> For the complete documentation index, see [llms.txt](https://api.qvalia.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://api.qvalia.io/api-documentation/apis/scim/user.md). # User HTTP methods with User resource(s) ## Get Service Provider Configuration > This endpoint returns the Service Provider Configuration, which contains the service provider's supported features. ```json {"openapi":"3.0.2","info":{"title":"Qvalia SCIM API","version":"1.0.0"},"tags":[{"name":"User","description":"HTTP methods with User resource(s)"}],"servers":[{"url":"https://api-test.qvalia.com"},{"url":"https://api.qvalia.com"}],"security":[{"api_key":[]},{"jwt":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"},"jwt":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT-based authentication. The Authorization header must be set as:\nAuthorization: Bearer \n\nObtain a token via POST /token/{accountRegNo} (see Authentication API).\n"}},"responses":{"TooManyRequests":{"description":"Too Many Requests. The account has exceeded its request budget, which is counted\nper account across all Qvalia APIs.\n\nRead `Retry-After` and wait at least that many seconds before retrying — retrying\nimmediately is simply rejected again. `RateLimit-Remaining` on every response tells\nyou how much of the budget is left, so a well-behaved client need not hit this at\nall. Contact [Qvalia Helpdesk](https://qvalia.com/help/) if your integration needs\na higher limit.","headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer"}}},"content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","description":"SCIM error response, per [RFC 7644 §3.12](https://www.rfc-editor.org/rfc/rfc7644#section-3.12).\n\n**NB!** The SCIM endpoints do *not* use the `{status, type, data, metadata}`\nenvelope the other Qvalia APIs return — provisioning connectors expect this\nschema, and it is served as `application/scim+json`.","required":["schemas","status"],"properties":{"schemas":{"type":"array","description":"Always exactly the SCIM Error message URN.","items":{"type":"string"}},"status":{"type":"string","description":"The HTTP status code, as a **string**, as the RFC requires."},"detail":{"type":"string","description":"Human-readable description of what went wrong."},"scimType":{"type":"string","description":"A SCIM failure keyword. Only present on a `400`\n([RFC 7644 §3.12, Table 9](https://www.rfc-editor.org/rfc/rfc7644#section-3.12)).","enum":["invalidFilter","tooMany","uniqueness","mutability","invalidSyntax","invalidPath","noTarget","invalidValue","invalidVers","sensitive"]}}}}},"paths":{"/scim/v2/{accountRegNo}/ServiceProviderConfig":{"get":{"tags":["User"],"summary":"Get Service Provider Configuration","description":"This endpoint returns the Service Provider Configuration, which contains the service provider's supported features.","operationId":"getServiceProviderConfig","responses":{"200":{"description":"Success - Service Provider Configuration found","content":{"application/scim+json":{"schema":{"properties":{"authenticationSchemes":{"type":"array","description":"The ways this service provider accepts authentication, per\n[RFC 7643 §5](https://www.rfc-editor.org/rfc/rfc7643#section-5).\nA flat list of scheme objects; the Bearer token scheme is the `primary`\none and currently the only one advertised.\n\nAn account API key sent as the `Authorization` header (the `api_key`\nsecurity scheme below) is also accepted, but it is not listed here:\nRFC 7643 §5 restricts `type` to `oauth`, `oauth2`, `oauthbearertoken`,\n`httpbasic` and `httpdigest`, and none of those describes it. In\nparticular it is NOT HTTP Basic — do not base64-encode it.","items":{"type":"object","properties":{"type":{"type":"string"},"name":{"type":"string"},"description":{"type":"string"},"specUri":{"type":"string"},"documentationUri":{"type":"string"},"primary":{"type":"boolean"}}}},"filter":{"type":"object","properties":{"supported":{"type":"boolean","default":false}}},"patch":{"type":"object","properties":{"supported":{"type":"boolean","default":false}}},"sort":{"type":"object","properties":{"supported":{"type":"boolean","default":false}}},"bulk":{"type":"object","properties":{"supported":{"type":"boolean","default":false}}},"etag":{"type":"object","properties":{"supported":{"type":"boolean","default":false}}},"changePassword":{"type":"object","description":"Change password is supported through PUT operation on User resource","properties":{"supported":{"type":"boolean","default":true}}},"schemas":{"type":"array","items":{"type":"string","enum":["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"]}}}}}}},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"description":"Internal server error - Implementers provide a descriptive debugging advice","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}} ``` ## Get filtered or all Users > This endpoint returns all or filtered Users. Utilize the query parameters to configure filtering, sorting, pagination and in-/excluded attribues. ```json {"openapi":"3.0.2","info":{"title":"Qvalia SCIM API","version":"1.0.0"},"tags":[{"name":"User","description":"HTTP methods with User resource(s)"}],"servers":[{"url":"https://api-test.qvalia.com"},{"url":"https://api.qvalia.com"}],"security":[{"api_key":[]},{"jwt":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"},"jwt":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT-based authentication. The Authorization header must be set as:\nAuthorization: Bearer \n\nObtain a token via POST /token/{accountRegNo} (see Authentication API).\n"}},"schemas":{"UserListResponse":{"allOf":[{"$ref":"#/components/schemas/ListResponse"}],"properties":{"Resource":{"type":"array","items":{"$ref":"#/components/schemas/User"}}},"required":["Resource"]},"ListResponse":{"description":"The ListResponse specifies control attribute for big collections returned. The attributes thus cover information about the pagination. The assigned Resource object contains the queried resources.","type":"object","properties":{"totalResults":{"type":"integer","format":"int32","description":"Non-negative integer. Specifies the total number of results matching the client query, e.g., 1000."},"startIndex":{"type":"integer","format":"int32","description":"The 1-based index of the first result in the current set of query results, e.g., 1."},"itemsPerPage":{"type":"integer","format":"int32","description":"Non-negative integer. Specifies the number of query results returned in a query response page, e.g., 10."