---
title: "Provision a SCIM enterprise user"
method: POST
path: "/scim/v2/Users"
tags: ["enterprise-admin"]
---

# Provision a SCIM enterprise user

`POST /scim/v2/Users`

**Note:** The SCIM API endpoints for enterprise accounts are currently in *private* beta and are subject to change.

Creates an external identity for a new SCIM enterprise user.

SCIM does not authenticate users, it only provisions them. The authentication of users is done by SAML. However, when SCIM is enabled, all users need to be provisioned through SCIM before a user can sign in through SAML. The matching of a user to a SCIM provisioned user is done when the SAML assertion is consumed. The user will be matched on SAML response `NameID` to SCIM `userName`.

When converting existing enterprise to use SCIM, the user handle (`userName`) from the SCIM payload will be used to match the provisioned user to an already existing user in the enterprise. Since the new identity record is created for newly provisioned users the matching for those records is done using a user's handle. Currently the matching will be performed to all of the users no matter if they were SAML JIT provisioned or created as local users.

## Request body

- User
  - `schemas` string[], required — The URIs that are used to indicate the namespaces of the SCIM schemas.
  - `externalId` string, required — A unique identifier for the resource as defined by the provisioning client.
  - `active` boolean, required — Whether the user active in the IdP.
  - `userName` string, required — The username for the user.
  - `name` UserName
    - `formatted` string — The full name, including all middle names, titles, and suffixes as appropriate, formatted for display.
    - `familyName` string, required — The family name of the user.
    - `givenName` string, required — The given name of the user.
    - `middleName` string — The middle name(s) of the user.
  - `displayName` string, required — A human-readable name for the user.
  - `emails` object[], required — The emails for the user.
    - `value` string, required — The email address.
    - `type` string, required — The type of email address.
    - `primary` boolean, required — Whether this email address is the primary address.
  - `roles` object[] — The roles assigned to the user.
    - `display` string
    - `type` string
    - `value` 'user' | '27d9891d-2c17-4f45-a262-781a0e55c80a' | 'guest_collaborator' | '1ebc4a02-e56c-43a6-92a5-02ee09b90824' | 'enterprise_owner' | '981df190-8801-4618-a08a-d91f6206c954' | 'ba4987ab-a1c3-412a-b58c-360fc407cb10' | 'billing_manager' | '0e338b8c-cc7f-498a-928d-ea3470d7e7e3' | 'e6be2762-e4ad-4108-b72d-1bbe884a0f91', required — The role value representing a user role in GitHub.
    - `primary` boolean — Is the role a primary role for the user.

## Response `201`

User has been created

## Other responses

- `400` — Bad request
- `401` — Authorization failure
- `403` — Permission denied
- `409` — Duplicate record detected
- `429` — Too many requests
- `500` — Internal server error

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-5.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-5/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-5/versions/50ae54440071/schema)