SCIM 2.0 reference

Technical reference for identity-management teams connecting an IdP (Microsoft Entra ID, SailPoint IdentityIQ, …) to mTime: which SCIM 2.0 attributes and operations mTime supports, and what each one does.

Overview

What SCIM manages, and what it does not

mTime separates the user (login, roles, access) from the employee and their employments:

User → Employee → n Employments

SCIM manages the user: who may sign in, under which name, and with which roles. Employees and employments — org unit, manager, employment terms, working-time norm, start and end dates — are dated data that mTime calculates on, and they come from your HR integration, not from SCIM. A SCIM user is linked to its employee through the externalId (see How users are provisioned).

This is why mTime does not support the Enterprise User Extension: department, manager and employeeNumber are single values without a validity date, while an employee in mTime can hold several dated employments.

Users

Attributes

Schema urn:ietf:params:scim:schemas:core:2.0:User.

Every other Core User attribute (nickName, title, phoneNumbers, addresses, password, …) and the Enterprise User Extension (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User) are not supported: they are ignored on create and update and never returned.

Which name SCIM sets

mTime shows one name for a person: the employee’s name when the user is linked to an employee, otherwise the user’s name.

• A user linked to an employee shows the employee’s name, which your HR integration maintains. By default SCIM does not update an existing employee, so a name sent through SCIM has no visible effect for this user. With Use identity provider names for employee names turned on, each create, PUT or PATCH that carries a name writes it to the linked employee as well — see Using the identity provider’s name for employees.
• A user without an employee (such as a draft) shows the user’s own name. SCIM sets it on create and can change it until the person activates their invitation; after that it follows the name on their own mTime account. When a role later creates their employee, the employee starts with this name.

To rename someone who is an employee, change the name in your HR system — or, with that setting turned on, in your IdP.

Operations

Users holding the owner role cannot be changed or deleted through SCIM (403).

Deactivate or delete?

Groups

Groups map to mTime roles: the IdP owns a group’s existence and membership, mTime admins own the role’s permissions. See How groups become roles.

Attributes

Schema urn:ietf:params:scim:schemas:core:2.0:Group.

Operations

Paging

GET /Users and GET /Groups support index-based paging (RFC 7644 §3.4.2.4), with or without a filter.

The response gives totalResults (all matches), startIndex, and itemsPerPage (the results on this page). Request the next page with startIndex + itemsPerPage until you have totalResults results. Results come in a fixed order, so pages neither skip nor repeat results unless users or groups are added or deleted in between.

Discovery endpoints

All three require the same bearer token as the other SCIM endpoints.

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
  "documentationUri": "https://help.mtime.app",
  "patch": { "supported": true },
  "bulk": { "supported": false, "maxOperations": 0, "maxPayloadSize": 0 },
  "filter": { "supported": true, "maxResults": 200 },
  "changePassword": { "supported": false },
  "sort": { "supported": false },
  "etag": { "supported": false },
  "authenticationSchemes": [
    {
      "type": "oauthbearertoken",
      "name": "OAuth Bearer Token",
      "description": "Bearer token issued for the workspace's provisioning service user",
      "primary": true
    }
  ]
}

Troubleshooting