}},"required":["totalResults","startIndex","itemsPerPage"]},"User":{"allOf":[{"$ref":"#/components/schemas/Resource"}],"description":"SCIM provides a resource type for \\\"User\\\" resources. The core schema for \\\"User\\\" is identified using the following schema URI \\\"urn:ietf:params:scim:schemas:core:2.0:User\\\". The following attributes are defined in addition to the core schema attributes","properties":{"userName":{"description":"A service provider's unique identifier for the user, typically used by the user to directly authenticate to the service provider. Often displayed to the user as their unique identifier within the system (as opposed to \\\"id\\\" or \\\"externalId\\\", which are generally opaque and not user-friendly identifiers). Each User MUST include a non-empty userName value. This identifier MUST be unique across the service provider's entire set of Users. This attribute is REQUIRED and is case insensitive.","type":"string"},"name":{"description":"The components of the user's name. Qvalia only allows the full formatted name once!","type":"array","items":{"properties":{"formatted":{"description":"The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g., \\\"Jane Doe\\\").","type":"string"}}}},"title":{"description":"The user's title, such as \\\"IT Architect\\\".","type":"string"},"userType":{"description":"Used to identify the permission in Qvalia account.","type":"string","pattern":"^[viewer|user|admin]$","enum":["viewer","user","admin"]},"preferredLanguage":{"description":"Indicates the user's preferred written or spoken languages and is generally used for selecting a localized user interface. The value indicates the set of natural languages that are preferred. The format of the value is the same as the HTTP Accept-Language header field (not including \\\"Accept-Language:\\\") and is specified in Section 5.3.5 of [RFC7231]. The intent of this value is to enable cloud applications to perform matching of language tags [RFC4647] to the user's language preferences, regardless of what may be indicated by a user agent (which might be shared), or in an interaction that does not involve a user (such as in a delegated OAuth 2.0 [RFC6749] style interaction) where normal HTTP Accept-Language header negotiation cannot take place.","type":"string","enum":["en","sv","fi"]},"active":{"description":"A Boolean value indicating the user's administrative status. The definitive meaning of this attribute is determined by the service provider. As a typical example, a value of true implies that the user is able to log in, while a value of false implies that the user's account has been suspended.","type":"boolean"},"password":{"writeOnly":true,"description":"This attribute is intended to be used as a means to set, replace, or compare (i.e., filter for equality) a password. The cleartext value or the hashed value of a password SHALL NOT be returnable by a service provider. If a service provider holds the value locally, the value SHOULD be hashed. When a password is set or changed by the client, the cleartext password SHOULD be processed by the service provider as follows\n\nA service provider that immediately passes the cleartext value on to another system or programming interface MUST pass the value directly over a secured connection (e.g., Transport Layer Security (TLS)). If the value needs to be temporarily persisted for a period of time (e.g., because of a workflow) before provisioning, then the value MUST be protected by some method, such as encryption.\nTesting for an equality match MAY be supported if there is an existing stored hashed value. When testing for equality, the service provider\n\nThe mutability of the password attribute is \\\"writeOnly\\\", indicating that the value MUST NOT be returned by a service provider in any form (the attribute characteristic \\\"returned\\\" is \\\"never\\\").\n","type":"string","format":"password"},"emails":{"description":"Email addresses for the User. The value SHOULD be specified according to [RFC5321]. Service providers SHOULD canonicalize the value according to [RFC5321], e.g., \\\"user@company.com\\\" instead of \\\"user@COMPANY.COM\\\". Qvalia only allows one email!","type":"array","items":{"properties":{"value":{"description":"should return canonicalized representation of the email value","type":"string","format":"email"}},"required":["value"]}},"phoneNumbers":{"description":"Phone numbers for the user. The value SHOULD be specified according to the format defined in [RFC3966], e.g., 'tel:+1-201-555-0123'. Service providers SHOULD canonicalize the value according to [RFC3966] format, when appropriate. The \\\"display\\\" sub-attribute MAY be used to return the canonicalized representation of the phone number value. Qvalia only allows one phone number!","type":"array","items":{"properties":{"value":{"description":"should return canonicalized representation of the phone value","type":"string","format":"string"}}}}},"required":["userName"]},"Resource":{"type":"object","description":"The resource is the base class to represent the entities of this RBAC REST API. It holds the attributes necessary for all actual resources (User, Group, Role, etc.).","properties":{"schemas":{"description":"The schema(s) involved in the SCIM resource.","type":"array","items":{"type":"string"}},"id":{"type":"string","format":"email","description":"A unique identifier for a SCIM resource as defined by the service provider. Each representation of the resource MUST include a non-empty \\\"id\\\" value. This identifier MUST be unique across the SCIM service provider's entire set of resources. It MUST be a stable, non-reassignable identifier that does not change when the same resource is returned in subsequent requests. The value of the \\\"id\\\" attribute is always issued by the service provider and MUST NOT be specified by the client. The string \\\"bulkId\\\" is a reserved keyword and MUST NOT be used within any unique identifier value. The attribute characteristics are \\\"caseExact\\\" as \\\"true\\\", a mutability of \\\"readOnly\\\", and a \\\"returned\\\" characteristic of \\\"always\\\". See [Section 9 RFC7643](https://www.rfc-editor.org/rfc/rfc7643.html#section-9) for additional considerations regarding privacy."}},"required":["id","schemas"]},"Error":{"type":"object","description":"SCIM error response, per [RFC 7644 §3.12](https://www.rfc-editor.org/rfc/rfc7644#section-3.12).\n\n**NB!** The SCIM endpoints do *not* use the `{status, type, data, metadata}`\nenvelope the other Qvalia APIs return — provisioning connectors expect this\nschema, and it is served as `application/scim+json`.","required":["schemas","status"],"properties":{"schemas":{"type":"array","description":"Always exactly the SCIM Error message URN.","items":{"type":"string"}},"status":{"type":"string","description":"The HTTP status code, as a **string**, as the RFC requires."},"detail":{"type":"string","description":"Human-readable description of what went wrong."},"scimType":{"type":"string","description":"A SCIM failure keyword. Only present on a `400`\n([RFC 7644 §3.12, Table 9](https://www.rfc-editor.org/rfc/rfc7644#section-3.12)).","enum":["invalidFilter","tooMany","uniqueness","mutability","invalidSyntax","invalidPath","noTarget","invalidValue","invalidVers","sensitive"]}}}},"responses":{"TooManyRequests":{"description":"Too Many Requests. The account has exceeded its request budget, which is counted\nper account across all Qvalia APIs.