```json
{
  "openapi": "3.0.0",
  "info": {
    "title": "Unity Identity SCIM",
    "version": "2.0.0",
    "description": "SCIM 2.0 user provisioning API for SSO-enabled organizations.",
    "contact": {
      "name": "Unity Identity Team"
    }
  },
  "servers": [
    {
      "url": "https://services.api.unity.com/scim/v2"
    }
  ],
  "tags": [
    {
      "name": "SCIM - Users",
      "description": "SCIM 2.0 user provisioning endpoints."
    },
    {
      "name": "SCIM - Groups",
      "description": "SCIM 2.0 group provisioning endpoints."
    },
    {
      "name": "SCIM - Discovery",
      "description": "SCIM 2.0 service discovery endpoints (ServiceProviderConfig, ResourceTypes, Schemas)."
    }
  ],
  "paths": {
    "/tenants/{organizationId}/Users": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        }
      ],
      "get": {
        "summary": "List SCIM users",
        "description": "Lists the SCIM users provisioned for the given tenant organization. Supports the standard SCIM 2.0 query parameters (filter, sortBy, startIndex, count) per RFC 7644 §3.4.",
        "operationId": "listScimUsers",
        "tags": [
          "SCIM - Users"
        ],
        "responses": {
          "200": {
            "description": "SCIM ListResponse of users.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      },
      "post": {
        "summary": "Create a SCIM user",
        "description": "Provisions a new SCIM user in the given tenant organization. The request body is a SCIM 2.0 User resource per RFC 7643 §4.1.",
        "operationId": "createScimUser",
        "tags": [
          "SCIM - Users"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/scim+json": {
              "schema": {
                "$ref": "#/components/schemas/ScimResource"
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "SCIM user created.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/ScimValidationError"
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "409": {
            "$ref": "#/components/responses/ScimConflictError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    },
    "/tenants/{organizationId}/Users/{id}": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        },
        {
          "$ref": "#/components/parameters/scimResourceId"
        }
      ],
      "get": {
        "summary": "Get a SCIM user",
        "description": "Returns the SCIM user with the given identifier from the tenant organization.",
        "operationId": "getScimUser",
        "tags": [
          "SCIM - Users"
        ],
        "responses": {
          "200": {
            "description": "SCIM user resource.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      },
      "put": {
        "summary": "Replace a SCIM user",
        "description": "Replaces the entire SCIM user resource with the provided representation per RFC 7644 §3.5.1. Attributes omitted from the request are cleared.",
        "operationId": "replaceScimUser",
        "tags": [
          "SCIM - Users"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/scim+json": {
              "schema": {
                "$ref": "#/components/schemas/ScimResource"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "SCIM user replaced.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/ScimValidationError"
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      },
      "patch": {
        "summary": "Patch a SCIM user",
        "description": "Applies a partial update to the SCIM user resource using the SCIM PatchOp envelope per RFC 7644 §3.5.2. Supports add, replace, and remove operations.",
        "operationId": "patchScimUser",
        "tags": [
          "SCIM - Users"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/scim+json": {
              "schema": {
                "$ref": "#/components/schemas/ScimPatchOp"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "SCIM user patched.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/ScimValidationError"
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      },
      "delete": {
        "summary": "Delete a SCIM user",
        "description": "Deprovisions the SCIM user from the tenant organization per RFC 7644 §3.6.",
        "operationId": "deleteScimUser",
        "tags": [
          "SCIM - Users"
        ],
        "responses": {
          "204": {
            "description": "SCIM user deleted."
