# Connect any SCIM 2.0 app with a custom endpoint

> Provision Google Workspace users and groups to any app that exposes an RFC 7644 compliant SCIM 2.0 API, using its base URL and a bearer token.

If an app is not in the template list but exposes a SCIM 2.0 API, you can connect it with **Custom SCIM 2.0**. All you need is the base URL and a bearer token. AnySCIM checks what the endpoint supports before the first sync.

## Before you start

Look in the app's admin or security settings for a page called *SCIM*, *User provisioning* or *Directory sync*. You need:

- The **SCIM base URL**, for example `https://app.vendor.com/scim/v2`. It is the URL that `/Users` and `/Groups` are appended to.
- A **bearer token** with permission to manage users (and groups, if you push them).

If the vendor documents its setup for Okta or Microsoft Entra ID, the same two values work with AnySCIM.

## Connect the endpoint

1. In the AnySCIM dashboard, open **Connections → New connection** and choose **Custom SCIM 2.0**.
2. Enter a display name, the base URL and the bearer token. The URL must use `https://`.
3. Click **Test connection**. AnySCIM calls `GET /ServiceProviderConfig` and `GET /Users?count=1` and shows which optional features the server supports (PATCH, filter, bulk).
4. In **Scope**, select the organizational units and groups to provision. Selecting nothing means the whole directory.
5. Review the **dry-run**: it lists every user and group that would be created or updated, without sending anything.
6. Click **Activate connection**.

## What the endpoint must support

| Feature | Required | Why |
| --- | --- | --- |
| `GET /Users?filter=userName eq "..."` | Yes | Finds existing accounts so they are matched instead of duplicated |
| `POST /Users` | Yes | Creates accounts |
| `PATCH /Users/{id}` | Yes | Updates changed attributes and sets `active: false` on offboarding |
| `/Groups` with PATCH | Optional | Only if you push group membership |
| `ETag` / `If-Match` | Optional | Used when available, to avoid overwriting concurrent changes |

## Troubleshooting

- **401 Unauthorized:** the token is wrong, expired or revoked. Generate a new one and update the connection.
- **403 Forbidden:** the token is valid but lacks permission, or SCIM is not included in your plan.
- **404 on /Users:** the base URL is incomplete or has an extra path segment. It should end where `/Users` begins.
- **409 Conflict on create:** an account with that `userName` already exists but the filter did not find it. Check that the app supports `filter=userName eq`.
- **429 Too Many Requests:** AnySCIM retries automatically and honors `Retry-After`. For very large first syncs, scope the connection to a few groups first.

## FAQ

### Do I need SCIM 2.0, or does SCIM 1.1 work?

AnySCIM requires SCIM 2.0 (RFC 7643/7644). Most apps launched in the last decade implement 2.0.

### Can I use OAuth client credentials instead of a static token?

Not yet. Connections use a bearer token: generate one with the client credentials grant in your app and paste it in **Connections → New connection**. If the token expires, the connection stops working until you add a new one.

### My app is listed but the template URL is different from mine

Templates only pre-fill the URL format. Always paste the exact base URL shown in the vendor's admin settings.