About SCIM API

How it works

System for Cross-domain Identity Management (SCIM) is a standard that automates and simplifies creating, updating, and removing user accounts across cloud apps.

Use SCIM provisioning to automatically sync users from your identity provider (IdP) to Tealium. SCIM creates users with appropriate access during onboarding and removes Tealium access when users are deprovisioned in the identity provider, ensuring consistent offboarding and preventing unauthorized access.

Use a SCIM provisioning connector in your IdP or invoke the SCIM API directly.

Authentication

The Tealium SCIM integration uses a long-lived bearer token to authenticate with applications. Use this bearer token as the OAuth bearer token when you configure your user provisioning application.

This bearer token authenticates all SCIM API calls.

The API key and bearer token are linked to the user who generates them. Use a dedicated service user (an account not linked to a person), such as scim@example.com, to prevent access issues if a regular user account becomes unavailable.

To generate the bearer token:

1. Log in to Tealium as a dedicated service user.
2. Generate an API key.
3. Call the long-lived token endpoint to generate a bearer token using the following cURL command. Replace the placeholders with your account name, profile name, dedicated username, and the API key:

curl --location 'https://developer.tealiumapis.com/v1/auth-long-lived/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'account={ACCOUNT}' \
--data-urlencode 'profile=main' \
--data-urlencode 'username={USERNAME@EXAMPLE.COM}' \
--data-urlencode 'key={API_KEY}'

The token resembles the following example:

{
  "access_token":"eyJhbG...53UHg",
  "token_type": "Bearer",
  "expires_in": 7776000,
  "scope": "profile email"
}

The token expires after 90 days. Regenerate it as needed, or use the revoke token endpoint to invalidate a token before it expires.

The token generation endpoint has a rate limit of 10 requests per minute per IP address.

If you need assistance generating a token or have questions about permissions, contact Tealium Support.

Revoke a token

Use the revoke endpoint to immediately invalidate a token before it expires. Revoke a token when responding to a security incident, rotating credentials, or decommissioning an integration.

Revocation takes effect within seconds and is permanent. Revoking a token cannot be undone. Generate a new token to restore access.

To revoke a token, call the following endpoint using the same credentials used to generate it:

curl --location 'https://developer.tealiumapis.com/v1/auth-long-lived/revoke' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'token={ACCESS_TOKEN}' \
--data-urlencode 'account={ACCOUNT}' \
--data-urlencode 'profile=main' \
--data-urlencode 'username={USERNAME@EXAMPLE.COM}' \
--data-urlencode 'key={API_KEY}'

Revoke token parameters

Response

A successful revocation returns HTTP 200 with an empty response body.

The endpoint returns 200 OK regardless of whether the token was already expired or previously revoked. Revoking an already-invalid token is not an error.

A 401 Unauthorized response indicates that the credentials provided do not match the credentials used to generate the token.

The revoke endpoint has a rate limit of 20 requests per minute per IP address.

Endpoints and permissions

The Tealium implementation of SCIM supports the following HTTP methods:

Groups

The SCIM API exposes two types of groups: built-in groups and custom groups.

SCIM can create custom groups and manage group membership for both types, but it cannot change a group’s permissions. You must use the Tealium UI to configure group permissions.

Built-in groups

Built-in groups are system-level groups that correspond to Tealium admin roles. They exist in every account and cannot be created, renamed, or deleted through SCIM.

The following built-in groups are available with the SCIM /Groups endpoint:

The Standard User group is an alias for the internal Account Viewers group. Both groups share the same UUID. Filtering on displayName eq "Standard User" matches this group, but filtering on Account Viewers returns zero results.

Inherited groups

Adding a user to certain admin groups automatically grants membership in inherited groups:

Membership in Account Admins, User Admins, or Privacy Admins automatically grants membership in internal PII groups (PII Admins/PII Viewers). For security purposes, these internal groups are not visible with the SCIM API.

Group removal behavior

Removing a user from an admin group automatically removes them from inherited groups:

• Account Admins: Removes from User Admins, Privacy Admins, Technical Admins, Profile Admins, and revokes PII access.
• User Admins: Removes from Technical Admins and revokes PII access.
• Privacy Admins: Removes from User Admins, Technical Admins, and revokes PII access.
• Technical Admins: No automatic removal.
• Profile Admins: No automatic removal.

Built-in group protection

Built-in groups have the following restrictions:

• Cannot be renamed with SCIM PATCH operations.
• Cannot be deleted with SCIM DELETE operations.

Creating or updating a custom group with a displayName that matches a built-in group returns an HTTP 400 error.

Custom groups

Custom groups are permission groups created in the Tealium UI. They appear alongside built-in groups in the SCIM /Groups endpoint.

SCIM supports the following operations on custom groups:

• Create a custom group with initial membership (POST).
• Add and remove users from a custom group (PATCH, PUT).
• Rename a custom group (PATCH, PUT).
• Delete a custom group (DELETE).

SCIM cannot set or modify the permissions of a custom group. After creating a group through SCIM, use the Tealium UI to configure the group permissions.