\n\nRead `Retry-After` and wait at least that many seconds before retrying — retrying\nimmediately is simply rejected again. `RateLimit-Remaining` on every response tells\nyou how much of the budget is left, so a well-behaved client need not hit this at\nall. Contact [Qvalia Helpdesk](https://qvalia.com/help/) if your integration needs\na higher limit.","headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer"}}},"content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/scim/v2/{accountRegNo}/Users":{"get":{"tags":["User"],"summary":"Get filtered or all Users","description":"This endpoint returns all or filtered Users. Utilize the query parameters to configure filtering, sorting, pagination and in-/excluded attribues.","operationId":"getUsers","parameters":[{"in":"query","name":"sortOrder","schema":{"type":"string","default":"ascending","enum":["ascending","descending"]},"description":"The order in which the \\\"sortBy\\\" parameter is applied. Allowed values are \\\"ascending\\\" and \\\"descending\\\". If a value for \\\"sortBy\\\" is provided and no \\\"sortOrder\\\" is specified, \\\"sortOrder\\\" SHALL default to ascending. String type attributes are case insensitive by default, unless the attribute type is defined as a case-exact string. \\\"sortOrder\\\" MUST sort according to the attribute type; i.e., for case-insensitive attributes, sort the result using case-insensitive Unicode alphabetic sort order with no specific locale implied, and for case-exact attribute types, sort the result using case-sensitive Unicode alphabetic sort order."},{"in":"query","name":"cursor","schema":{"type":"integer","default":1},"description":"The 1-based index of the first query result. A value less than 1 SHALL be interpreted as 1."},{"in":"query","name":"count","schema":{"type":"integer","default":1000},"description":"Non-negative integer. Specifies the desired maximum number of query results per page, e.g., 10. A negative value SHALL be interpreted as \\\"0\\\". A value of \\\"0\\\" indicates that no resource results are to be returned except for \\\"totalResults\\\"."}],"responses":{"200":{"description":"Success - list of all Users","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/UserListResponse"}}}},"400":{"description":"Bad request - See scimType for further information","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized - Authentication failed try again with a valid authentication","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Forbidden - Authentication was successful but the user is not authorized","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Not found - No resource with provided Id","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"description":"Internal server error - Implementers provide a descriptive debugging advice","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}} ``` ## Create new user resource > Creates a new User. Some attributes might be immutable, thus make sure these are set correctly for creation. Unset required attributes might lead to assertions or insertion of default values. Readonly attributes are ignored. The query parameters attribues and excludedAttributes refer to the response upon success. The id attributes is set by the Service Provider to ensure uniqueness. ```json {"openapi":"3.0.2","info":{"title":"Qvalia SCIM API","version":"1.0.0"},"tags":[{"name":"User","description":"HTTP methods with User resource(s)"}],"servers":[{"url":"https://api-test.qvalia.com"},{"url":"https://api.qvalia.com"}],"security":[{"api_key":[]},{"jwt":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"},"jwt":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT-based authentication. The Authorization header must be set as:\nAuthorization: Bearer \n\nObtain a token via POST /token/{accountRegNo} (see Authentication API).\n"}},"schemas":{"User":{"allOf":[{"$ref":"#/components/schemas/Resource"}],"description":"SCIM provides a resource type for \\\"User\\\" resources. The core schema for \\\"User\\\" is identified using the following schema URI \\\"urn:ietf:params:scim:schemas:core:2.0:User\\\". The following attributes are defined in addition to the core schema attributes","properties":{"userName":{"description":"A service provider's unique identifier for the user, typically used by the user to directly authenticate to the service provider. Often displayed to the user as their unique identifier within the system (as opposed to \\\"id\\\" or \\\"externalId\\\", which are generally opaque and not user-friendly identifiers). Each User MUST include a non-empty userName value. This identifier MUST be unique across the service provider's entire set of Users. This attribute is REQUIRED and is case insensitive.","type":"string"},"name":{"description":"The components of the user's name. Qvalia only allows the full formatted name once!","type":"array","items":{"properties":{"formatted":{"description":"The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g., \\\"Jane Doe\\\").","type":"string"}}}},"title":{"description":"The user's title, such as \\\"IT Architect\\\".","type":"string"},"userType":{"description":"Used to identify the permission in Qvalia account.","type":"string","pattern":"^[viewer|user|admin]$","enum":["viewer","user","admin"]},"preferredLanguage":{"description":"Indicates the user's preferred written or spoken languages and is generally used for selecting a localized user interface. The value indicates the set of natural languages that are preferred. The format of the value is the same as the HTTP Accept-Language header field (not including \\\"Accept-Language:\\\") and is specified in Section 5.3.5 of [RFC7231]. The intent of this value is to enable cloud applications to perform matching of language tags [RFC4647] to the user's language preferences, regardless of what may be indicated by a user agent (which might be shared), or in an interaction that does not involve a user (such as in a delegated OAuth 2.0 [RFC6749] style interaction) where normal HTTP Accept-Language header negotiation cannot take place.","type":"string","enum":["en","sv","fi"]},"active":{"description":"A Boolean value indicating the user's administrative status. The definitive meaning of this attribute is determined by the service provider. As a typical example, a value of true implies that the user is able to log in, while a value of false implies that the user's account has been suspended.","type":"boolean"},"password":{"writeOnly":true,"description":"This attribute is intended to be used as a means to set, replace, or compare (i.e., filter for equality) a password. The cleartext value or the hashed value of a password SHALL NOT be returnable by a service provider. If a service provider holds the value locally, the value SHOULD be hashed. When a password is set or changed by the client, the cleartext password SHOULD be processed by the service provider as follows\n
    \n
  • Prepare the cleartext value for international language comparison. See Section 7.8 of [RFC7644].
