One document matched: draft-ietf-scim-core-schema-09.xml

<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet type='text/xsl' href='http://xml.resource.org/authoring/rfc2629.xslt' ?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?rfc toc="yes"?>
<?rfc tocompact="yes"?>
<?rfc tocdepth="3"?>
<?rfc tocindent="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="std" docName="draft-ietf-scim-core-schema-09" ipr="trust200902">
  <front>
    <title abbrev="draft-scim-core-schema-09">System for Cross-Domain Identity
    Management: Core Schema</title>

    <author fullname="Kelly Grizzle" initials="K.G." surname="Grizzle">
      <organization abbrev="SailPoint">SailPoint</organization>

      <address>
        <email>kelly.grizzle@sailpoint.com</email>
      </address>
    </author>

    <author fullname="Phil Hunt" initials="P." role="editor" surname="Hunt">
      <organization abbrev="Oracle">Oracle Corporation</organization>

      <address>
        <email>phil.hunt@yahoo.com</email>
      </address>
    </author>

    <author fullname="Erik Wahlstroem" initials="E." surname="Wahlstroem">
      <organization abbrev="Nexus Technology">Nexus Technology</organization>

      <address>
        <email>erik.wahlstrom@nexusgroup.com</email>
      </address>
    </author>

    <author fullname="Chuck Mortimore" initials="C." surname="Mortimore">
      <organization abbrev="Salesforce">Salesforce.com</organization>

      <address>
        <email>cmortimore@salesforce.com</email>
      </address>
    </author>

    <date month="August" year="2014"/>

    <abstract>
      <t>The System for Cross-Domain Identity Management (SCIM) specifications
      are designed to make identity management in cloud based applications and
      services easier. The specification suite builds upon experience with
      existing schemas and deployments, placing specific emphasis on
      simplicity of development and integration, while applying existing
      authentication, authorization, and privacy models. Its intent is to
      reduce the cost and complexity of user management operations by
      providing a common user schema and extension model, as well as binding
      documents to provide patterns for exchanging this schema using HTTP
      protocol. </t>

      <t>This document provides a platform neutral schema and extension model
      for representing users and groups and other resource types in JSON
      format. This schema is intended for exchange and use with cloud service
      providers. </t>
    </abstract>
  </front>

  <middle>
    <section anchor="overview" title="Introduction and Overview">
      <t>While there are existing standards for describing and exchanging user
      information, many of these standards can be difficult to implement
      and/or use; e.g., their wire protocols do not easily traverse firewalls
      and/or are not easily layered onto existing web protocols. As a result,
      many cloud providers implement non-standardized protocols for managing
      users within their services. This increases both the cost and complexity
      associated with organizations adopting products and services from
      multiple cloud providers as they must perform redundant integration
      development. Similarly, cloud services providers seeking to
      inter-operate with multiple application marketplaces or cloud identity
      providers must be redundantly integrated.</t>

      <t>SCIM seeks to simplify this problem through a simple to implement
      specification suite that provides a common user schema and extension
      model, as well as binding documents to provide patterns for exchanging
      this schema via an HTTP based protocol. It draws inspiration and best
      practice, building upon existing user protocols and schemas from a wide
      variety of sources including, but not limited to, existing services
      exposed by cloud providers, PortableContacts, vCards, and LDAP directory
      services.</t>

      <t>This document provides a JSON based schema and extension model for
      representing users and groups, as well as service provider
      configuration. This schema is intended for exchange and use with cloud
      service providers and other cross-domain scenarios. An HTTP
      protocol-binding document is provided separately.</t>

      <section anchor="rnc" title="Requirements Notation and Conventions">
        <t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
        "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
        document are to be interpreted as described in <xref
        target="RFC2119"/>.</t>

        <t>Throughout this document, values are quoted to indicate that they
        are to be taken literally. When using these values in protocol
        messages, the quotes MUST NOT be used as part of the value.</t>
      </section>

      <section anchor="defs" title="Definitions" toc="default">
        <t><list style="hanging">
            <t hangText="Service Provider"><vspace/>An HTTP web application
            that provides identity information via the SCIM protocol.</t>

            <t hangText="Client"><vspace/>A website or application that uses
            the SCIM protocol to manage identity data maintained by the
            service provider. The client initiates SCIM HTTP requests to a
            target service provider.</t>

            <t hangText="Resource"><vspace/>A service provider managed
            artifact containing one or more attributes. For example a <spanx
            style="verb">User</spanx> or <spanx style="verb">Group</spanx>.</t>

            <t hangText="Resource Type"><vspace/>A type of a resource that is
            managed by a service provider. The resource type defines the
            resource name, endpoint URL, Schemas, and other meta-data which
            indicate where a resource is managed and how it is composed; e.g.
            <spanx style="verb">User</spanx> or <spanx style="verb">Group</spanx>.</t>

            <t hangText="Schema"><vspace/>A collection of Attribute
            Definitions that describe the contents of an entire or partial
            resource; e.g. <spanx style="verb">urn:ietf:params:scim:schemas:core:2.0:User</spanx>.</t>

            <t hangText="Singular Attribute"><vspace/>A resource attribute
            that contains 0..1 values; e.g. <spanx style="verb">displayName</spanx>.</t>

