SCIM Audit Logs

SCIM Audit Logs capture every SCIM request — such as read, create, update, and delete operations — and record how each one was handled by the system. Reviewing these entries allows the Workspace Administrator to monitor identity lifecycle events, verify that automated provisioning is working correctly, and troubleshoot integration issues as they arise.

Role Permissions

1. Workspace Administrator: Views and reviews SCIM Audit Logs, including entry details and filtered results, to monitor identity lifecycle events and troubleshoot SCIM integration issues.
2. All Other Roles (Administrator, Moderators & Members): Do not have access to it.

SCIM Log Columns

SCIM Audit Logs provide a record of each SCIM operation and indicate whether it succeeded or failed. Each entry includes the following columns:

1. Request ID: A unique reference identifier for the SCIM request. This ID can be used to trace a specific transaction across systems or when working with support teams.
2. Time: The exact date and time the request was made. This places events in sequence, correlates them with other system activity, and supports investigation of time-bound incidents.
3. Status: Indicates whether the request completed successfully or failed. Note: If the status is Failed, selecting the more info (i) icon displays the associated error message for further detail.
4. HTTP Method: Indicates the type of API operation performed — such as GET (read), POST (create), PUT (replace), or DELETE (remove). Identifying the method shows what kind of change was attempted.
5. Endpoint: Shows the specific API endpoint that was called (for example, /Users or /Groups), identifying which SCIM resource or collection the operation targeted.
6. Query Parameter: Displays any query parameters included with the API call. These parameters refine the request — for instance, by filtering, sorting, or limiting the results.
7. Status Code: Provides the HTTP status code returned by the server, indicating whether the request succeeded or failed. Codes such as 200, 201, and 204 represent successful operations, while codes like 400 and 404 indicate the request was not completed as intended.
8. Response: Shows the full response returned by the SCIM service. Reviewing this content helps diagnose issues and verify that the system behaved as expected.
9. Request: Displays the full details of the SCIM request that was sent, including the HTTP method, headers, and payload. Reviewing this information helps clarify exactly what data was transmitted and how the client interacted with the SCIM API.

Filter

SCIM Audit Logs can be filtered using the following parameters:

1. Start Date: Uses the date picker to choose the earliest date to include. The system returns only entries that occurred on or after this date, defining the beginning of the review period.
2. End Date: Uses the date picker to select the latest date to include. The system returns only entries that occurred on or before this date, capping the review period.
3. HTTP Method: Selects the type of API call to analyze from the HTTP Method dropdown — GET, PUT, POST, PATCH, DELETE, or All. Selecting a specific method focuses the review on particular SCIM operations, such as reads (GET) or updates (PUT/PATCH).
4. Resource Type: Selects the type of SCIM resource the request targeted from the Resource Type dropdown — All, Users, Groups, Me, or Bulk — to focus the review on the entities most relevant to the investigation.
5. Endpoint: Enters the specific API endpoint (for example, /Users or /Groups) in the Endpoint field to narrow the results to SCIM requests that targeted that particular path.
6. Status: Selects whether to view only successful requests, only failed requests, or all requests from the Status dropdown, isolating the SCIM events most relevant to the review.
7. Reset: Clears all selected filter criteria and returns the SCIM Audit Logs view to its default state, allowing a new search to start without previously applied filters.

Once the filter criteria are configured, selecting the Filter button displays only the audit log entries that match the selected parameters.

Frequently Asked Questions

What is the purpose of SCIM Audit Logs?

SCIM Audit Logs capture every SCIM request and record how it was handled by the system, allowing the Workspace Administrator to monitor identity lifecycle events, verify that automated provisioning is working correctly, and troubleshoot integration issues.

How can a specific SCIM request be traced?

Each audit log entry includes a Request ID, a unique reference identifier that can be used to trace a specific transaction across systems or when working with support teams.

What happens if a SCIM request fails?

A failed request appears with a Status of Failed. Selecting the more info (i) icon on that entry displays the associated error message for further detail.

Can SCIM Audit Logs be narrowed to a specific date range?

Yes. The Start Date and End Date filters limit results to entries that occurred on or after the Start Date and on or before the End Date, respectively.

How are previously applied filters cleared?

Selecting the Reset button clears all selected filter criteria and returns the SCIM Audit Logs view to its default state.

Related Articles

• Help Article for SCIM in IdeaScale
• Help Article for Manage Workspace