Discovery

Three endpoints let a client learn what a server supports, at runtime.

To simplify interoperability, SCIM provides three endpoints to discover supported features and specific attribute details. A client can adapt to a given service provider rather than hard-coding assumptions about it.

GET /ServiceProviderConfig: Specification compliance, authentication schemes, and data models. This is where you learn whether the server supports PATCH, bulk operations, filtering, sorting, and ETags, along with any limits on those.
GET /ResourceTypes: An endpoint used to discover the types of resources available — typically User and Group, but a server may expose more — along with each one's endpoint and schema URIs.
GET /Schemas: Introspect resources and attribute extensions. Returns the full attribute definitions: names, types, mutability, uniqueness, and whether each is required or multi-valued.

Discovering server capabilities

GET /v2/ServiceProviderConfig HTTP/1.1
Host: example.com
Accept: application/scim+json

Extensions advertise themselves here

Later RFCs add their own attributes to /ServiceProviderConfig, so this is where a client discovers optional capabilities: RFC 9865 adds pagination to describe cursor and index paging support, and RFC 9967 adds securityEvents to describe asynchronous event support.

Note

These three endpoints are read-only, and RFC 7644 allows them to be served without authentication so that a client can discover a server's capabilities before provisioning credentials.

Examples Next →