            <t hangText="Multi-valued Attribute"><vspace/>A resource attribute
            that contains 0..n values; e.g. <spanx style="verb">emails</spanx>.</t>

            <t hangText="Simple Attribute"><vspace/>A singular or multi-valued
            attribute whose value is a primitive; e.g. <spanx style="verb">String</spanx>.</t>

            <t hangText="Complex Attribute"><vspace/>A singular or
            multi-valued attribute whose value is a composition of one or more
            simple attributes; e.g. <spanx style="verb">addresses</spanx>.</t>

            <t hangText="Sub-Attribute"><vspace/>A simple attribute contained
            within a complex attribute.</t>
          </list></t>
      </section>
    </section>

    <section anchor="schema_structure" title="SCIM Schema Structure">
      <t>SCIM schema provides a minimal core schema for representing users and
      groups (resources), encompassing common attributes found in many
      existing deployments and schemas. In addition to the minimal core
      schema, this document also specifies a standardized means by which
      service providers may extend schema to define new resources and
      attributes in both standardized and service provider specific cases.</t>

      <t>Resources are categorized into common resource types such as <spanx
      style="verb">User</spanx> or <spanx style="verb">Group</spanx>).
      Collections of resources of the same type are usually contained within
      the same "container" ("folder") endpoint.</t>

      <t>A resource is a collection of attributes identified by one or more
      schemas. Minimally, an attribute consists of the attribute name and at
      least one simple or complex value either of which may be multi-valued.
      For each attribute, SCIM schema defines the data type, plurality,
      mutability, and other distinguishing features of an attribute. </t>

      <t>Attribute names SHOULD be camel-cased (e.g. "camelCase"). SCIM
      resources are represented in JSON <xref target="RFC7159"/> and MUST
      specify schema via the <spanx style="verb">schemas</spanx> attribute per
      <xref target="schemas-attribute"/>.</t>

      <t>Attribute names MUST conform to the following ABNF <xref
      target="RFC5234"/> rules: <figure anchor="attrABNF"
          title="ABNF for Attribute Names">
          <artwork align="center">ATTRNAME   = ALPHA *(nameChar)
nameChar   = "-" / "_" / DIGIT / ALPHA</artwork>
        </figure></t>

      <section anchor="attribute-types" title="Attribute Data Types">
        <t>Attribute data types are derived from JSON <xref target="RFC7159"/>
        and unless otherwise specified have the following characteristics (see
        <xref target="schema-schema"/> for attribute characteristic
        definitions): <list style="symbols">
            <t>are optional (is not required).</t>

            <t>are case insensitive (caseExact=false),</t>

            <t>are modifiable (mutability is readWrite),</t>

            <t>are returned in response to queries (returned by default),</t>

            <t>are not unique (uniqueness=none), and,</t>

            <t>of type <xref target="type-string">String</xref>.</t>
          </list> The JSON format defines a limited set of data types, hence,
        where appropriate, alternate JSON representations derived from XML
        Schema <xref target="XML-Schema"/> are defined below. SCIM extensions
        SHOULD NOT introduce new data types.</t>

        <section anchor="type-string" title="String">
          <t>A sequence of zero or more Unicode characters encoded using UTF-8
          as per <xref target="RFC2277"/> and <xref target="RFC3629"/>. The
          JSON format is defined in <xref target="RFC7159">Section 7</xref>. A
          <spanx style="verb">String</spanx> attribute MAY specify a required
          data format. Additionally, when canonical values are specified
          service providers SHOULD conform to those values if appropriate, but
          MAY provide alternate <spanx style="verb">String</spanx> values to
          represent additional values.</t>
        </section>

        <section anchor="type-boolean" title="Boolean">
          <t>The literal <spanx style="verb">true</spanx> or <spanx
          style="verb">false</spanx>. The JSON format is defined in <xref
          target="RFC7159">Section 3</xref>.</t>
        </section>

        <section anchor="type-decimal" title="Decimal">
          <t>A real number with at least one digit to the left and right of
          the period. The JSON format is defined in <xref
          target="RFC7159">Section 6</xref>.</t>
        </section>

        <section anchor="type-integer" title="Integer">
          <t>A decimal number with no fractional digits. The JSON format is
          defined in <xref target="RFC7159">Section 6</xref> with the
          additional constraint that the value MUST NOT contain fractional or
          exponent parts.</t>
        </section>

        <section anchor="type-datetime" title="DateTime">
          <t>A DateTime value (e.g. 2008-01-23T04:56:22Z). The attribute value
          MUST be encoded as a valid xsd:dateTime as specified in <xref
          target="XML-Schema">Section 3.2.7</xref>.</t>

          <t>Values represented in JSON MUST conform to the XML constraints
          above and are represented as a JSON String per <xref
          target="RFC7159">Section 7</xref>.</t>
        </section>

        <section anchor="type-binary" title="Binary">
          <t>Arbitrary binary data. The attribute value MUST be encoded as a
          valid xsd:base64Binary as specified in <xref
          target="XML-Schema">Section 3.2.16</xref>.</t>

          <t>Values represented in JSON MUST conform to the XML constraints
          above and are represented as a JSON String per <xref
          target="RFC7159">Section 2.7</xref>.</t>
        </section>

