P20

Provision a user like an HR system

Push a SCIM user into a directory — the automated Joiner every onboarding pipeline relies on.

1
On the SCIM lab, generate a bearer token (shown once).

It stands in for the credential a real HRIS or IdP (Workday, Okta, Entra) is issued to push provisioning events into a downstream app — stored only as a SHA-256 hash, never in the clear.
2
POST a user to /scim/v2/Users with the sample curl command.

This is exactly the SCIM 2.0 (RFC 7643/7644) call an HR system fires the moment a new hire is added — the Lab returns the created resource with its `meta.location`.
3
Watch it land in the live directory, then flip active off or delete it.

Directory rows here can NEVER log in — they’re provisioning data, not accounts. Deactivating/deleting is the Mover/Leaver half of the same lifecycle, driven by the exact PATCH/DELETE a real deprovisioning pipeline sends.

Do it

Do the steps above on the lab page, then come back and check your progress.

Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.