    • \n
  • Validate the value against server password policy. Note, The definition and enforcement of password policy are beyond the scope of this document.
    • \n
  • Ensure that the value is encrypted (e.g., hashed). See Section 9.2 of [RFC7643] for acceptable hashing and encryption handling when storing or persisting for provisioning workflow reasons.
    • \n
\nA service provider that immediately passes the cleartext value on to another system or programming interface MUST pass the value directly over a secured connection (e.g., Transport Layer Security (TLS)). If the value needs to be temporarily persisted for a period of time (e.g., because of a workflow) before provisioning, then the value MUST be protected by some method, such as encryption.\nTesting for an equality match MAY be supported if there is an existing stored hashed value. When testing for equality, the service provider\n
    \n
  • Prepares the filter value for international language comparison. See Section 7.8 of [RFC7644].
    • \n
  • Generates the salted hash of the filter value and tests for a match with the locally held value.
    • \n
\nThe mutability of the password attribute is \\\"writeOnly\\\", indicating that the value MUST NOT be returned by a service provider in any form (the attribute characteristic \\\"returned\\\" is \\\"never\\\").\n","type":"string","format":"password"},"emails":{"description":"Email addresses for the User. The value SHOULD be specified according to [RFC5321]. Service providers SHOULD canonicalize the value according to [RFC5321], e.g., \\\"user@company.com\\\" instead of \\\"user@COMPANY.COM\\\". Qvalia only allows one email!","type":"array","items":{"properties":{"value":{"description":"should return canonicalized representation of the email value","type":"string","format":"email"}},"required":["value"]}},"phoneNumbers":{"description":"Phone numbers for the user. The value SHOULD be specified according to the format defined in [RFC3966], e.g., 'tel:+1-201-555-0123'. Service providers SHOULD canonicalize the value according to [RFC3966] format, when appropriate. The \\\"display\\\" sub-attribute MAY be used to return the canonicalized representation of the phone number value. Qvalia only allows one phone number!","type":"array","items":{"properties":{"value":{"description":"should return canonicalized representation of the phone value","type":"string","format":"string"}}}}},"required":["userName"]},"Resource":{"type":"object","description":"The resource is the base class to represent the entities of this RBAC REST API. It holds the attributes necessary for all actual resources (User, Group, Role, etc.).","properties":{"schemas":{"description":"The schema(s) involved in the SCIM resource.","type":"array","items":{"type":"string"}},"id":{"type":"string","format":"email","description":"A unique identifier for a SCIM resource as defined by the service provider. Each representation of the resource MUST include a non-empty \\\"id\\\" value. This identifier MUST be unique across the SCIM service provider's entire set of resources. It MUST be a stable, non-reassignable identifier that does not change when the same resource is returned in subsequent requests. The value of the \\\"id\\\" attribute is always issued by the service provider and MUST NOT be specified by the client. The string \\\"bulkId\\\" is a reserved keyword and MUST NOT be used within any unique identifier value. The attribute characteristics are \\\"caseExact\\\" as \\\"true\\\", a mutability of \\\"readOnly\\\", and a \\\"returned\\\" characteristic of \\\"always\\\". See [Section 9 RFC7643](https://www.rfc-editor.org/rfc/rfc7643.html#section-9) for additional considerations regarding privacy."}},"required":["id","schemas"]},"Error":{"type":"object","description":"SCIM error response, per [RFC 7644 §3.12](https://www.rfc-editor.org/rfc/rfc7644#section-3.12).\n\n**NB!** The SCIM endpoints do *not* use the `{status, type, data, metadata}`\nenvelope the other Qvalia APIs return — provisioning connectors expect this\nschema, and it is served as `application/scim+json`.","required":["schemas","status"],"properties":{"schemas":{"type":"array","description":"Always exactly the SCIM Error message URN.","items":{"type":"string"}},"status":{"type":"string","description":"The HTTP status code, as a **string**, as the RFC requires."},"detail":{"type":"string","description":"Human-readable description of what went wrong."},"scimType":{"type":"string","description":"A SCIM failure keyword. Only present on a `400`\n([RFC 7644 §3.12, Table 9](https://www.rfc-editor.org/rfc/rfc7644#section-3.12)).","enum":["invalidFilter","tooMany","uniqueness","mutability","invalidSyntax","invalidPath","noTarget","invalidValue","invalidVers","sensitive"]}}}},"responses":{"TooManyRequests":{"description":"Too Many Requests. The account has exceeded its request budget, which is counted\nper account across all Qvalia APIs.\n\nRead `Retry-After` and wait at least that many seconds before retrying — retrying\nimmediately is simply rejected again. `RateLimit-Remaining` on every response tells\nyou how much of the budget is left, so a well-behaved client need not hit this at\nall. Contact [Qvalia Helpdesk](https://qvalia.com/help/) if your integration needs\na higher limit.","headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer"}}},"content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/scim/v2/{accountRegNo}/Users":{"post":{"tags":["User"],"summary":"Create new user resource","description":"Creates a new User. Some attributes might be immutable, thus make sure these are set correctly for creation. Unset required attributes might lead to assertions or insertion of default values. Readonly attributes are ignored. The query parameters attribues and excludedAttributes refer to the response upon success. The id attributes is set by the Service Provider to ensure uniqueness.","operationId":"createUser","requestBody":{"description":"Content to create new user