Specifications

SCIM 2.0 was published by the IETF in September 2015 as three RFCs, and has since been extended by three more, with further work in progress.

SCIM 2.0

SCIM 2.0 is released as RFC 7642, RFC 7643, and RFC 7644 under the IETF SCIM working group.

RFC 7643 SCIM: Core Schema Published

The Core Schema provides a platform-neutral schema and extension model for representing users and groups.
RFC 7644 SCIM: Protocol Published

The SCIM Protocol is an application-level, REST protocol for provisioning and managing identity data on the web.
RFC 7642 SCIM: Definitions, Overview, Concepts, and Requirements Published

This document lists the user scenarios and use cases of System for Cross-domain Identity Management (SCIM).

Extensions and updates

Standards Track RFCs published since SCIM 2.0, extending the core specifications or updating them in place.

RFC 9865 Cursor-Based Pagination of SCIM Resources Published

Defines cursor and count query parameters and nextCursor / previousCursor response attributes, so service providers whose backing store already pages by cursor need not translate to index-based paging. Updates RFC 7643 and RFC 7644.
RFC 9944 Device Schema Extensions to the SCIM Model Published

Adds Device and EndpointApp resource types plus per-system bootstrapping extensions, enabling provisioning of devices using Wi-Fi Easy Connect, FIDO Device Onboard, Bluetooth Low Energy, Ethernet MAB, and Zigbee.
RFC 9967 SCIM Profile for Security Event Tokens (SETs) Published

Defines a set of SCIM events carried as Security Event Tokens, for asynchronous exchange of resource changes between service providers and receivers. Updates RFC 7643 and RFC 7644.

Current work

Where SCIM development is happening now. This list reflects the working group's document page as of September 2026; check there for the current state of any draft.

Working group drafts

Note

The working group's other adopted drafts have all been published as RFCs and are listed above. One adopted draft remains open, and its most recent revision has lapsed — drafts expire six months after publication and are routinely revived by a new revision, so an expired draft is not necessarily abandoned work.

draft-ietf-scim-roles-entitlements -01 WG Document Expired

SCIM Roles and Entitlements Extension. Lets a service provider publish the permitted values for the core roles and entitlements attributes, which in practice vary by tenant and by which services a customer has bought, so a client can discover them rather than guess.

Individual drafts

These are individual submissions that the working group has not adopted. They carry no consensus and may change or disappear, but they are where most active SCIM work currently sits.

draft-zollner-scim-interop-profile -01 Active

SCIM 2.0 Interoperability Profile. Constrains the base specification's many optional features into a required baseline, on the argument that the many-to-many model — one identity provider talking to many service providers, each provider accepting many identity providers — multiplies the cost of every optional feature.
draft-schreiber-scim-ipsie-profile -00 Active

SCIM 2.0 IPSIE Profile. A profile for enterprise identity lifecycle covering provisioning, account management, client authentication, and synchronization, organised into three Account Lifecycle assurance levels: deprovisioning, user and group management, then role management.
draft-zollner-scim-group-members -01 Active

SCIM Group Member Resource Type Extension. Promotes membership to a top-level GroupMember resource. Because RFC 7643 models members as values inside a Group attribute, there is no way to page, filter, or sort them — at a million members a single response can exceed 100 MB, which is why many implementations simply omit members.
draft-kushwaha-scim-attr-cursor-pagination -01 Active

Cursor-based pagination and deferred retrieval for multi-valued attributes. Tackles the same scale problem from the other direction: rather than flattening membership into its own resource, it pages within an attribute such as Group.members, and defines how a client can tell a bounded response from a complete one. Distinct from RFC 9865, which pages collections of resources.
draft-wzdk-scim-agent-resource -00 Active

AI Agent Resource Extension. A minimal schema for representing an AI agent as a SCIM resource, so an agent identity can be provisioned over the SCIM protocol and later authenticated and authorized like any other principal.
draft-kushwaha-scim-agent-governance -00 Active

SCIM Agent Governance Extension. Builds on the agent resource above with governance metadata: a lifecycle state model drawn from ISO/IEC 24760-1 rather than a single boolean, an autonomy classification, a validity window, and a credential-discovery reference. Authorization and credential management are deliberately left out.
draft-kushwaha-scim-tenant-resource -00 Active

Tenant-aware identity provisioning. Adds a Tenant resource type and tenant-membership extensions to User and Group, plus tenant-scoped uniqueness, a rule for resolving which tenant a request applies to, and tenant-aware filtering. Aimed at multi-tenant SaaS and B2B deployments.
draft-kushwaha-scim-didvc-binding -01 Active

SCIM DID/VC Binding Extension. Records auditable links between a SCIM User and Decentralized Identifiers or Verifiable Credentials, via an IdentityBinding resource type and a read-only User extension exposing binding state. DID resolution and credential issuance are out of scope; state changes propagate as RFC 9967 events.

Historical drafts

Expired individual drafts from 2015–2018 (6)

Note

These are individual Internet-Drafts rather than working group products, and all of them have expired. They are listed for the historical record; do not treat them as current.

draft-ansari-scim-soft-delete Expired

This document specifies a profile that handles soft delete of Users on SCIM service providers.
draft-hunt-scim-notify Expired

In a SCIM environment, changes to resources may be requested by multiple parties. As time goes by an interested subscriber may wish to be informed about resource state changes that are occurring at the SCIM service provider. This specification defines a hub notification service that can be used to publish and distribute events to interested registered subscribers.
draft-hunt-scim-password-mgmt Expired

This specification defines a set of password and account status extensions for managing passwords and password usage (e.g. failures) and other related session data. The specification defines new ResourceTypes that enable management of passwords and account recovery functions.
draft-wahl-scim-jit-profile Expired

This document specifies a profile of the System for Cross-domain Identity Management Protocol (SCIM). Servers which implement protocols such as SAML or OpenID Connect receive user identities through those protocols and often cache them, and this profile of SCIM defines how an identity provider can notify a SCIM server of changes to user accounts.
draft-greevenbosch-scim-vcard-mapping Expired

This document defines a mapping between SCIM and vCard.
draft-grizzle-scim-pam-ext Expired

This document contains a SCIM 2.0 extension for Privileged Access Management, which includes extensions to the core User and Group objects, and new resource types and schemas for standard Privileged Access Management constructs. This extension is intended to provide greater interoperability between PAM software and clients, a common language for PAM concepts, and a baseline that can be further extended to support more complex PAM requirements.

SCIM 1.1

Second official release of the SCIM specification, released in July 2012. Compatible with 1.0 and contains cleanups and clarifications on issues found during interop testing. These documents predate the IETF work and are archived here.

Core Schema Archived

The Core Schema provides a platform-neutral schema and extension model for representing users and groups in JSON and XML formats.
REST API Archived

The SCIM Protocol is an application-level, REST protocol for provisioning and managing identity data on the web.

SCIM 1.0

Deprecated

First official release of the SCIM specification, released in December 2011.

Scenarios Doc — draft 4 Deprecated

The scenario document was created to guide the development of the specification and is not normative.
Core Schema Deprecated

The Core Schema provides a platform-neutral schema and extension model for representing users and groups in JSON and XML formats.
REST API Deprecated

The SCIM Protocol is an application-level, REST protocol for provisioning and managing identity data on the web.
SAML 2.0 Binding — draft 1 Deprecated

Defines a binding of SCIM schema to SAML messages and assertions.