🗂️ SCIM provisioning lab
SCIM 2.0 (RFC 7643/7644) — the "Joiner" side of the identity lifecycle. This page SIMULATES an external HR/IdP system (Workday, Okta, Entra…) pushing user records into a directory it owns. The directory below is yours alone: every read and write is scoped to your account, so no other learner's token can see or change it.
Directory rows here are provisioning data, not accounts — a row in scim_users can never log in. No credential, no
session, no email-code path ever touches it. Deactivating or deleting a row is the Mover/Leaver
half of the same lifecycle a real HR-driven offboarding pipeline runs.