resource","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/User"}}}},"responses":{"201":{"description":"Success - User created","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/User"}}}},"400":{"description":"Bad request - See scimType for further information","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized - Authentication failed try again with a valid authentication","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Forbidden - Authentication was successful but the user is not authorized","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Not found - No resource with provided Id","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict - Outdated version number or refusal of Service Provider to create a duplicate","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"description":"Internal server error - Implementers provide a descriptive debugging advice","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}} ``` ## Get user by Id > Finds a single User by its id attribute. Returned attributes might be specified or restricted with the query parameter attributes or excludedAttributes. Some attributes might not be readable according their schema definition. ```json {"openapi":"3.0.2","info":{"title":"Qvalia SCIM API","version":"1.0.0"},"tags":[{"name":"User","description":"HTTP methods with User resource(s)"}],"servers":[{"url":"https://api-test.qvalia.com"},{"url":"https://api.qvalia.com"}],"security":[{"api_key":[]},{"jwt":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"},"jwt":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT-based authentication. The Authorization header must be set as:\nAuthorization: Bearer \n\nObtain a token via POST /token/{accountRegNo} (see Authentication API).\n"}},"schemas":{"User":{"allOf":[{"$ref":"#/components/schemas/Resource"}],"description":"SCIM provides a resource type for \\\"User\\\" resources. The core schema for \\\"User\\\" is identified using the following schema URI \\\"urn:ietf:params:scim:schemas:core:2.0:User\\\". The following attributes are defined in addition to the core schema attributes","properties":{"userName":{"description":"A service provider's unique identifier for the user, typically used by the user to directly authenticate to the service provider. Often displayed to the user as their unique identifier within the system (as opposed to \\\"id\\\" or \\\"externalId\\\", which are generally opaque and not user-friendly identifiers). Each User MUST include a non-empty userName value. This identifier MUST be unique across the service provider's entire set of Users. This attribute is REQUIRED and is case insensitive.","type":"string"},"name":{"description":"The components of the user's name. Qvalia only allows the full formatted name once!","type":"array","items":{"properties":{"formatted":{"description":"The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g., \\\"Jane Doe\\\").","type":"string"}}}},"title":{"description":"The user's title, such as \\\"IT Architect\\\".","type":"string"},"userType":{"description":"Used to identify the permission in Qvalia account.","type":"string","pattern":"^[viewer|user|admin]$","enum":["viewer","user","admin"]},"preferredLanguage":{"description":"Indicates the user's preferred written or spoken languages and is generally used for selecting a localized user interface. The value indicates the set of natural languages that are preferred. The format of the value is the same as the HTTP Accept-Language header field (not including \\\"Accept-Language:\\\") and is specified in Section 5.3.5 of [RFC7231]. The intent of this value is to enable cloud applications to perform matching of language tags [RFC4647] to the user's language preferences, regardless of what may be indicated by a user agent (which might be shared), or in an interaction that does not involve a user (such as in a delegated OAuth 2.0 [RFC6749] style interaction) where normal HTTP Accept-Language header negotiation cannot take place.","type":"string","enum":["en","sv","fi"]},"active":{"description":"A Boolean value indicating the user's administrative status. The definitive meaning of this attribute is determined by the service provider. As a typical example, a value of true implies that the user is able to log in, while a value of false implies that the user's account has been suspended.","type":"boolean"},"password":{"writeOnly":true,"description":"This attribute is intended to be used as a means to set, replace, or compare (i.e., filter for equality) a password. The cleartext value or the hashed value of a password SHALL NOT be returnable by a service provider. If a service provider holds the value locally, the value SHOULD be hashed. When a password is set or changed by the client, the cleartext password SHOULD be processed by the service provider as follows\n
    \n
  • Prepare the cleartext value for international language comparison. See Section 7.8 of [RFC7644].
    • \n
  • Validate the value against server password policy. Note, The definition and enforcement of password policy are beyond the scope of this document.
    • \n
  • Ensure that the value is encrypted (e.g., hashed). See Section 9.2 of [RFC7643] for acceptable hashing and encryption handling when storing or persisting for provisioning workflow reasons.
    • \n
\nA service provider that immediately passes the cleartext value on to another system or programming interface MUST pass the value directly over a secured connection (e.g., Transport Layer Security (TLS)). If the value needs to be temporarily persisted for a period of time (e.g., because of a workflow) before provisioning, then the value MUST be protected by some method, such as encryption.\nTesting for an equality match MAY be supported if there is an existing stored hashed value. When testing for equality, the service provider\n
    \n
  • Prepares the filter value for international language comparison. See Section 7.8 of [RFC7644].
    • \n
  • Generates the salted hash of the filter value and tests for a match with the locally held value.