        <section anchor="type-reference" title="Reference">
          <t>A reference to a SCIM resource. The value MUST be the absolute or
          relative URI of the target resource. Relative URIs should be
          resolved as specified in <xref target="RFC3986">Section 5.2</xref>.
          The base URI for relative URI resolution MUST include all URI
          components and path segments up to but not including the Endpoint
          URI; e.g., the base URI for a request to <spanx style="verb">https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646</spanx>
          would be <spanx style="verb">https://example.com/v2/</spanx> and the
          relative URI for this resource would be <spanx style="verb">Users/2819c223-7f76-453a-919d-413861904646</spanx>.</t>

          <t>Performing a GET operation on a reference URI MUST return the
          target resource or an appropriate HTTP response code. The service
          provider MAY optionally choose to enforce referential integrity for
          references.</t>

          <t>By convention, a reference is commonly represented as a <spanx
          style="verb">$ref</spanx> sub-attribute in complex or multi-valued
          attributes, however this is OPTIONAL.</t>
        </section>

        <section anchor="type-complex" title="Complex">
          <t>A singular or multi-valued attribute whose value is a composition
          of one or more simple Attributes. The JSON format is defined in
          <xref target="RFC7159">Section 4</xref>.</t>
        </section>
      </section>

      <section anchor="multi-value-types" title="Multi-valued Attributes">
        <t>Multi-valued attributes contain a list of value or may contain
        sub-attributes and MAY also be considered complex attributes. The
        order of values returned by the server MAY NOT be guaranteed. The
        sub-attributes below are considered normative and when specified
        SHOULD be used as defined.</t>

        <t><list style="hanging">
            <t hangText="type">A label indicating the attribute's function;
            e.g., <spanx style="verb">work</spanx> or <spanx style="verb">home</spanx>.</t>

            <t hangText="primary">A Boolean value indicating the 'primary' or
            preferred attribute value for this attribute, e.g. the preferred
            mailing address or the primary e-mail address. The primary
            attribute value <spanx style="verb">true</spanx> MUST appear no
            more than once.</t>

            <t hangText="display">A human readable name, primarily used for
            display purposes and has a mutability of <spanx style="verb">immutable</spanx>.</t>

            <t hangText="value">The attribute's significant value; e.g., the
            e-mail address, phone number, etc.</t>

            <t hangText="$ref">The reference URI of the target resource, if
            the attribute is a reference.</t>
          </list></t>

        <t>When returning multi-valued attributes, service providers SHOULD
        canonicalize the value returned, if appropriate (e.g. for e-mail
        addresses and URLs). Service providers MAY return the same value more
        than once with different types (e.g. the same e-mail address may used
        for work and home), but SHOULD NOT return the same (type, value)
        combination more than once per Attribute, as this complicates
        processing by the Consumer.</t>
      </section>

      <section anchor="unassigned" title="Unassigned and Null Values">
        <t>Unassigned attributes, the null value, or empty array (in the case
        of a multi-valued attribute) SHALL be considered to be equivalent in
        "state". Assigning an attribute with the value <spanx style="verb">null</spanx>
        or an empty array (in the case of multi-valued attributes) has the
        effect of making the attribute "unassigned". When a resource is
        expressed in JSON form, unassigned attributes, though they are defined
        in schema, MAY be omitted for compactness.</t>
      </section>
    </section>

    <section title="Schema Extension Model">
      <t>SCIM supports two types of extensions: Resource Types and Attribute
      extensions. New resources allow new objects to be defined, while
      attribute extensions allow for new classes of attributes to be added to
      an existing resource type. For example, the enterprise user extension
      defines additional attributes for a <spanx style="verb">User</spanx>
      resource type.</t>

      <section title="Resource Type Extensions">
        <t>Each resource type supported by a SCIM service provider defines the
        types name, endpoint, base schema (the attributes), and any schema
        extensions registered for use with the resource type. In order to
        offer new types of resources, a service provider defines the new
        resource type as specified in <xref
        target="resource-type-schema"/>.</t>
      </section>

      <section title="Attribute Extensions">
        <t>SCIM allows resource types to have extensions in addition to their
        core schema. This is similar to how <spanx style="verb">ObjectClasses</spanx>
        used in LDAP. However, unlike LDAP there is no inheritance model; all
        extensions are additive (similar to LDAP Auxiliary Object Class <xref
        target="RFC4512"/> ). Each <spanx style="verb">schemas</spanx> value
        indicates additive schema that may exist in a SCIM resource
        representation. The <spanx style="verb">schemas</spanx> attribute MUST
        contain at least one value which SHALL be the base schema for the
        resource. The <spanx style="verb">schemas</spanx> attribute MAY
        contain additional values indicating extended schemas that are in use.
        Schema extensions SHOULD avoid redefining any attributes defined in
        this specification and SHOULD follow conventions defined in this
        specification. Except for the base object schema, the schema extension
        URI SHALL be used as a JSON container to distinguish attributes
        belonging to the extension namespace from base schema attributes. See
        <xref target="enterpriseUserJSON"/> for an example JSON representation
        of an extended User.</t>

        <t>In order to determine which <spanx style="verb">schemas</spanx> URI
        value is the base schema and which is extended schema for any given
        resource, the resource's <spanx style="verb">resourceType</spanx>
        attribute value MAY be used to retrieve the resource's <spanx
        style="verb">ResourceType</spanx> schema ( <xref
        target="resource-type-schema"/> ). See example <spanx style="verb">ResourceType</spanx>
        representation in <xref target="resourceTypeJSON"/>.</t>
      </section>
    </section>

