SCIM 2.0 Automated User Provisioning and Deprovisioning

when IdP pushes SCIM POST /scim/v2/Users for a new employee, then Rivane creates the user account, assigns roles from group mapping, and sends a welcome notification within 5 min

when IdP pushes PATCH /scim/v2/Users/{id} with active: false, then all active JWTs for that user are revoked via jti blocklist within 60 s and the account is disabled

Administrator enables SCIM in Rivane, receives a bearer token and endpoint URL, and configures the IdP SCIM app. When HR adds a new employee in the HRIS, the IdP pushes a SCIM POST /Users to Rivane, which creates the user account, assigns roles from the SCIM group mapping, and sends a welcome notification. When HR terminates an employee, the IdP pushes PATCH /Users/{id} with active: false;
Rivane immediately revokes all active sessions via jti blocklist, disables the account, and writes a deprovisioning audit event. Group membership changes trigger incremental role updates.

Given SCIM 2.0 endpoint configured with bearer token;
when IdP pushes SCIM POST /scim/v2/Users for a new employee, then Rivane creates the user account, assigns roles from group mapping, and sends a welcome notification within 5 min;
when IdP pushes PATCH /scim/v2/Users/{id} with active: false, then all active JWTs for that user are revoked via jti blocklist within 60 s and the account is disabled;
(negative) when a SCIM request is sent with an invalid bearer token, then 401 is returned and no account change is made.

user { user_id: string, org_id: string, email: string, scim_external_id: string, status: enum(ACTIVE,INACTIVE,DEPROVISIONED), external_id: string };
scim_group_role_mapping { scim_group: string, org_id: string, role_id: string };
provisioning_audit { event_id: string, action: enum(PROVISION,DEPROVISION,UPDATE), user_id: string, source: string(SCIM), timestamp: timestamp };
(reference, product may differ).

POST /scim/v2/Users { userName, name, emails, groups } -> 201 { id, meta };
PATCH /scim/v2/Users/{id} { Operations: [{op, path, value}] } -> 200;
GET /scim/v2/Users/{id};
POST /scim/v2/Bulk -> 200 { Operations[] };
emits scim.user_provisioned and scim.user_deprovisioned events;
idempotent via SCIM id.

ACTIVE -> INACTIVE -> DEPROVISIONED;
guard: deprovisioning revokes JWTs within 60 s via jti blocklist;
PATCH operations are idempotent;
bulk operations supported for ≥1,000 users.