    • \n
\nThe mutability of the password attribute is \\\"writeOnly\\\", indicating that the value MUST NOT be returned by a service provider in any form (the attribute characteristic \\\"returned\\\" is \\\"never\\\").\n","type":"string","format":"password"},"emails":{"description":"Email addresses for the User. The value SHOULD be specified according to [RFC5321]. Service providers SHOULD canonicalize the value according to [RFC5321], e.g., \\\"user@company.com\\\" instead of \\\"user@COMPANY.COM\\\". Qvalia only allows one email!","type":"array","items":{"properties":{"value":{"description":"should return canonicalized representation of the email value","type":"string","format":"email"}},"required":["value"]}},"phoneNumbers":{"description":"Phone numbers for the user. The value SHOULD be specified according to the format defined in [RFC3966], e.g., 'tel:+1-201-555-0123'. Service providers SHOULD canonicalize the value according to [RFC3966] format, when appropriate. The \\\"display\\\" sub-attribute MAY be used to return the canonicalized representation of the phone number value. Qvalia only allows one phone number!","type":"array","items":{"properties":{"value":{"description":"should return canonicalized representation of the phone value","type":"string","format":"string"}}}}},"required":["userName"]},"Resource":{"type":"object","description":"The resource is the base class to represent the entities of this RBAC REST API. It holds the attributes necessary for all actual resources (User, Group, Role, etc.).","properties":{"schemas":{"description":"The schema(s) involved in the SCIM resource.","type":"array","items":{"type":"string"}},"id":{"type":"string","format":"email","description":"A unique identifier for a SCIM resource as defined by the service provider. Each representation of the resource MUST include a non-empty \\\"id\\\" value. This identifier MUST be unique across the SCIM service provider's entire set of resources. It MUST be a stable, non-reassignable identifier that does not change when the same resource is returned in subsequent requests. The value of the \\\"id\\\" attribute is always issued by the service provider and MUST NOT be specified by the client. The string \\\"bulkId\\\" is a reserved keyword and MUST NOT be used within any unique identifier value. The attribute characteristics are \\\"caseExact\\\" as \\\"true\\\", a mutability of \\\"readOnly\\\", and a \\\"returned\\\" characteristic of \\\"always\\\". See [Section 9 RFC7643](https://www.rfc-editor.org/rfc/rfc7643.html#section-9) for additional considerations regarding privacy."}},"required":["id","schemas"]},"Error":{"type":"object","description":"SCIM error response, per [RFC 7644 §3.12](https://www.rfc-editor.org/rfc/rfc7644#section-3.12).\n\n**NB!** The SCIM endpoints do *not* use the `{status, type, data, metadata}`\nenvelope the other Qvalia APIs return — provisioning connectors expect this\nschema, and it is served as `application/scim+json`.","required":["schemas","status"],"properties":{"schemas":{"type":"array","description":"Always exactly the SCIM Error message URN.","items":{"type":"string"}},"status":{"type":"string","description":"The HTTP status code, as a **string**, as the RFC requires."},"detail":{"type":"string","description":"Human-readable description of what went wrong."},"scimType":{"type":"string","description":"A SCIM failure keyword. Only present on a `400`\n([RFC 7644 §3.12, Table 9](https://www.rfc-editor.org/rfc/rfc7644#section-3.12)).","enum":["invalidFilter","tooMany","uniqueness","mutability","invalidSyntax","invalidPath","noTarget","invalidValue","invalidVers","sensitive"]}}}},"responses":{"TooManyRequests":{"description":"Too Many Requests. The account has exceeded its request budget, which is counted\nper account across all Qvalia APIs.\n\nRead `Retry-After` and wait at least that many seconds before retrying — retrying\nimmediately is simply rejected again. `RateLimit-Remaining` on every response tells\nyou how much of the budget is left, so a well-behaved client need not hit this at\nall. Contact [Qvalia Helpdesk](https://qvalia.com/help/) if your integration needs\na higher limit.","headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer"}}},"content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/scim/v2/{accountRegNo}/Users/{id}":{"get":{"tags":["User"],"summary":"Get user by Id","description":"Finds a single User by its id attribute. Returned attributes might be specified or restricted with the query parameter attributes or excludedAttributes. Some attributes might not be readable according their schema definition.","operationId":"getUserById","parameters":[{"name":"id","in":"path","description":"The SCIM resource id of the user. Qvalia uses the user's **email address**\nas the SCIM `id`, so this is an email, not a UUID — e.g. `user@example.com`.\nRemember to URL-encode it.","required":true,"schema":{"type":"string","format":"email"}},{"in":"query","name":"attributes","schema":{"type":"string"},"description":"A multi-valued list of strings indicating the names of resource attributes to return in the response, overriding the set of attributes that would be returned by default. Attribute names MUST be in standard attribute notation (see [Section 3.10 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.10)) form. See [Section 3.9 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.9) for additional retrieval query parameters."},{"in":"query","name":"excludedAttributes","schema":{"type":"string"},"description":"A multi-valued list of strings indicating the names of resource attributes to be removed from the default set of attributes to return. This parameter SHALL have no effect on attributes whose schema \\\"returned\\\" setting is \\\"always\\\" (see Sections [2.2](https://www.rfc-editor.org/rfc/rfc7644#section-2.2) and [7](https://www.rfc-editor.org/rfc/rfc7644#section-7) of RFC7644). Attribute names MUST be in standard attribute notation ([Section 3.10 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.10)) form. See [Section 3.9 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.9) for additional retrieval query parameters."}],"responses":{"200":{"description":"Success - User found","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/User"}}}},"400":{"description":"Bad request - See scimType for further information","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized - Authentication failed try again with a valid authentication","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Forbidden - Authentication was successful but the user is not authorized","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Not found - No resource with provided Id","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"description":"Internal server error - Implementers provide a descriptive debugging advice","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}} ``` ## Update user by Id > Updates a present User. Unset required attributes might lead to assertions or insertion of default values. Readonly attributes are ignored. The query parameters attribues and excludedAttributes refer to the response upon success. ```json {"openapi":"3.0.2","info":{"title":"Qvalia SCIM API","version":"1.0.0"},"tags":[{"name":"User","description":"HTTP methods with User resource(s)"}],"servers":[{"url":"https://api-test.qvalia.com"},{"url":"https://api.qvalia.com"}],"security":[{"api_key":[]},{"jwt":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"},"jwt":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT-based authentication. The Authorization header must be set as:\nAuthorization: Bearer \n\nObtain a token via POST /token/{accountRegNo} (see Authentication API).\n"}},"schemas":{"User":{"allOf":[{"$ref":"#/components/schemas/Resource"}],"description":"SCIM provides a resource type for \\\"User\\\" resources. The core schema for \\\"User\\\" is identified using the following schema URI \\\"urn:ietf:params:scim:schemas:core:2.0:User\\\". The following attributes are defined in addition to the core schema attributes","properties":{"userName":{"description":"A service provider's unique identifier for the user, typically used by the user to directly authenticate to the service provider. Often displayed to the user as their unique identifier within the system (as opposed to \\\"id\\\" or \\\"externalId\\\", which are generally opaque and not user-friendly identifiers). Each User MUST include a non-empty userName value. This identifier MUST be unique across the service provider's entire set of Users. This attribute is REQUIRED and is case insensitive.","type":"string"},"name":{"description":"The components of the user's name. Qvalia only allows the full formatted name once!","type":"array","items":{"properties":{"formatted":{"description":"The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g., \\\"Jane Doe\\\").","type":"string"}}}},"title":{"description":"The user's title, such as \\\"IT Architect\\\".","type":"string"},"userType":{"description":"Used to identify the permission in Qvalia account.","type":"string","pattern":"^[viewer|user|admin]$","enum":["viewer","user","admin"]},"preferredLanguage":{"description":"Indicates the user's preferred written or spoken languages and is generally used for selecting a localized user interface. The value indicates the set of natural languages that are preferred. The format of the value is the same as the HTTP Accept-Language header field (not including \\\"Accept-Language:\\\") and is specified in Section 5.3.5 of [RFC7231]. The intent of this value is to enable cloud applications to perform matching of language tags [RFC4647] to the user's language preferences, regardless of what may be indicated by a user agent (which might be shared), or in an interaction that does not involve a user (such as in a delegated OAuth 2.0 [RFC6749] style interaction) where normal HTTP Accept-Language header negotiation cannot take place.","type":"string","enum":["en","sv","fi"]},"active":{"description":"A Boolean value indicating the user's administrative status. The definitive meaning of this attribute is determined by the service provider. As a typical example, a value of true implies that the user is able to log in, while a value of false implies that the user's account has been suspended.","type":"boolean"},"password":{"writeOnly":true,"description":"This attribute is intended to be used as a means to set, replace, or compare (i.e., filter for equality) a password. The cleartext value or the hashed value of a password SHALL NOT be returnable by a service provider. If a service provider holds the value locally, the value SHOULD be hashed. When a password is set or changed by the client, the cleartext password SHOULD be processed by the service provider as follows\n
    \n
  • Prepare the cleartext value for international language comparison. See Section 7.8 of [RFC7644].