    <section anchor="schema" title="SCIM Core Schema">
      <section anchor="commonSchema" title="Common Schema Attributes">
        <t>Each SCIM resource (Users, Groups, etc.) includes the following
        common attributes. With the exception of <spanx style="verb">ServiceProviderConfig</spanx>
        and <spanx style="verb">ResourceType</spanx> server discovery
        endpoints and their associated resources, these attributes MUST be
        included in all resources, including any extended resource types.
        Common attributes are considered to be part of every base resource
        schema and do not use their own schemas URI and SHALL not be
        considered schema extensions.</t>

        <t><list style="hanging">
            <t hangText="id"><vspace/>A unique identifier for a SCIM resource
            as defined by the service provider. Each representation of the
            resource MUST include a non-empty <spanx style="verb">id</spanx>
            value. This identifier MUST be unique across the SCIM service
            provider's entire set of resources. It MUST be a stable,
            non-reassignable identifier that does not change when the same
            resource is returned in subsequent requests. The value of the
            <spanx style="verb">id</spanx> attribute is always issued by the
            service provider and MUST NOT be specified by the client. The
            string <spanx style="verb">bulkId</spanx> is a reserved keyword
            and MUST NOT be used within any unique identifier value. REQUIRED
            and has a mutability of <spanx style="verb">readOnly</spanx>.</t>

            <t hangText="externalId"><vspace/>An identifier for the resource
            as defined by the client. The <spanx style="verb">externalId</spanx>
            may simplify identification of the resource between client and
            service provider by allowing the client to use a filter to locate
            the resource with its own identifier, obviating the need to store
            a local mapping between the local identifier of the resource and
            the identifier used by the service provider. Each resource MAY
            include a non-empty <spanx style="verb">externalId</spanx> value.
            The value of the <spanx style="verb">externalId</spanx> attribute
            is always issued by the client and can never be specified by the
            service provider. The service provider MUST always interpret the
            externalId as scoped to the client's tenant.</t>

            <t hangText="meta"><vspace/>A complex attribute containing
            resource metadata. All sub-attributes are OPTIONAL <list
                style="hanging">
                <t hangText="resourceType">The name of the resource type of
                the resource. This attribute has mutability of <spanx
                style="verb">readOnly</spanx>.</t>

                <t hangText="created">The DateTime the resource was added to
                the service provider. The attribute MUST be a DateTime. This
                attribute has mutability of <spanx style="verb">readOnly</spanx>.</t>

                <t hangText="lastModified">The most recent DateTime the
                details of this resource were updated at the service provider.
                If this resource has never been modified since its initial
                creation, the value MUST be the same as the value of created.
                The attribute MUST be a DateTime and has mutability of <spanx
                style="verb">readOnly</spanx>.</t>

                <t hangText="location">The URI of the resource being returned.
                This value MUST be the same as the Location HTTP response
                header. The attribute has mutability of <spanx style="verb">readOnly</spanx>.</t>

                <t hangText="version">The version of the resource being
                returned. This value must be the same as the ETag HTTP
                response header. The attribute has mutability of <spanx
                style="verb">readOnly</spanx>.</t>
              </list></t>
          </list></t>
      </section>

      <section anchor="schemas-attribute"
               title=""schemas" Attribute">
        <t>The <spanx style="verb">schemas</spanx> attribute is a REQUIRED
        attribute and is an array of Strings containing URIs which are used to
        indicate the namespace of SCIM schema as well as any schema extensions
        that together defines the attributes in a resource. Each String value
        must be a unique URI. All representations of SCIM schema MUST include
        a non-zero value array with value(s) of the URIs supported by that
        representation. The schemas attribute for a resource MUST only contain
        values defined as <spanx style="verb">schema</spanx> and <spanx
        style="verb">schemaExtensions</spanx> for the resource's <spanx
        style="verb">resourceType</spanx>. Duplicate values MUST NOT be
        included. Value order is not specified and MUST not impact
        behavior.</t>
      </section>
    </section>

    <section anchor="user-resource" title="SCIM User Schema">
      <t>SCIM provides a resource type for <spanx style="verb">User</spanx>
      resources. The core schema for <spanx style="verb">User</spanx> is
      identified using the URI: <spanx style="verb">urn:ietf:params:scim:schemas:core:2.0:User</spanx>.
      The following attributes are defined in addition to the core schema
      attributes:</t>

      <section title="Singular Attributes">
        <t><list style="hanging">
            <t hangText="userName"><vspace/>A service provider unique
            identifier for the user, typically used by the user to directly
            authenticate to the service provider. Often displayed to the user
            as their unique identifier within the system (as opposed to id or
            externalId, which are generally opaque and not user-friendly
            identifiers). Each User MUST include a non-empty userName value.
            This identifier MUST be unique across the service provider's
            entire set of Users. RECOMMENDED.</t>