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    },
    "/tenants/{organizationId}/Groups": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        }
      ],
      "get": {
        "summary": "List SCIM groups",
        "description": "Lists the SCIM groups provisioned for the given tenant organization. Supports the standard SCIM 2.0 query parameters (filter, sortBy, startIndex, count) per RFC 7644 §3.4. Only SCIM-provisioned groups are visible. Plain lists omit `members`, which only a `displayName eq` filter returns. `excludedAttributes` applies only to `members`, and `attributes` is not supported.",
        "operationId": "listScimGroups",
        "tags": [
          "SCIM - Groups"
        ],
        "responses": {
          "200": {
            "description": "SCIM ListResponse of groups.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      },
      "post": {
        "summary": "Create a SCIM group",
        "description": "Provisions a new SCIM group in the given tenant organization. The request body is a SCIM 2.0 Group resource per RFC 7643 §4.2.",
        "operationId": "createScimGroup",
        "tags": [
          "SCIM - Groups"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/scim+json": {
              "schema": {
                "$ref": "#/components/schemas/ScimResource"
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "SCIM group created.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/ScimValidationError"
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "409": {
            "$ref": "#/components/responses/ScimConflictError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    },
    "/tenants/{organizationId}/Groups/{id}": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        },
        {
          "$ref": "#/components/parameters/scimResourceId"
        }
      ],
      "get": {
        "summary": "Get a SCIM group",
        "description": "Returns the SCIM group with the given identifier from the tenant organization. Only SCIM-provisioned groups are visible.",
        "operationId": "getScimGroup",
        "tags": [
          "SCIM - Groups"
        ],
        "responses": {
          "200": {
            "description": "SCIM group resource.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      },
      "put": {
        "summary": "Replace a SCIM group",
        "description": "Replaces the entire SCIM group resource with the provided representation per RFC 7644 §3.5.1. Attributes omitted from the request are cleared.",
        "operationId": "replaceScimGroup",
        "tags": [
          "SCIM - Groups"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/scim+json": {
              "schema": {
                "$ref": "#/components/schemas/ScimResource"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "SCIM group replaced.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/ScimValidationError"
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      },
      "patch": {
        "summary": "Patch a SCIM group",
        "description": "Applies a partial update to the SCIM group resource using the SCIM PatchOp envelope per RFC 7644 §3.5.2. Supports add, replace, and remove operations.",
        "operationId": "patchScimGroup",
        "tags": [
          "SCIM - Groups"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/scim+json": {
              "schema": {
                "$ref": "#/components/schemas/ScimPatchOp"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "SCIM group patched.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/ScimValidationError"
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      },
      "delete": {
        "summary": "Delete a SCIM group",
        "description": "Deprovisions the SCIM group from the tenant organization per RFC 7644 §3.6.",
        "operationId": "deleteScimGroup",
        "tags": [
          "SCIM - Groups"
        ],
        "responses": {
          "204": {
            "description": "SCIM group deleted."
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    },
    "/tenants/{organizationId}/ServiceProviderConfig": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        }
      ],
      "get": {
        "summary": "Get the SCIM service provider configuration",
        "description": "Returns the SCIM ServiceProviderConfig resource describing the SCIM features supported by Unity for the given tenant per RFC 7644 §4.",
        "operationId": "getScimServiceProviderConfig",
        "tags": [
          "SCIM - Discovery"
        ],
        "responses": {
          "200": {
            "description": "SCIM ServiceProviderConfig resource.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    },
    "/tenants/{organizationId}/ResourceTypes": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        }
      ],
      "get": {
        "summary": "List SCIM resource types",
        "description": "Lists the SCIM resource types supported by Unity for the given tenant per RFC 7644 §4. Each entry describes a resource (User, Group, etc.) and its endpoint, schema, and supported extensions.",
        "operationId": "listScimResourceTypes",
        "tags": [
          "SCIM - Discovery"
        ],
        "responses": {
          "200": {
            "description": "SCIM ListResponse of resource types.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    },
    "/tenants/{organizationId}/ResourceTypes/{id}": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        },
        {
          "$ref": "#/components/parameters/scimResourceId"
        }
      ],
      "get": {
        "summary": "Get a SCIM resource type",
        "description": "Returns metadata for a single SCIM resource type per RFC 7644 §4, including its endpoint, base schema, and supported extensions.",
        "operationId": "getScimResourceType",
        "tags": [
          "SCIM - Discovery"
        ],
        "responses": {
          "200": {
            "description": "SCIM ResourceType resource.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    },