    • \n
  • Validate the value against server password policy. Note, The definition and enforcement of password policy are beyond the scope of this document.
    • \n
  • Ensure that the value is encrypted (e.g., hashed). See Section 9.2 of [RFC7643] for acceptable hashing and encryption handling when storing or persisting for provisioning workflow reasons.
    • \n
\nA service provider that immediately passes the cleartext value on to another system or programming interface MUST pass the value directly over a secured connection (e.g., Transport Layer Security (TLS)). If the value needs to be temporarily persisted for a period of time (e.g., because of a workflow) before provisioning, then the value MUST be protected by some method, such as encryption.\nTesting for an equality match MAY be supported if there is an existing stored hashed value. When testing for equality, the service provider\n
    \n
  • Prepares the filter value for international language comparison. See Section 7.8 of [RFC7644].
    • \n
  • Generates the salted hash of the filter value and tests for a match with the locally held value.
    • \n
\nThe mutability of the password attribute is \\\"writeOnly\\\", indicating that the value MUST NOT be returned by a service provider in any form (the attribute characteristic \\\"returned\\\" is \\\"never\\\").\n","type":"string","format":"password"},"emails":{"description":"Email addresses for the User. The value SHOULD be specified according to [RFC5321]. Service providers SHOULD canonicalize the value according to [RFC5321], e.g., \\\"user@company.com\\\" instead of \\\"user@COMPANY.COM\\\". Qvalia only allows one email!","type":"array","items":{"properties":{"value":{"description":"should return canonicalized representation of the email value","type":"string","format":"email"}},"required":["value"]}},"phoneNumbers":{"description":"Phone numbers for the user. The value SHOULD be specified according to the format defined in [RFC3966], e.g., 'tel:+1-201-555-0123'. Service providers SHOULD canonicalize the value according to [RFC3966] format, when appropriate. The \\\"display\\\" sub-attribute MAY be used to return the canonicalized representation of the phone number value. Qvalia only allows one phone number!","type":"array","items":{"properties":{"value":{"description":"should return canonicalized representation of the phone value","type":"string","format":"string"}}}}},"required":["userName"]},"Resource":{"type":"object","description":"The resource is the base class to represent the entities of this RBAC REST API. It holds the attributes necessary for all actual resources (User, Group, Role, etc.).","properties":{"schemas":{"description":"The schema(s) involved in the SCIM resource.","type":"array","items":{"type":"string"}},"id":{"type":"string","format":"email","description":"A unique identifier for a SCIM resource as defined by the service provider. Each representation of the resource MUST include a non-empty \\\"id\\\" value. This identifier MUST be unique across the SCIM service provider's entire set of resources. It MUST be a stable, non-reassignable identifier that does not change when the same resource is returned in subsequent requests. The value of the \\\"id\\\" attribute is always issued by the service provider and MUST NOT be specified by the client. The string \\\"bulkId\\\" is a reserved keyword and MUST NOT be used within any unique identifier value. The attribute characteristics are \\\"caseExact\\\" as \\\"true\\\", a mutability of \\\"readOnly\\\", and a \\\"returned\\\" characteristic of \\\"always\\\". See [Section 9 RFC7643](https://www.rfc-editor.org/rfc/rfc7643.html#section-9) for additional considerations regarding privacy."}},"required":["id","schemas"]},"Error":{"type":"object","description":"SCIM error response, per [RFC 7644 §3.12](https://www.rfc-editor.org/rfc/rfc7644#section-3.12).\n\n**NB!** The SCIM endpoints do *not* use the `{status, type, data, metadata}`\nenvelope the other Qvalia APIs return — provisioning connectors expect this\nschema, and it is served as `application/scim+json`.","required":["schemas","status"],"properties":{"schemas":{"type":"array","description":"Always exactly the SCIM Error message URN.","items":{"type":"string"}},"status":{"type":"string","description":"The HTTP status code, as a **string**, as the RFC requires."},"detail":{"type":"string","description":"Human-readable description of what went wrong."},"scimType":{"type":"string","description":"A SCIM failure keyword. Only present on a `400`\n([RFC 7644 §3.12, Table 9](https://www.rfc-editor.org/rfc/rfc7644#section-3.12)).","enum":["invalidFilter","tooMany","uniqueness","mutability","invalidSyntax","invalidPath","noTarget","invalidValue","invalidVers","sensitive"]}}}},"responses":{"TooManyRequests":{"description":"Too Many Requests. The account has exceeded its request budget, which is counted\nper account across all Qvalia APIs.\n\nRead `Retry-After` and wait at least that many seconds before retrying — retrying\nimmediately is simply rejected again. `RateLimit-Remaining` on every response tells\nyou how much of the budget is left, so a well-behaved client need not hit this at\nall. Contact [Qvalia Helpdesk](https://qvalia.com/help/) if your integration needs\na higher limit.","headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer"}}},"content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/scim/v2/{accountRegNo}/Users/{id}":{"put":{"tags":["User"],"summary":"Update user by Id","description":"Updates a present User. Unset required attributes might lead to assertions or insertion of default values. Readonly attributes are ignored. The query parameters attribues and excludedAttributes refer to the response upon success.","operationId":"updateUserById","parameters":[{"name":"id","in":"path","description":"The SCIM resource id of the user. Qvalia uses the user's **email address**\nas the SCIM `id`, so this is an email, not a UUID — e.g. `user@example.com`.