← All practicals

Provision a group, not just a user

Push a SCIM group with members, then PATCH its membership like a real HR reorg.

1. 1

   On the SCIM lab, POST a group to /scim/v2/Groups naming one of your directory users as a member.

   RFC 7643 §4.2: a Group is its own resource, displayName required. Every member id is checked against YOUR OWN directory before the group is created — a stranger’s user id (or another admin’s) is rejected outright, never silently dropped.

2. 2

   PATCH the group to add or remove a member — try the filtered path members[value eq "…"] to remove just one.

   RFC 7644 §3.5.2 PatchOp: add appends and de-dupes, the filtered remove path targets exactly one membership edge, and replace swaps the whole roster — all validated against your directory before anything is written.

3. 3

   Delete one of the group’s member users from the directory and re-fetch the group.

   Deleting a scim_user cascades: it disappears from every group it was in, in the same call — a directory can never be left pointing at a member that no longer exists.