            <t hangText="name"><vspace/>The components of the user's real
            name. Service providers MAY return just the full name as a single
            string in the formatted sub-attribute, or they MAY return just the
            individual component attributes using the other sub-attributes, or
            they MAY return both. If both variants are returned, they SHOULD
            be describing the same name, with the formatted name indicating
            how the component attributes should be combined. <list
                style="hanging">
                <t hangText="formatted">The full name, including all middle
                names, titles, and suffixes as appropriate, formatted for
                display (e.g. <spanx style="verb">Ms. Barbara Jane Jensen, III.</spanx>
                ).</t>

                <t hangText="familyName">The family name of the User, or last
                name in most Western languages (e.g. <spanx style="verb">Jensen</spanx>
                given the full name <spanx style="verb">Ms. Barbara Jane Jensen, III.</spanx>
                ).</t>

                <t hangText="givenName">The given name of the User, or first
                name in most Western languages (e.g. <spanx style="verb">Barbara</spanx>
                given the full name <spanx style="verb">Ms. Barbara Jane Jensen, III.</spanx>
                ).</t>

                <t hangText="middleName">The middle name(s) of the User (e.g.
                <spanx style="verb">Jane</spanx> given the full name <spanx
                style="verb">Ms. Barbara Jane Jensen, III.</spanx> ).</t>

                <t hangText="honorificPrefix">The honorific prefix(es) of the
                User, or title in most Western languages (e.g. <spanx
                style="verb">Ms.</spanx> given the full name <spanx
                style="verb">Ms. Barbara Jane Jensen, III.</spanx> ).</t>

                <t hangText="honorificSuffix">The honorific suffix(es) of the
                User, or suffix in most Western languages (e.g. <spanx
                style="verb">III.</spanx> given the full name <spanx
                style="verb">Ms. Barbara Jane Jensen, III.</spanx> ).</t>
              </list></t>

            <t hangText="displayName"><vspace/>The name of the user, suitable
            for display to end-users. Each user returned MAY include a
            non-empty displayName value. The name SHOULD be the full name of
            the User being described if known (e.g. <spanx style="verb">Babs Jensen</spanx>
            or <spanx style="verb">Ms. Barbara J Jensen, III</spanx> ), but
            MAY be a username or handle, if that is all that is available
            (e.g. <spanx style="verb">bjensen</spanx> ). The value provided
            SHOULD be the primary textual label by which this User is normally
            displayed by the service provider when presenting it to
            end-users.</t>

            <t hangText="nickName"><vspace/>The casual way to address the user
            in real life, e.g. <spanx style="verb">Bob</spanx> or <spanx
            style="verb">Bobby</spanx> instead of <spanx style="verb">Robert</spanx>.
            This attribute SHOULD NOT be used to represent a User's username
            (e.g. bjensen or mpepperidge).</t>

            <t hangText="profileUrl"><vspace/>A fully qualified URL to a page
            representing the user's online profile.</t>

            <t hangText="title"><vspace/>The user’s title, such as <spanx
            style="verb">Vice President</spanx>.</t>

            <t hangText="userType"><vspace/>Used to identify the organization
            to user relationship. Typical values used might be <spanx
            style="verb">Contractor</spanx>, <spanx style="verb">Employee</spanx>,
            <spanx style="verb">Intern</spanx>, <spanx style="verb">Temp</spanx>,
            <spanx style="verb">External</spanx>, and <spanx style="verb">Unknown</spanx>
            but any value may be used.</t>

            <t anchor="preferredLanguage"
            hangText="preferredLanguage"><vspace/>Indicates the user's
            preferred written or spoken languages and is generally used for
            selecting a localized User interface. The value indicates the set
            of natural languages that are preferred. The format of the value
            is same as the Accept-Language header field (not including
            "Accept-Language:") of HTTP and is specified in <xref
            target="RFC7231">Section 5.3.5 of</xref>. The intent of this value
            is to enable cloud applications to perform matching of language
            tags <xref target="RFC4647"/> to the user's language preferences
            regardless of what may be indicated by a user agent (which might
            be shared), or in a non-user present interaction (such as in a
            delegated OAuth2 <xref target="RFC6749"/> style interaction) where
            normal HTTP Accept-Language header negotiation cannot take
            place.</t>

            <t hangText="locale"><vspace/>Used to indicate the User's default
            location for purposes of localizing items such as currency, date
            time format, numerical representations, etc. A valid value is a
            language tag as defined in <xref target="RFC5646"/>. Computer
            languages are explicitly excluded.</t>

            <t>A language tag is a sequence of one or more case-insensitive
            sub-tags, each separated by a hyphen character ("-", %x2D). For
            backwards compatibility reasons, servers MAY accept tags separated
            by an underscore character ("_", %5F). In most cases, a language
            tag consists of a primary language sub-tag that identifies a broad
            family of related languages (e.g., "en" = English) which is
            optionally followed by a series of sub-tags that refine or narrow
            that language's range (e.g., "en-CA" = the variety of English as
            communicated in Canada). Whitespace is not allowed within a
            language tag. Example tags include: <figure align="center">
                <artwork align="center">fr, en-US, es-419, az-Arab, x-pig-latin, man-Nkoo-GN</artwork>
              </figure> See <xref target="RFC5646"/> for further
            information.</t>

            <t hangText="timezone"><vspace/>The User's time zone in IANA Time
            Zone database format <xref target="RFC6557"/>, also known as
            "Olson" timezone database format <xref target="Olson-TZ"/> ; For
            example: <spanx style="verb">America/Los_Angeles</spanx>.</t>

