Integrate an app through SCIM 2.0

SlashID can read users, groups, roles and entitlements from any application that exposes a SCIM 2.0 API. The connection is a custom app that pulls from the app's SCIM endpoint on a schedule, so the app's roles, entitlements and custom resource types land in the identity graph next to its users and groups.

Before starting

Before starting, ensure you have:

• The base URL of the SCIM 2.0 endpoint (for example https://api.example.com/scim/v2). It must use https, with no username or password, query string or fragment
• Credentials for the endpoint: a bearer token, OAuth 2.0 client credentials, or a username and password
• Network access from SlashID to the endpoint, whose host must resolve to a public IP address (SlashID refuses private, loopback and link-local addresses)

IP allowlisting

If your endpoint or tenant restricts traffic by source IP, allow connections from SlashID's egress IPs published at https://cdn.slashid.com/egress.json. The list is global and stable; the syncToken field changes whenever the IPs change, so you can use it to detect drift.

The file follows the JAFAR draft format (A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients), the same convention major cloud providers use to publish their IP ranges.

Step 1: Obtain your SCIM credentials

SlashID supports three authentication methods. Choose the one your app requires:

Bearer token

Obtain a long-lived API token or personal access token from the app. This token is sent as an Authorization: Bearer <token> header on every request.

OAuth 2.0 client credentials

Obtain an OAuth 2.0 client ID and client secret, along with the app's token URL (the endpoint SlashID uses to request access tokens). SlashID refreshes the access token before it expires.

Basic auth

Obtain a username and password for HTTP Basic authentication. These are sent as an Authorization: Basic <base64> header on every request.

Step 2: Connect the app

1. Go to the SlashID Console > Identity Protection > Configuration > Data sources. Click Add data source, then pick SCIM. The Connect any app wizard opens with the SCIM option already chosen.
2. Name your app, then keep SCIM — your app has a SCIM endpoint selected and continue. SlashID creates the connection as a draft.
3. Point us at the app's SCIM endpoint:

Field	Description	Example
SCIM base URL	The root URL of the SCIM 2.0 API	https://api.example.com/scim/v2
Authentication	How SlashID authenticates to the endpoint	Bearer token
Authoritative status	Whether the app's identities are the source of truth when SlashID reconciles people across providers; leave None unless the app is your directory	None, Primary or Secondary

Then fill in the fields for the chosen method:

Bearer token:

Field	Description
Bearer token	The API token for the SCIM endpoint

OAuth 2.0 client credentials:

Field	Description
Client ID	Your OAuth 2.0 application's client ID
Client secret	Your OAuth 2.0 application's client secret
Token URL	The OAuth 2.0 token endpoint (e.g. https://auth.example.com/oauth/token)

Basic auth:

Field	Description
Username	Username for HTTP Basic authentication
Password	Password for HTTP Basic authentication

Test saves the endpoint and runs the connection's health check, so you can fix a credential before you continue.

4. Pick what to sync: choose which userType values are service accounts, and opt in to any custom resource types the endpoint serves.
5. Preview a sample of the first page of each endpoint, then click Activate.

To create the connection through the API, and for the full mapping, the limits and the activation responses, see Alternative: let SlashID pull from the app's SCIM endpoint.

What SlashID syncs

Entity type	Source	Key attributes
Custom app user or service account	GET /Users	userName, displayName, active, emails, userType, enterprise extension
Custom app group	GET /Groups	displayName, members (nested groups included)
Custom app role	Users' roles	value, display
Custom app resource (entitlement)	Users' entitlements	value, display, type
Custom resource types you opt in to	Their own endpoints	Mapped to roles or resources

Group memberships, role grants and entitlement grants are edges in the identity graph, so you can see which users belong to which groups, hold which roles and reach which resources.

Verification

After you activate the connection, SlashID:

• Syncs users and service accounts, with their names, emails, status and manager
• Syncs groups, roles and entitlements, and who holds each of them

The first crawl can take a few minutes, and SlashID then re-crawls on its regular schedule, once a day. The connection's page shows the health check and the last sync. You can then start exploring security events in the Identity Protection Dashboard.

Troubleshooting

In the wizard, a problem reading the endpoint shows as Could not read the SCIM endpoint or The preview failed, with a message such as SCIM discovery failed: the endpoint answered HTTP 401.

"401 Unauthorized"

• Verify your credentials are correct and have not expired.
• For bearer tokens, make sure the token can read /Users, and /Groups if the app has it.
• For OAuth 2.0, verify the client ID, client secret and token URL.

"403 Forbidden"

• Make sure the credentials are allowed to list users and groups through the app's SCIM API; some apps limit what a token can read. Check the app's documentation.

No users or groups appearing

• Confirm the base URL is correct and includes the SCIM path prefix (e.g. /scim/v2).
• Test the endpoint manually: curl -H "Authorization: Bearer <token>" <base_url>/Users

The health check or discovery fails to connect

• Make sure the SCIM endpoint is reachable from SlashID's infrastructure. If the app restricts access by IP, allow SlashID's egress IPs (see Before starting).

For activation errors, redirects and paging problems, see Troubleshooting SCIM pull.

If your console shows a SCIM form instead of the wizard

Some consoles still open SlashID's earlier SCIM form, for example where SCIM pull is not available yet. That form syncs users and groups only: no roles, entitlements or custom resource types.

1. Go to the SlashID Console > Identity Protection > Configuration > Data sources. Click Add data source, then select SCIM.

2. Enter your connection details:

Field	Description	Example
Name of the connection	Arbitrary name for this connection	HubSpot SCIM
SCIM endpoint base URL	The root URL of the SCIM 2.0 API	https://api.hubspot.com/scim/v2
Authentication method	How SlashID authenticates to your SCIM endpoint	Bearer token, OAuth 2.0 or Basic
Authoritative status	Whether SCIM identities are the primary source of truth when reconciling across providers	None, Primary or Secondary

3. Fill in the fields for your chosen authentication method, as in the tables in Step 2.

4. Click Connect to test the connection and complete the integration.

The form reads GET /Users (userName, displayName, active, emails) and GET /Groups (displayName, members).