
          "name": "givenName",
          "type": "string",
          "multiValued": false,
          "description": "The given name of the User, or first name in most Western languages (e.g., 'Barabara' given the full name 'Ms. Barbara J Jensen, III'",
          "required": true,
          "caseExact": false,
          "mutability": "readWrite",
          "returned": "default",
          "uniqueness": "none"
        }
      ],
      "returned": "default"
    },
    {
      "name": "emails",
      "type": "complex",
      "multiValued": true,
      "description": "Email addresses for the user.  The value SHOULD be canonicalized by the service provider, e.g., 'bjensen@example.com' instead of 'bjensen@EXAMPLE.COM'. Canonical type values of 'work', 'home', and 'other'.",
      "required": false,
      "subAttributes": [
        {
          "name": "value",
          "type": "string",
          "multiValued": false,
          "description": "Email addresses for the user.  The value SHOULD be canonicalized by the service provider, e.g., 'bjensen@example.com' instead of 'bjensen@EXAMPLE.COM'. Canonical type values of 'work', 'home', and 'other'.",
          "required": false,
          "caseExact": false,
          "mutability": "readWrite",
          "returned": "default",
          "uniqueness": "none"
        },
        {
          "name": "type",
          "type": "string",
          "multiValued": false,
          "description": "A label indicating the attribute's function, e.g., 'work' or 'home'.",
          "required": false,
          "caseExact": false,
          "canonicalValues": [
            "work",
            "home",
            "other"
          ],
          "mutability": "readWrite",
          "returned": "default",
          "uniqueness": "none"
        },
        {
          "name": "primary",
          "type": "boolean",
          "multiValued": false,
          "description": "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g., the preferred mailing address or primary email address.  The primary attribute value 'true' MUST appear no more than once.",
          "required": false,
          "mutability": "readWrite",
          "returned": "default"
        }
      ],
      "mutability": "readWrite",
      "returned": "default",
      "uniqueness": "none"
    },
    {
      "name": "active",
      "type": "boolean",
      "multiValued": false,
      "description": "A Boolean value indicating the User's administrative status.",
      "required": false,
      "mutability": "readWrite",
      "returned": "default"
    },
    {
      "name": "externalId",
      "type": "string",
      "multiValued": false,
      "description": "An identifier for the resource as defined by the provisioning client",
      "required": false,
      "mutability": "readWrite",
      "caseExact": true,
      "returned": "default",
      "uniqueness": "none"
    }
  ]
}
200Successful operation
404Not found
500Internal server error

Resource types

List the resource types available, and the endpoint that serves each one. Trint exposes two: User at /Users and Group at /Groups.

Get information about supported resource types

gethttps://scim.trint.com/v2/ResourceTypes
GET /ResourceTypes
curl --request GET \  --url 'https://scim.trint.com/v2/ResourceTypes' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 2,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
      ],
      "id": "User",
      "name": "User",
      "endpoint": "/Users",
      "description": "User Account",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
      "meta": {
        "location": "https://scim.trint.com/v2/ResourceTypes/User",
        "resourceType": "ResourceType"
      }
    },
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
      ],
      "id": "Group",
      "name": "Group",
      "endpoint": "/Groups",
      "description": "Group",
      "schema": "urn:ietf:params:scim:schemas:core:2.0:Group",
      "meta": {
        "location": "https://scim.trint.com/v2/ResourceTypes/Group",
        "resourceType": "ResourceType"
      }
    }
  ]
}
200Successful operation
401Unauthorized — the access token is missing, expired or invalid.
500Internal server error

Get a resource type by Id

gethttps://scim.trint.com/v2/ResourceTypes/{id}

Path parameters

idstringrequired

resourceType Id

Allowed: User, Group

GET /ResourceTypes/{id}
curl --request GET \  --url 'https://scim.trint.com/v2/ResourceTypes/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
  ],
  "id": "User",
  "name": "User",
  "endpoint": "/Users",
  "description": "User Account",
  "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
  "meta": {
    "location": "https://scim.trint.com/v2/ResourceTypes/User",
    "resourceType": "ResourceType"
  }
}
200Successful operation
404Not found
500Internal server error

Users

A Trint SCIM user maps to a Trint account. userName must be an email address, and active controls whether the account is enabled — deactivating a user is how you offboard someone.