            <t hangText="active"><vspace/>A Boolean value indicating the
            user's administrative status. The definitive meaning of this
            attribute is determined by the service provider. As a typical
            example, a value of true infers the user is able to login while a
            value of false implies the user's account has been suspended.</t>

            <t hangText="password"><vspace/>The user's clear text password.
            This attribute is intended to be used as a means to specify an
            initial password when creating a new User or to reset an existing
            User's password. Password policies and the ability to update or
            set passwords are out of scope of this document. The mutability of
            this attribute is <spanx style="verb">writeOnly</spanx> indicating
            the value MUST NOT be returned by a service provider in any
            form.</t>
          </list></t>
      </section>

      <section title="Multi-valued Attributes">
        <t>The following multi-valued attributes are defined.</t>

        <t><list style="hanging">
            <t hangText="emails"><vspace/>E-mail addresses for the User. The
            value SHOULD be canonicalized by the service provider, e.g. <spanx
            style="verb">bjensen@example.com</spanx> instead of <spanx
            style="verb">bjensen@EXAMPLE.COM</spanx>. Canonical type values of
            <spanx style="verb">work</spanx>, <spanx style="verb">home</spanx>,
            and <spanx style="verb">other</spanx>.</t>

            <t hangText="phoneNumbers"><vspace/>Phone numbers for the user.
            The value SHOULD be canonicalized by the service provider
            according to format in <xref target="RFC3966"/> e.g.
            'tel:+1-201-555-0123'. Canonical type values of <spanx
            style="verb">work</spanx>, <spanx style="verb">home</spanx>,
            <spanx style="verb">mobile</spanx>, <spanx style="verb">fax</spanx>,
            <spanx style="verb">pager</spanx>, and <spanx style="verb">other</spanx>.</t>

            <t hangText="ims"><vspace/>Instant messaging address for the user.
            No official canonicalization rules exist for all instant messaging
            addresses, but service providers SHOULD, when appropriate, remove
            all whitespace and convert the address to lowercase. Instead of
            the standard canonical values for type, this attribute defines the
            following canonical values to represent currently popular IM
            services: <spanx style="verb">aim</spanx>, <spanx style="verb">gtalk</spanx>,
            <spanx style="verb">icq</spanx>, <spanx style="verb">xmpp</spanx>,
            <spanx style="verb">msn</spanx>, <spanx style="verb">skype</spanx>,
            <spanx style="verb">qq</spanx>, <spanx style="verb">yahoo</spanx>,
            and <spanx style="verb">other</spanx>.</t>

            <t hangText="photos"><vspace/>URL of a photo of the User. The
            value SHOULD be a canonicalized URL, and MUST point to an image
            file (e.g. a GIF, JPEG, or PNG image file) rather than to a web
            page containing an image. Service providers MAY return the same
            image at different sizes, though it is recognized that no standard
            for describing images of various sizes currently exists. Note that
            this attribute SHOULD NOT be used to send down arbitrary photos
            taken by this user, but specifically profile photos of the user
            suitable for display when describing the user. Instead of the
            standard canonical values for type, this attribute defines the
            following canonical values to represent popular photo sizes:
            <spanx style="verb">photo</spanx>, <spanx style="verb">thumbnail</spanx>.</t>

            <t hangText="addresses"><vspace/>A physical mailing address for
            this user. Canonical type values of <spanx style="verb">work</spanx>,
            <spanx style="verb">home</spanx>, and <spanx style="verb">other</spanx>.
            The value attribute is a complex type with the following
            sub-attributes. All sub-attributes are OPTIONAL. <list
                style="hanging">
                <t hangText="formatted">The full mailing address, formatted
                for display or use with a mailing label. This attribute MAY
                contain newlines.</t>

                <t hangText="streetAddress">The full street address component,
                which may include house number, street name, P.O. box, and
                multi-line extended street address information. This attribute
                MAY contain newlines.</t>

                <t hangText="locality">The city or locality component.</t>

                <t hangText="region">The state or region component.</t>

                <t hangText="postalCode">The zipcode or postal code
                component.</t>

                <t hangText="country">The country name component. When
                specified the value MUST be in ISO 3166-1 alpha 2 "short" code
                format <xref target="ISO3166"> </xref> ; e.g., the United
                States and Sweden are <spanx style="verb">US</spanx> and
                <spanx style="verb">SE</spanx>, respectively.</t>
              </list></t>

            <t hangText="groups"><vspace/>A list of groups that the user
            belongs to, either thorough direct membership, nested groups, or
            dynamically calculated. The values are meant to enable expression
            of common group or role based access control models, although no
            explicit authorization model is defined. It is intended that the
            semantics of group membership and any behavior or authorization
            granted as a result of membership are defined by the service
            provider. The canonical types <spanx style="verb">direct</spanx>
            and <spanx style="verb">indirect</spanx> are defined to describe
            how the group membership was derived. Direct group membership
            indicates the user is directly associated with the group and
            SHOULD indicate that clients may modify membership through the
            <spanx style="verb">Group</spanx> resource. Indirect membership
            indicates user membership is transitive or dynamic and implies
            that clients cannot modify indirect group membership through the
            <spanx style="verb">Group</spanx> resource but MAY modify direct
            group membership through the <spanx style="verb">Group</spanx>
            resource which MAY influence indirect memberships. If the SCIM
            service provider exposes a Group resource, the <spanx
            style="verb">value</spanx> sub-attribute MUST be the <spanx
            style="verb">id</spanx> and the <spanx style="verb">$ref</spanx>
            sub-attribute must be the URI of the corresponding <spanx
            style="verb">Group</spanx> resources to which the user belongs.
            Since this attribute has a mutability of <spanx style="verb">readOnly</spanx>,
            group membership changes MUST be applied via the <xref
            target="group-resource">Group Resource</xref>. The attribute has a
            mutability of <spanx style="verb">readOnly</spanx>.</t>