    "/tenants/{organizationId}/Schemas": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        }
      ],
      "get": {
        "summary": "List SCIM schemas",
        "description": "Lists the SCIM attribute schemas supported by Unity for the given tenant per RFC 7644 §4. Used by SCIM clients to discover the attributes available on each resource type.",
        "operationId": "listScimSchemas",
        "tags": [
          "SCIM - Discovery"
        ],
        "responses": {
          "200": {
            "description": "SCIM ListResponse of schemas.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    },
    "/tenants/{organizationId}/Schemas/{id}": {
      "parameters": [
        {
          "$ref": "#/components/parameters/organizationId.v1"
        },
        {
          "$ref": "#/components/parameters/scimSchemaURN"
        }
      ],
      "get": {
        "summary": "Get a SCIM schema",
        "description": "Returns a single SCIM attribute schema by URI per RFC 7644 §4, including the attribute definitions used to validate the corresponding resource type.",
        "operationId": "getScimSchema",
        "tags": [
          "SCIM - Discovery"
        ],
        "responses": {
          "200": {
            "description": "SCIM Schema resource.",
            "content": {
              "application/scim+json": {
                "schema": {
                  "$ref": "#/components/schemas/ScimResource"
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/ScimAuthenticationError"
          },
          "403": {
            "$ref": "#/components/responses/ScimAuthorizationError"
          },
          "404": {
            "$ref": "#/components/responses/ScimNotFoundError"
          },
          "500": {
            "$ref": "#/components/responses/ScimInternalServerError"
          }
        }
      }
    }
  },
  "components": {
    "parameters": {
      "organizationId.v1": {
        "name": "organizationId",
        "in": "path",
        "description": "Genesis ID of the organization",
        "required": true,
        "schema": {
          "type": "string"
        }
      },
      "scimResourceId": {
        "name": "id",
        "in": "path",
        "required": true,
        "description": "SCIM resource identifier.",
        "schema": {
          "type": "string"
        }
      },
      "scimSchemaURN": {
        "name": "id",
        "in": "path",
        "required": true,
        "description": "SCIM schema URN per RFC 7643 §8 (e.g.\n`urn:ietf:params:scim:schemas:core:2.0:User`). Distinct from\n`scimResourceId` because schema ids are URNs containing RFC 3986\nreserved characters (notably `:`), which the gateway's default\npath-segment matcher does not accept.\n",
        "schema": {
          "type": "string",
          "pattern": "^urn:[^/]+$"
        }
      }
    },
    "schemas": {
      "ScimResource": {
        "type": "object",
        "description": "Opaque SCIM 2.0 resource. The gateway forwards the body verbatim to the SCIM service, which validates against RFC 7643/7644.",
        "additionalProperties": true
      },
      "ScimError": {
        "type": "object",
        "description": "SCIM 2.0 error response envelope per RFC 7644 §3.12. The SCIM service produces this body\nand the gateway forwards it verbatim (see `bodyProcessing.response: skip` on each route).\n",
        "required": [
          "schemas",
          "status"
        ],
        "properties": {
          "schemas": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "example": [
              "urn:ietf:params:scim:api:messages:2.0:Error"
            ]
          },
          "status": {
            "type": "string",
            "description": "HTTP status code as a string per RFC 7644 §3.12.",
            "example": "404"
          },
          "scimType": {
            "type": "string",
            "description": "SCIM detail error keyword (RFC 7644 §3.12, e.g. `uniqueness`, `mutability`).",
            "example": "uniqueness"
          },
          "detail": {
            "type": "string",
            "example": "Resource 5770009990009 not found."
          }
        },
        "additionalProperties": true
      },
      "ScimPatchOp": {
        "type": "object",
        "description": "SCIM 2.0 PatchOp envelope (RFC 7644 §3.5.2). Forwarded verbatim to the SCIM service for validation.",
        "additionalProperties": true
      }
    },
    "responses": {
      "ScimAuthenticationError": {
        "description": "Unauthorized",
        "content": {
          "application/scim+json": {
            "schema": {
              "$ref": "#/components/schemas/ScimError"
            }
          }
        }
      },
      "ScimAuthorizationError": {
        "description": "Forbidden",
        "content": {
          "application/scim+json": {
            "schema": {
              "$ref": "#/components/schemas/ScimError"
            }
          }
        }
      },
      "ScimInternalServerError": {
        "description": "Internal Server Error",
        "content": {
          "application/scim+json": {
            "schema": {
              "$ref": "#/components/schemas/ScimError"
            }
          }
        }
      },
      "ScimValidationError": {
        "description": "Bad Request",
        "content": {
          "application/scim+json": {
            "schema": {
              "$ref": "#/components/schemas/ScimError"
            }
          }
        }
      },
      "ScimConflictError": {
        "description": "Conflict",
        "content": {
          "application/scim+json": {
            "schema": {
              "$ref": "#/components/schemas/ScimError"
            }
          }
        }
      },
      "ScimNotFoundError": {
        "description": "Not Found",
        "content": {
          "application/scim+json": {
            "schema": {
              "$ref": "#/components/schemas/ScimError"
            }
          }
        }
      }
    }
  }
}
```