Product | 5 min read | Audience: Application Owners & Enterprise IGA Teams
Every enterprise deal eventually hits the same wall: "Does your app support SCIM?"
Identity providers and governance tools like SailPoint, Okta, Microsoft Entra ID, and Saviynt expect to create, update, and deactivate users in your application automatically. The protocol they speak is SCIM 2.0. Without it, your customers' IT teams are stuck provisioning accounts by hand — and your sales team is stuck waiting on a security review that won't clear.
The catch is that building SCIM well is a slog. The spec (RFC 7643/7644) is large, the edge cases are subtle, and every application's user model is different. So teams usually pick one of two bad options: spend weeks hand-rolling a SCIM server, or bolt on a third-party provisioning service that inserts itself between your app and your own user data.
What It Is
SCIM Forge reads your existing codebase and generates a complete, runnable SCIM 2.0 adapter tailored to it — in three reviewable stages, right inside your coding agent.
The output isn't a hosted service or an opaque dependency. It's source code that lands in your repository, wraps the user-management logic you already have, and is yours to read, modify, and ship. Once generated, the adapter has zero runtime dependency on SCIM Forge or any outside service.
Why It Matters
| Pass certification, close the deal | SCIM Forge generates the /Users and /Groups endpoints, filtering, pagination, and discovery routes that identity providers require to certify your integration. |
| No black box | The generated adapter runs on its own. Your users' data flows only between your app and your identity provider — never through us. |
| You stay in control | SCIM Forge never silently rewrites your application. Every stage stops for your review, and the generated code connects to your services through a bridge you wire up explicitly. |
| Built for your stack | First-class support for Node/TypeScript (Express, Fastify), Python (FastAPI, Flask), Go (chi, net/http), and Java/Kotlin (Spring Boot). |
How It Works
SCIM Forge runs as a plugin inside your coding agent — such as Claude Code or Gemini CLI — and works in three commands, each followed by a human review gate:
Step 1
/scim-analyze
SCIM Forge walks your repository and maps how you already handle users, groups, roles, and the create/update/deactivate lifecycle. It writes its findings to scim/analysis.md for you to review. Crucially, it never guesses: anything it can't determine from your code is flagged as inconclusive, not invented.
Step 2
/scim-map
It translates those findings into a SCIM attribute mapping and a full OpenAPI 3.1 specification for your new endpoints. Where a required SCIM field has no obvious home in your model, it flags the gap for a human decision rather than papering over it. You resolve those before moving on — and generation won't proceed until you do.
Step 3
/scim-generate
Once the mapping is clean, SCIM Forge emits a complete adapter under scim/server/: the SCIM routes, a filter parser, attribute transforms (with unit tests), bearer-token authentication, schema and discovery endpoints, a smoke test, and an INTEGRATION.md that tells you exactly what to paste into your router. The code compiles and passes its own tests out of the box.
From there, you wire a handful of bridge functions to your real service methods, merge a dependency fragment, set a bearer token — and you're serving SCIM.
What SCIM Forge Covers
SCIM Forge targets the production baseline real identity providers require: full CRUD on Users and Groups, filtering, pagination, sorting, the discovery endpoints (/Schemas, /ResourceTypes, /ServiceProviderConfig), bearer-token auth, and RFC-compliant error responses. Generated specs are checked for SCIM compliance as part of the pipeline.
(Bulk operations, ETag versioning, the /Me endpoint, and the Enterprise User extension are deliberately out of v1 scope — additions on the roadmap, not gaps in the baseline.)
Get Started
SCIM Forge Is Available Now to Our Customers
If enterprise provisioning is on your roadmap — or blocking a deal right now — we'd love to show you how fast you can ship it.