            <t hangText="entitlements"><vspace/>A list of entitlements for the
            user that represent a thing the user has. An entitlement MAY be an
            additional right to a thing, object, or service. No vocabulary or
            syntax is specified and service providers and clients are expected
            to encode sufficient information in the value so as to accurately
            and without ambiguity determine what the user has access to. This
            value has NO canonical types though type may be useful as a means
            to scope entitlements.</t>

            <t hangText="roles"><vspace/>A list of roles for the user that
            collectively represent who the user is; e.g., <spanx style="verb">Student, Faculty</spanx>.
            No vocabulary or syntax is specified though it is expected that a
            role value is a String or label representing a collection of
            entitlements. This value has NO canonical types.</t>

            <t hangText="x509Certificates"><vspace/>A list of certificates
            issued to the User. Values are <xref
            target="type-binary">Binary</xref> and DER encoded x509. This
            value has NO canonical types.</t>
          </list></t>
      </section>
    </section>

    <section anchor="enterpriseUser"
             title="SCIM Enterprise User Schema Extension">
      <t>The following SCIM extension defines attributes commonly used in
      representing users that belong to, or act on behalf of a business or
      enterprise. The enterprise user extension is identified using the
      following schema URI: <spanx style="verb">urn:ietf:params:scim:schemas:extension:enterprise:2.0:User</spanx>.</t>

      <t>The following Singular Attributes are defined:</t>

      <t><list style="hanging">
          <t hangText="employeeNumber"><vspace/>Numeric or alphanumeric
          identifier assigned to a person, typically based on order of hire or
          association with an organization.</t>

          <t hangText="costCenter"><vspace/>Identifies the name of a cost
          center.</t>

          <t hangText="organization"><vspace/>Identifies the name of an
          organization.</t>

          <t hangText="division"><vspace/>Identifies the name of a
          division.</t>

          <t hangText="department"><vspace/>Identifies the name of a
          department.</t>

          <t hangText="manager"><vspace/>The user's manager. A complex type
          that optionally allows service providers to represent organizational
          hierarchy by referencing the <spanx style="verb">id</spanx>
          attribute of another User. <list style="hanging">
              <t hangText="value">The <spanx style="verb">id</spanx> of the
              SCIM resource representing the user's manager. RECOMMENDED.</t>

              <t hangText="$ref">The URI of the SCIM resource representing the
              User's manager. RECOMMENDED.</t>

              <t hangText="displayName">The displayName of the user's manager.
              This attribute is OPTIONAL and mutability is <spanx
              style="verb">readOnly</spanx>.</t>
            </list></t>
        </list></t>
    </section>

    <section anchor="group-resource" title="SCIM Group Schema">
      <t>SCIM provides a schema for representing groups, identified using the
      following schema URI: <spanx style="verb">urn:ietf:params:scim:schemas:core:2.0:Group</spanx>.</t>

      <t>Group resources are meant to enable expression of common group or
      role based access control models, although no explicit authorization
      model is defined. It is intended that the semantics of group membership
      and any behavior or authorization granted as a result of membership are
      defined by the service provider are considered out of scope for this
      specification.</t>

      <t>The following singular attribute is defined in addition to the common
      attributes defined in SCIM core schema: <list style="hanging">
          <t hangText="displayName"><vspace/>A human readable name for the
          Group. REQUIRED.</t>
        </list></t>

      <t>The following multi-valued attribute is defined in addition to the
      common attributes defined in SCIM Core Schema: <list style="hanging">
          <t hangText="members"><vspace/>A list of members of the Group. While
          values MAY be added or removed, sub-attributes of members are <spanx
          style="verb">immutable</spanx>. The <spanx style="verb">value</spanx>
          sub-attribute must be the <spanx style="verb">id</spanx> and the
          <spanx style="verb">$ref</spanx> sub-attribute must be the URI of a
          SCIM resource, either a <spanx style="verb">User</spanx>, or a
          <spanx style="verb">Group</spanx>. The intention of the <spanx
          style="verb">Group</spanx> type is to allow the service provider to
          support nested groups. Service providers MAY require clients to
          provide a non-empty members value based on the <spanx style="verb">required</spanx>
          sub attribute of the <spanx style="verb">members</spanx> attribute
          in the <spanx style="verb">Group</spanx> resource schema.</t>
        </list></t>
    </section>

    <section anchor="serviceProviderConfig"
             title="Service Provider Configuration Schema">
      <t>SCIM provides a schema for representing the service provider's
      configuration identified using the following schema URI: <spanx
      style="verb">urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig</spanx></t>