List users

Return a paged list of users. Use filter to look a user up by attribute (for example userName eq "devtest@trint.com"), and startIndex/count to page. Filtering returns at most 100 results per page.

Search or list users

gethttps://scim.trint.com/v2/Users

Query parameters

filterstringoptional

Filter expression for querying a subset of resources

startIndexinteger (int32)optional

Start index (1-based)

countinteger (int32)optional

Page size

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

GET /Users
curl --request GET \  --url 'https://scim.trint.com/v2/Users' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "itemsPerPage": 2,
  "startIndex": 1,
  "totalResults": 10,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "meta": {
        "resourceType": "User",
        "created": "2022-12-02T09:48:14.218Z",
        "lastModified": "2022-12-02T09:48:14.678Z",
        "location": "https://scim.trint.com/v2/Users/6784c3a4ed66dec96ffcf035"
      },
      "userName": "devtest1@trint.com",
      "name": {
        "givenName": "Dev",
        "familyName": "Trint"
      },
      "active": true,
      "id": "6784c3a4ed66dec96ffcf035",
      "emails": []
    },
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "meta": {
        "resourceType": "User",
        "created": "2022-12-02T09:48:14.218Z",
        "lastModified": "2022-12-02T09:48:14.678Z",
        "location": "https://scim.trint.com/v2/Users/6888f6f88ee1631c0f182be8"
      },
      "userName": "devtest2@trint.com",
      "name": {
        "givenName": "Dev",
        "familyName": "Trint"
      },
      "active": true,
      "id": "6888f6f88ee1631c0f182be8",
      "emails": []
    }
  ]
}
200Successful operation
400Bad request
401Authorization failure
403Permissions denied
500Internal server error

Search users

The same query as List users, but with the filter and paging parameters supplied in a request body instead of the query string. Use this when a filter would be too long or awkward to URL-encode.

Search or list users

posthttps://scim.trint.com/v2/Users/.search

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

Body parameters

countinteger (int32)optional

Page size

filterstringoptional

Only supported for /User and /Group endpoints

schemasarray of stringoptional

Allowed: urn:ietf:params:scim:api:messages:2.0:SearchRequest

startIndexinteger (int32)optional

Start index (1-based)

POST /Users/.search
curl --request POST \  --url 'https://scim.trint.com/v2/Users/.search' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/scim+json' \
  --data '{}'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "itemsPerPage": 2,
  "startIndex": 1,
  "totalResults": 10,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "meta": {
        "resourceType": "User",
        "created": "2022-12-02T09:48:14.218Z",
        "lastModified": "2022-12-02T09:48:14.678Z",
        "location": "https://scim.trint.com/v2/Users/6784c3a4ed66dec96ffcf035"
      },
      "userName": "devtest1@trint.com",
      "name": {
        "givenName": "Dev",
        "familyName": "Trint"
      },
      "active": true,
      "id": "6784c3a4ed66dec96ffcf035",
      "emails": []
    },
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "meta": {
        "resourceType": "User",
        "created": "2022-12-02T09:48:14.218Z",
        "lastModified": "2022-12-02T09:48:14.678Z",
        "location": "https://scim.trint.com/v2/Users/6888f6f88ee1631c0f182be8"
      },
      "userName": "devtest2@trint.com",
      "name": {
        "givenName": "Dev",
        "familyName": "Trint"
      },
      "active": true,
      "id": "6888f6f88ee1631c0f182be8",
      "emails": []
    }
  ]
}
200Returns a list of users
400Bad request
401Authorization failure
403Permissions denied
500Internal server error

Provision a user

Provision a new Trint account. schemas, userName and name are required. Supply your own externalId to correlate the Trint record with the user in your directory. Returns 409 if a user with that userName already exists.

Create a user

posthttps://scim.trint.com/v2/Users

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

Body parameters

activebooleanoptional

User status

emailsarray of objectoptional
externalIdstringoptional

External unique resource Id defined by provisioning client

idstringoptional

Unique resource Id

namestringrequired
schemasarray of stringrequired

Allowed: urn:ietf:params:scim:schemas:core:2.0:User

userNamestringrequired

MUST be an email address

POST /Users
curl --request POST \  --url 'https://scim.trint.com/v2/Users' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/scim+json' \
  --data '{}'

Response 201

201 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "active": true,
  "externalId": "randomId",
  "name": {
    "formatted": "Dev Test",
    "familyName": "Dev",
    "givenName": "Test"
  },
  "emails": [
    {
      "type": "work",
      "value": "devtest@trint.com",
      "primary": true
    }
  ],
  "userName": "devtest@trint.com"
}
201Successfully created user
400Bad request
401Authorization failure
403Permissions denied
409Duplicate email
500Internal server error

Retrieve a user

Fetch a single user by their Trint SCIM id — the value returned in id when the user was created, not their externalId.

