Events (SETs)

Asynchronous SCIM events, delivered as Security Event Tokens.

SCIM as defined in RFC 7644 is request/response: a client asks, a service provider answers. RFC 9967 adds the other direction. When a resource changes, a provider can emit a signal describing what happened, and interested receivers can consume it without polling the resource endpoints. Events are RFC 8417 Security Event Tokens (SETs), delivered either by push (RFC 8935) or by poll (RFC 8936).

A SET is a JWT: standard top-level claims plus an events claim holding one or more event URIs, each mapped to an object carrying that event's detail. Multiple event URIs in one SET mean the events came from the same transaction or state change on a single resource. Stream registration and configuration are deliberately out of scope.

Identifying the subject

Events identify their subject with the RFC 9493 sub_id claim, which lives in the top-level JWT claims — never inside an event payload.

format "scim"

Marks the remaining sub_id attributes as SCIM attributes.

uri required

The relative path of the resource — the resource type endpoint plus the resource id, such as /Users/2b2f880af6674ac284bae9381673d462. A receiver that cannot match the URI locally may append it to a previously agreed base URI and issue a SCIM GET.

externalId

The resource's externalId, if known, so a receiver can correlate the subject with its own record.

id

The SCIM id, permitted alongside uri for backwards compatibility.

Event types

All event URIs are prefixed urn:ietf:params:scim:event and grouped into sub-namespaces: feed for feed control, prov for provisioning, and misc.

The :notice and :full suffixes decide how much the event carries. A full event includes a data payload with the resource content; a notice event includes only an attributes list naming what changed, leaving the receiver to fetch the values itself. Exactly one of data or attributes is present — never both.

{
  "jti": "4d3559ec67504aaba65d40b0363faad8",
  "iat": 1458496404,
  "iss": "https://scim.example.com",
  "aud": [
    "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754",
    "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7"
  ],
  "sub_id": {
    "format": "scim",
    "uri": "/Users/44f6142df96bd6ab61e7521d9",
    "externalId": "jdoe"
  },
  "events": {
    "urn:ietf:params:scim:event:prov:create:full": {
      "data": {
        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
        "userName": "jdoe",
        "name": {
          "givenName": "John",
          "familyName": "Doe"
        },
        "emails": [
          { "type": "work", "value": "jdoe@example.com" }
        ]
      }
    }
  }
}

The same change as a notice carries only the attribute names:

{
  "jti": "4d3559ec67504aaba65d40b0363faad8",
  "iat": 1458496404,
  "iss": "https://scim.example.com",
  "sub_id": {
    "format": "scim",
    "uri": "/Users/44f6142df96bd6ab61e7521d9",
    "externalId": "jdoe"
  },
  "events": {
    "urn:ietf:params:scim:event:prov:create:notice": {
      "attributes": ["id", "name", "userName", "password", "emails"]
    }
  }
}

Discovery

A provider advertises event support through a securityEvents attribute on /ServiceProviderConfig. When the attribute is absent, the provider does not support events or is not configured for them.

asyncRequest "none" | "long" | "request"

Whether asynchronous SCIM requests are supported: none not at all, long at the server's discretion, request when the client asks for it.

eventUris multi-valued string

The event URIs this provider can generate and deliver over a SET stream. Informational only — it does not register or configure a stream.