SCIM
Base path: /scim/v2/{orgSlug} (SCIM bearer token). Standard SCIM 2.0 for IdP provisioning (Okta/Entra).
Discovery
Section titled “Discovery”GET /ServiceProviderConfig, /Schemas, /Schemas/{id}, /ResourceTypes (ScimEndpoints.cs:39).
| Method · Route | Source |
|---|---|
GET /Users · GET /Users/{id} | :112, :152 |
POST /Users | :165 |
PUT /Users/{id} · DELETE /Users/{id} | :255, :472 |
Groups (= Roles)
Section titled “Groups (= Roles)”| Method · Route | Behaviour | Source |
|---|---|---|
GET /Groups · GET /Groups/{id} | Lists Axowl Roles; members = active ConnectedIdRoles | :360, :395 |
POST /Groups | Creates a Role (CreateRoleCommand); members assigned via AssignRoleToMemberCommand | :416 |
PUT /Groups/{id} · PATCH /Groups/{id} | Rename role + reconcile membership (assign/revoke ConnectedIdRole) | :493 |
DELETE /Groups/{id} | :556 |
This is why the RBAC unification (Role = single source of truth) aligns with SCIM — see Roles & permissions.