Get a user by Id

gethttps://scim.trint.com/v2/Users/{id}

Path parameters

idstringrequired

User Id

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

GET /Users/{id}
curl --request GET \  --url 'https://scim.trint.com/v2/Users/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "active": true,
  "externalId": "randomId",
  "name": {
    "formatted": "Dev Test",
    "familyName": "Dev",
    "givenName": "Test"
  },
  "emails": [
    {
      "type": "work",
      "value": "devtest@trint.com",
      "primary": true
    }
  ],
  "userName": "devtest@trint.com"
}
200Successful operation
401Authorization failure
403Permissions denied
404Not found
500Internal server error

Replace a user

Overwrite a user with the representation you supply. Any optional attribute you omit is cleared, so send the complete resource. To change individual attributes instead, use Patch a user.

Fully update/replace a user

puthttps://scim.trint.com/v2/Users/{id}

Path parameters

idstringrequired

User Id

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

Body parameters

activebooleanoptional

User status

emailsarray of objectoptional
externalIdstringoptional

External unique resource Id defined by provisioning client

idstringoptional

Unique resource Id

namestringrequired
schemasarray of stringrequired

Allowed: urn:ietf:params:scim:schemas:core:2.0:User

userNamestringrequired

MUST be an email address

PUT /Users/{id}
curl --request PUT \  --url 'https://scim.trint.com/v2/Users/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/scim+json' \
  --data '{}'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "userName": "devtest@trint.com",
  "name": {
    "formatted": "Dev Test",
    "familyName": "Dev",
    "givenName": "Test"
  },
  "emails": [
    {
      "type": "work",
      "value": "devtest@trint.com",
      "primary": true
    }
  ]
}
200Successfully fully updated a user
400Bad request
401Authorization failure
403Permissions denied
404Not found
500Internal server error

Patch a user

Apply a targeted change without sending the whole resource. Each entry in Operations has an op (add, replace or remove) and a path; value may be a scalar, an object or an array depending on the attribute you are targeting. This is the usual way to deactivate a user (replace active with false).

Partially update/patch a user

patchhttps://scim.trint.com/v2/Users/{id}

Path parameters

idstringrequired

User Id

Body parameters

Operationsarray of objectrequired

Patch operations list

schemasarray of stringrequired

Allowed: urn:ietf:params:scim:api:messages:2.0:PatchOp

PATCH /Users/{id}
curl --request PATCH \  --url 'https://scim.trint.com/v2/Users/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/scim+json' \
  --data '{}'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "active": true,
  "externalId": "randomId",
  "name": {
    "formatted": "Dev Test",
    "familyName": "Dev",
    "givenName": "Test"
  },
  "emails": [
    {
      "type": "work",
      "value": "trintdev@trint.com",
      "primary": true
    }
  ],
  "userName": "devtest@trint.com"
}
200Successfully partially updated user
400Bad request
401Authorization failure
403Permissions denied
404Not found
500Internal server error

Remove a user account

Permanently remove the user's Trint account. Returns 204 with no body.

Deletion is not reversible

Prefer patching active to false to offboard someone — that disables the account while preserving their content. Use DELETE only when the account genuinely must be removed.

Delete a user

deletehttps://scim.trint.com/v2/Users/{id}

Path parameters

idstringrequired

User Id

DELETE /Users/{id}
curl --request DELETE \  --url 'https://scim.trint.com/v2/Users/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 401

401 response
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "detail": "Unauthorized",
  "status": "401"
}
204Successfully deleted
401Authorization failure
403Permissions denied
404Not found
500Internal server error

Groups

Groups collect users together. Each entry in members references a user by their SCIM id.

List groups

Return a paged list of groups, with the same filter, startIndex and count parameters as List users.

