Tessera SCIM API reference
Generated from api/scim-openapi.yaml (version 0.1.0) by tessera-codegen — do not edit.
WP-A5 interface-first SCIM 2.0 contract (RFC 7643/7644). This separate protocol uses application/scim+json, SCIM camelCase fields, one-based pagination and SCIM Error objects, exempt from the /v1 JSON field, pagination and ErrorEnvelope rules (003 section 1).
An organization administrator mints a bearer token through POST /v1/orgs/{org_id}/scim-token. It resolves to exactly one organization; every resource lookup and mutation is scoped to that organization before access. Normal session JWTs and project API keys are not SCIM credentials. A resource from another organization is indistinguishable from a missing resource (404). Wrong and revoked tokens return SCIM 401; revocation is effective within 5 seconds. SCIM works without SSO configured.
Deactivation changes the membership, never deletes the user or audit trail. Sessions for a deactivated member are denied within 60 seconds. Reactivation restores the membership. Owner assignment and last-owner deactivation are forbidden. Mutations emit A3 audit events with actor.kind=api_key and the token id as actor.id. Tokens and raw bearer values are never audit metadata. Token buckets are keyed by token id; throttling returns SCIM 429 and Retry-After.
The schema-aware-v1 generator prerequisite normalizes known attribute names case-insensitively before request validation, including named nested objects. Colliding case variants are rejected, even for readOnly attributes. Declared readOnly attributes are ignored before value validation and excluded from request serialization. Unknown attributes remain errors; org_id, role and permissions never become accepted grants. Writable null values are preserved to clear optional attributes; null and [] both clear multi-valued attributes. Schemas below describe canonical attribute spelling. The /v1 contract is unaffected. PATCH envelope keys normalize, but op/path strings and the untyped value tree are preserved for the later schema-aware PATCH interpreter.
gateway-api serves this document at /scim/v2 on the public API origin, outside the /v1 tenancy middleware.
Servers
| URL | Description |
|---|---|
https://api.staging.tessera.zone/scim/v2 |
Authentication
| Scheme | Type | Description |
|---|---|---|
scimBearer | http (bearer) | An org-bound SCIM token; session JWTs and project API keys are rejected. |
Resources
- scim_config — 1 operation
- scim_groups — 5 operations
- scim_users — 6 operations
- Schemas