\nRemember to URL-encode it.","required":true,"schema":{"type":"string","format":"email"}},{"in":"query","name":"attributes","schema":{"type":"string"},"description":"A multi-valued list of strings indicating the names of resource attributes to return in the response, overriding the set of attributes that would be returned by default. Attribute names MUST be in standard attribute notation (see [Section 3.10 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.10)) form. See [Section 3.9 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.9) for additional retrieval query parameters."},{"in":"query","name":"excludedAttributes","schema":{"type":"string"},"description":"A multi-valued list of strings indicating the names of resource attributes to be removed from the default set of attributes to return. This parameter SHALL have no effect on attributes whose schema \\\"returned\\\" setting is \\\"always\\\" (see Sections [2.2](https://www.rfc-editor.org/rfc/rfc7644#section-2.2) and [7](https://www.rfc-editor.org/rfc/rfc7644#section-7) of RFC7644). Attribute names MUST be in standard attribute notation ([Section 3.10 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.10)) form. See [Section 3.9 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.9) for additional retrieval query parameters."}],"requestBody":{"description":"Content for updating an existent user by Id","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/User"}}}},"responses":{"200":{"description":"Success - User updated","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/User"}}}},"400":{"description":"Bad request - See scimType for further information","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized - Authentication failed try again with a valid authentication","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Forbidden - Authentication was successful but the user is not authorized","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Not found - No resource with provided Id","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict - Outdated version number or refusal of Service Provider to create a duplicate","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"description":"Internal server error - Implementers provide a descriptive debugging advice","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}} ``` ## Delete user by Id > Deletes a present User. For subsequent requests on that resource and after successful deletion, a HTTP status code 404 is returned. ```json {"openapi":"3.0.2","info":{"title":"Qvalia SCIM API","version":"1.0.0"},"tags":[{"name":"User","description":"HTTP methods with User resource(s)"}],"servers":[{"url":"https://api-test.qvalia.com"},{"url":"https://api.qvalia.com"}],"security":[{"api_key":[]},{"jwt":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"},"jwt":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"JWT-based authentication. The Authorization header must be set as:\nAuthorization: Bearer \n\nObtain a token via POST /token/{accountRegNo} (see Authentication API).\n"}},"schemas":{"Error":{"type":"object","description":"SCIM error response, per [RFC 7644 §3.12](https://www.rfc-editor.org/rfc/rfc7644#section-3.12).\n\n**NB!** The SCIM endpoints do *not* use the `{status, type, data, metadata}`\nenvelope the other Qvalia APIs return — provisioning connectors expect this\nschema, and it is served as `application/scim+json`.","required":["schemas","status"],"properties":{"schemas":{"type":"array","description":"Always exactly the SCIM Error message URN.","items":{"type":"string"}},"status":{"type":"string","description":"The HTTP status code, as a **string**, as the RFC requires."},"detail":{"type":"string","description":"Human-readable description of what went wrong."},"scimType":{"type":"string","description":"A SCIM failure keyword. Only present on a `400`\n([RFC 7644 §3.12, Table 9](https://www.rfc-editor.org/rfc/rfc7644#section-3.12)).","enum":["invalidFilter","tooMany","uniqueness","mutability","invalidSyntax","invalidPath","noTarget","invalidValue","invalidVers","sensitive"]}}}},"responses":{"TooManyRequests":{"description":"Too Many Requests. The account has exceeded its request budget, which is counted\nper account across all Qvalia APIs.\n\nRead `Retry-After` and wait at least that many seconds before retrying — retrying\nimmediately is simply rejected again. `RateLimit-Remaining` on every response tells\nyou how much of the budget is left, so a well-behaved client need not hit this at\nall. Contact [Qvalia Helpdesk](https://qvalia.com/help/) if your integration needs\na higher limit.","headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer"}}},"content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/scim/v2/{accountRegNo}/Users/{id}":{"delete":{"tags":["User"],"summary":"Delete user by Id","description":"Deletes a present User. For subsequent requests on that resource and after successful deletion, a HTTP status code 404 is returned.","operationId":"deleteUserByID","parameters":[{"name":"id","in":"path","description":"The SCIM resource id of the user. Qvalia uses the user's **email address**\nas the SCIM `id`, so this is an email, not a UUID — e.g. `user@example.com`.\nRemember to URL-encode it.","required":true,"schema":{"type":"string","format":"email"}}],"responses":{"204":{"description":"Success - User deleted"},"400":{"description":"Bad request - See scimType for further information","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized - Authentication failed try again with a valid authentication","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Forbidden - Authentication was successful but the user is not authorized","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Not found - No resource with provided Id","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Conflict - Outdated version number or refusal of Service Provider to create a duplicate","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"412":{"description":"Precondition failed - Failed to update. Resource has changed on the server.","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"description":"Internal server error - Implementers provide a descriptive debugging advice","content":{"application/scim+json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://api.qvalia.io/api-documentation/apis/scim/user.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.