Search or list groups

gethttps://scim.trint.com/v2/Groups

Query parameters

filterstringoptional

Filter expression for querying a subset of resources

startIndexinteger (int32)optional

Start index (1-based)

countinteger (int32)optional

Page size

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

GET /Groups
curl --request GET \  --url 'https://scim.trint.com/v2/Groups' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "itemsPerPage": 20,
  "startIndex": 1,
  "totalResults": 3,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "meta": {
        "resourceType": "Group",
        "created": "2022-05-23T13:03:03.560Z",
        "lastModified": "2022-09-02T12:26:47.925Z",
        "location": "https://scim.trint.com/v2/Groups/W6bfHfS1V4ykw2hHCat_IU"
      },
      "displayName": "Dev Team 1",
      "id": "W6bfHfS1V4ykw2hHCat_IU",
      "members": [
        {
          "value": "67e0f592c3f5f7ea18041f35",
          "type": "User"
        },
        {
          "value": "6865cad45eb9190d5ecee995",
          "type": "User"
        }
      ]
    },
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "meta": {
        "resourceType": "Group",
        "created": "2022-05-23T13:03:11.257Z",
        "lastModified": "2022-09-08T11:26:44.473Z",
        "location": "https://scim.trint.com/v2/Groups/2SXGk4r-MwuuEsXKAxSDmu"
      },
      "displayName": "Dev Team 2",
      "id": "2SXGk4r-MwuuEsXKAxSDmu",
      "members": [
        {
          "value": "67a0d43daf33fdaa97de74a4",
          "type": "User"
        },
        {
          "value": "6887b33ea49859f50764ef70",
          "type": "User"
        }
      ]
    },
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "meta": {
        "resourceType": "Group",
        "created": "2023-01-10T11:56:20.368Z",
        "lastModified": "2023-01-10T11:56:20.368Z",
        "location": "https://scim.trint.com/v2/Groups/rYsTOasl8GzYVFLJAE1uBw"
      },
      "displayName": "Dev Team 3",
      "id": "rYsTOasl8GzYVFLJAE1uBw",
      "members": []
    }
  ]
}
200Successful operation
401Authorization failure
403Permissions denied
500Internal server error

Search groups

The body-based equivalent of List groups, for filters that are impractical to send in a query string.

Search or list groups

posthttps://scim.trint.com/v2/Groups/.search

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

Body parameters

countinteger (int32)optional

Page size

filterstringoptional

Only supported for /User and /Group endpoints

schemasarray of stringoptional

Allowed: urn:ietf:params:scim:api:messages:2.0:SearchRequest

startIndexinteger (int32)optional

Start index (1-based)

POST /Groups/.search
curl --request POST \  --url 'https://scim.trint.com/v2/Groups/.search' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/scim+json' \
  --data '{}'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "itemsPerPage": 20,
  "startIndex": 1,
  "totalResults": 3,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "meta": {
        "resourceType": "Group",
        "created": "2022-05-23T13:03:03.560Z",
        "lastModified": "2022-09-02T12:26:47.925Z",
        "location": "https://scim.trint.com/v2/Groups/W6bfHfS1V4ykw2hHCat_IU"
      },
      "displayName": "Dev Team 1",
      "id": "W6bfHfS1V4ykw2hHCat_IU",
      "members": [
        {
          "value": "67e0f592c3f5f7ea18041f35",
          "type": "User"
        },
        {
          "value": "6865cad45eb9190d5ecee995",
          "type": "User"
        }
      ]
    },
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "meta": {
        "resourceType": "Group",
        "created": "2022-05-23T13:03:11.257Z",
        "lastModified": "2022-09-08T11:26:44.473Z",
        "location": "https://scim.trint.com/v2/Groups/2SXGk4r-MwuuEsXKAxSDmu"
      },
      "displayName": "Dev Team 2",
      "id": "2SXGk4r-MwuuEsXKAxSDmu",
      "members": [
        {
          "value": "67a0d43daf33fdaa97de74a4",
          "type": "User"
        },
        {
          "value": "6887b33ea49859f50764ef70",
          "type": "User"
        }
      ]
    },
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
      ],
      "meta": {
        "resourceType": "Group",
        "created": "2023-01-10T11:56:20.368Z",
        "lastModified": "2023-01-10T11:56:20.368Z",
        "location": "https://scim.trint.com/v2/Groups/rYsTOasl8GzYVFLJAE1uBw"
      },
      "displayName": "Dev Team 3",
      "id": "rYsTOasl8GzYVFLJAE1uBw",
      "members": []
    }
  ]
}
200Returns a list of users
400Bad request
401Authorization failure
403Permissions denied
500Internal server error

Create a new group

Create a group with a displayName, optionally populating members in the same request.

