SCIM Troubleshooting
Common issues and solutions for SCIM provisioning problems.
Common Issues
Token Authentication Failed
CauseInvalid or expired SCIM token
SolutionRegenerate the token in SecureCodingHub and update it in your identity provider
NoteTokens don't expire automatically, but can be revoked by an admin
User Already Exists (409 Conflict)
CauseUser with the same email already exists (created manually or via JIT provisioning)
SolutionIf the existing user is inactive (previously deactivated via SCIM), SCIM reactivates them in place and returns 200. If the existing user is active, SCIM returns 409 and does not auto-link — the IdP needs to PATCH or PUT the matching user instead of creating a duplicate.
Seat Limit Reached (403 Forbidden)
CauseOrganization has reached its maxSeats limit
SolutionRemove inactive users or upgrade your plan to increase the seat limit
Group Sync Not Working
CausePush Groups not enabled, or the group is not assigned to the application
SolutionEnable Push Groups in your IdP and verify the group is assigned to the SecureCodingHub app
User Not Deactivated After Removal
CauseIdP sends PATCH with active=false, not DELETE
SolutionThis is expected behavior — SCIM deactivation sets the user to inactive without deleting their data
Checking SCIM Logs
When troubleshooting, check the provisioning logs in your identity provider:
| Identity Provider | Where to Find Logs |
|---|---|
| Okta | Applications → your app → Provisioning → Integration → View Logs |
| Azure AD | Enterprise Applications → your app → Provisioning → Provisioning Logs |
SCIM Endpoints Reference
All endpoints are relative to the base URL: https://api.limeplate.com/api/sch/scim/v2
| Endpoint | Method | Description |
|---|---|---|
/Users | GET | List users (with filter support) |
/Users | POST | Create user |
/Users/{id} | GET | Get user |
/Users/{id} | PUT | Replace user |
/Users/{id} | PATCH | Update user attributes |
/Users/{id} | DELETE | Soft-delete user (sets active=false, preserves the record) |
/Groups | GET | List groups (with filter support) |
/Groups | POST | Create group |
/Groups/{id} | GET | Get group |
/Groups/{id} | PUT | Replace group |
/Groups/{id} | PATCH | Update group members |
/Groups/{id} | DELETE | Delete group |
/ServiceProviderConfig | GET | Discovery — capabilities the server supports. |
/Schemas | GET | Discovery — the SCIM schemas served by this tenant. |
/ResourceTypes | GET | Discovery — the resource types (User, Group) this tenant exposes. |
Still having issues? Contact support@securecodinghub.com with your organization name and the error details.