Connect any SCIM 2.0 app with a custom endpoint

If an app is not in the template list but exposes a SCIM 2.0 API, you can connect it with Custom SCIM 2.0. All you need is the base URL and a bearer token. AnySCIM checks what the endpoint supports before the first sync.

Before you start

Look in the app's admin or security settings for a page called *SCIM*, *User provisioning* or *Directory sync*. You need:

The SCIM base URL, for example https://app.vendor.com/scim/v2. It is the URL that /Users and /Groups are appended to.
A bearer token with permission to manage users (and groups, if you push them).

If the vendor documents its setup for Okta or Microsoft Entra ID, the same two values work with AnySCIM.

Connect the endpoint

In the AnySCIM dashboard, open Connections → New connection and choose Custom SCIM 2.0.
Enter a display name, the base URL and the bearer token. The URL must use https://.
Click Test connection. AnySCIM calls GET /ServiceProviderConfig and GET /Users?count=1 and shows which optional features the server supports (PATCH, filter, bulk).
In Scope, select the organizational units and groups to provision. Selecting nothing means the whole directory.
Review the dry-run: it lists every user and group that would be created or updated, without sending anything.
Click Activate connection.

What the endpoint must support

Feature	Required	Why
`GET /Users?filter=userName eq "..."`	Yes	Finds existing accounts so they are matched instead of duplicated
`POST /Users`	Yes	Creates accounts
`PATCH /Users/{id}`	Yes	Updates changed attributes and sets `active: false` on offboarding
`/Groups` with PATCH	Optional	Only if you push group membership
`ETag` / `If-Match`	Optional	Used when available, to avoid overwriting concurrent changes

Troubleshooting

401 Unauthorized: the token is wrong, expired or revoked. Generate a new one and update the connection.
403 Forbidden: the token is valid but lacks permission, or SCIM is not included in your plan.
404 on /Users: the base URL is incomplete or has an extra path segment. It should end where /Users begins.
409 Conflict on create: an account with that userName already exists but the filter did not find it. Check that the app supports filter=userName eq.
429 Too Many Requests: AnySCIM retries automatically and honors Retry-After. For very large first syncs, scope the connection to a few groups first.

FAQ

Do I need SCIM 2.0, or does SCIM 1.1 work?

AnySCIM requires SCIM 2.0 (RFC 7643/7644). Most apps launched in the last decade implement 2.0.

Can I use OAuth client credentials instead of a static token?

Not yet. Connections use a bearer token: generate one with the client credentials grant in your app and paste it in Connections → New connection. If the token expires, the connection stops working until you add a new one.

My app is listed but the template URL is different from mine

Templates only pre-fill the URL format. Always paste the exact base URL shown in the vendor's admin settings.