SCIM

What it means

SCIM stands for System for Cross-domain Identity Management. It is a standard way for one system, usually a company's identity provider, to create, update and deactivate user accounts in another, such as your product, over a plain web API. Customers with a directory such as a company's own staff list expect this kind of link.

In practice an administrator adds a person in their directory and the account appears in your app, with the right groups. When the person leaves, the same system tells your app to switch the account off. No one has to create or delete accounts by hand, which is the point of the standard.

Why it matters

The valuable part is removal. Without automation, former staff keep working accounts in tools nobody remembered to clean up, which is how privilege creep and leftover access become audit findings. Enterprise buyers increasingly ask for SCIM before they sign. For you, it turns an offboarding task into something that happens without anyone remembering to do it.

It is also a new door into your app. The SCIM endpoint can create accounts and set roles, so it needs strong authentication of its own. A weak token or missing checks can let an outsider create an administrator. Treat it with the same care as the sign-in page, since it can change who has access.

How it shows up

You meet SCIM as a set of endpoints, commonly under /Users and /Groups, called by a customer's identity provider with a long-lived bearer token. Check how that token is issued, scoped and rotated, and whether it is tied to one customer only.

Common mistakes are one customer's token working on another's data, which is a tenant data leak, and accepting role or admin fields the directory should not control. Deactivation also needs to end live sessions and revoke tokens, not just flip a flag.