Create a group

posthttps://scim.trint.com/v2/Groups

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

Body parameters

idstringoptional

Unique resource Id

displayNamestringrequired

Name of the group

membersarray of objectoptional
schemasarray of stringrequired

Allowed: urn:ietf:params:scim:schemas:core:2.0:Group

POST /Groups
curl --request POST \  --url 'https://scim.trint.com/v2/Groups' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/scim+json' \
  --data '{}'

Response 201

201 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "displayName": "Dev Team",
  "members": [
    {
      "value": "67a0d43daf33fdaa97de74a4"
    }
  ]
}
201Successfully created group
400Bad request
401Authorization failure
403Permissions denied
500Internal server error

Retrieve a group

Fetch a single group by its SCIM id, including its current membership.

Get a group by Id

gethttps://scim.trint.com/v2/Groups/{id}

Path parameters

idstringrequired

Group Id

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

GET /Groups/{id}
curl --request GET \  --url 'https://scim.trint.com/v2/Groups/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "meta": {
    "resourceType": "Group",
    "created": "2022-09-06T08:07:48.313Z",
    "lastModified": "2023-01-13T10:22:47.834Z",
    "location": "https://scim.trint.com/v2/Groups/LH3Mr1nxKI-824c4MlfQi4"
  },
  "displayName": "Dev Team",
  "id": "LH3Mr1nxKI-824c4MlfQi4",
  "members": [
    {
      "value": "67a0d43daf33fdaa97de74a4"
    }
  ]
}
200Successful operation
401Authorization failure
403Permissions denied
404Not found
500Internal server error

Replace a group

Overwrite the group with the representation you supply. As with users, omitted optional attributes are cleared — including members, so send the full membership list or use Patch a group.

Fully update/replace a group

puthttps://scim.trint.com/v2/Groups/{id}

Path parameters

idstringrequired

Group Id

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

Body parameters

idstringoptional

Unique resource Id

displayNamestringrequired

Name of the group

membersarray of objectoptional
schemasarray of stringrequired

Allowed: urn:ietf:params:scim:schemas:core:2.0:Group

PUT /Groups/{id}
curl --request PUT \  --url 'https://scim.trint.com/v2/Groups/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/scim+json' \
  --data '{}'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "displayName": "Dev Team",
  "id": "LH3Mr1nxKI-824c4MlfQi4",
  "members": [
    {
      "value": "67a0d43daf33fdaa97de74a4"
    }
  ]
}
200Successfully fully updated a group
400Bad request
401Authorization failure
403Permissions denied
404Not found
500Internal server error

Patch a group

Add or remove individual members without resending the whole group. This is the efficient way to maintain membership on a large group.

Partially update/patch a group

patchhttps://scim.trint.com/v2/Groups/{id}

Path parameters

idstringrequired

Group Id

Query parameters

attributesarray of stringoptional

SCIM defined attributes parameter.

excludedAttributesarray of stringoptional

SCIM defined excludedAttribute parameter.

Body parameters

Operationsarray of objectrequired

Patch operations list

schemasarray of stringrequired

Allowed: urn:ietf:params:scim:api:messages:2.0:PatchOp

PATCH /Groups/{id}
curl --request PATCH \  --url 'https://scim.trint.com/v2/Groups/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/scim+json' \
  --data '{}'

Response 200

200 response
{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "displayName": "Dev Team",
  "id": "LH3Mr1nxKI-824c4MlfQi4",
  "members": [
    {
      "value": "67a0d43daf33fdaa97de74a4"
    }
  ]
}
200Successfully fully updated a group
400Bad request
401Authorization failure
403Permissions denied
404Not found
500Internal server error

Remove a group

Remove the group. The users who belonged to it are not deleted — only the grouping is.

Delete a group

deletehttps://scim.trint.com/v2/Groups/{id}

Path parameters

idstringrequired

Group Id

DELETE /Groups/{id}
curl --request DELETE \  --url 'https://scim.trint.com/v2/Groups/:id' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Response 401

401 response
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "detail": "Unauthorized",
  "status": "401"
}
204Successfully deleted
401Authorization failure
403Permissions denied
404Not found
500Internal server error