      <t>The service provider configuration resource enables a service
      provider to discovery of SCIM specification features in a standardized
      form as well as provide additional implementation details to clients.
      All attributes are READ-ONLY (a mutability of <spanx style="verb">readOnly</spanx>
      ). Unlike other core resources, the <spanx style="verb">id</spanx>
      attribute is not required for the service provider configuration
      resource.</t>

      <t>The following Singular Attributes are defined in addition to the
      common attributes defined in Core Schema: <list style="hanging">
          <t hangText="documentationUrl"><vspace/>An HTTP addressable URL
          pointing to the service provider's human consumable help
          documentation.</t>

          <t hangText="patch"><vspace/>A complex type that specifies PATCH
          configuration options. REQUIRED. <list style="hanging">
              <t hangText="supported">Boolean value specifying whether the
              operation is supported. REQUIRED.</t>
            </list></t>

          <t hangText="bulk"><vspace/>A complex type that specifies BULK
          configuration options. REQUIRED <list style="hanging">
              <t hangText="supported">Boolean value specifying whether the
              operation is supported. REQUIRED.</t>
            </list> <list style="hanging">
              <t hangText="maxOperations">An integer value specifying the
              maximum number of operations. REQUIRED.</t>
            </list> <list style="hanging">
              <t hangText="maxPayloadSize">An integer value specifying the
              maximum payload size in bytes. REQUIRED.</t>
            </list></t>

          <t hangText="filter"><vspace/>A complex type that specifies FILTER
          options. REQUIRED. <list style="hanging">
              <t hangText="supported">Boolean value specifying whether the
              operation is supported. REQUIRED.</t>

              <t hangText="maxResults">Integer value specifying the maximum
              number of resources returned in a response. REQUIRED.</t>
            </list></t>

          <t hangText="changePassword"><vspace/>A complex type that specifies
          Change Password configuration options. REQUIRED. <list
              style="hanging">
              <t hangText="supported">Boolean value specifying whether the
              operation is supported. REQUIRED.</t>
            </list></t>

          <t hangText="sort"><vspace/>A complex type that specifies Sort
          configuration options. REQUIRED. <list style="hanging">
              <t hangText="supported">Boolean value specifying whether sorting
              is supported. REQUIRED.</t>
            </list></t>

          <t hangText="etag"><vspace/>A complex type that specifies Etag
          configuration options. REQUIRED. <list style="hanging">
              <t hangText="supported">Boolean value specifying whether the
              operation is supported. REQUIRED.</t>
            </list></t>
        </list></t>

      <t>The following multi-valued attribute is defined in addition to the
      common attributes defined in core schema: <list style="hanging">
          <t hangText="authenticationSchemes"><vspace/>A complex type that
          specifies supported Authentication Scheme properties. This attribute
          defines the following canonical values to represent common schemes:
          <spanx style="verb">oauth</spanx>, <spanx style="verb">oauth2</spanx>,
          <spanx style="verb">oauthbearertoken</spanx>, <spanx style="verb">httpbasic</spanx>,
          and <spanx style="verb">httpdigest</spanx>. To enable seamless
          discovery of configuration, the service provider SHOULD, with the
          appropriate security considerations, make the authenticationSchemes
          attribute publicly accessible without prior authentication.
          REQUIRED. <list style="hanging">
              <t hangText="name">The common authentication scheme name; e.g.,
              HTTP Basic. REQUIRED.</t>

              <t hangText="description">A description of the Authentication
              Scheme. REQUIRED.</t>

              <t hangText="specUrl">A HTTP addressable URL pointing to the
              Authentication Scheme's specification. OPTIONAL.</t>

              <t hangText="documentationUrl">A HTTP addressable URL pointing
              to the Authentication Scheme's usage documentation.
              OPTIONAL.</t>
            </list></t>
        </list></t>
    </section>

    <section anchor="resource-type-schema" title="ResourceType Schema">
      <t>The <spanx style="verb">ResourceType</spanx> schema specifies the
      meta-data about a resource type. Resource type resources are READ-ONLY
      and identified using the following schema URI: <spanx style="verb">urn:ietf:params:scim:schemas:core:2.0:ResourceType</spanx>.
      Unlike other core resources, all attributes are REQUIRED unless
      otherwise specified. The <spanx style="verb">id</spanx> attribute is not
      required for the resource type resource.</t>

      <t>The following Singular Attributes are defined: <list style="hanging">
          <t hangText="id"><vspace/>The resource type's server unique id.
          Often this is the same value as the <spanx style="verb">name</spanx>
          attribute. OPTIONAL</t>

          <t hangText="name"><vspace/>The resource type name. When applicable
          service providers MUST specify the name specified in the core schema
          specification; e.g., <spanx style="verb">User</spanx> or <spanx
          style="verb">Group</spanx>. This name is referenced by the <spanx
          style="verb">meta.resourceType</spanx> attribute in all
          resources.</t>

          <t hangText="description"><vspace/>The resource type's human
          readable description. When applicable service providers MUST specify
          the description specified in the core schema specification.</t>

          <t hangText="endpoint"><vspace/>The resource type's HTTP addressable
          endpoint relative to the Base URL; e.g., <spanx style="verb">/Users</spanx>.</t>

          <t hangText="schema"><vspace/>The resource type's primary/base
          schema URI; e.g., <spanx style="verb">urn:ietf:params:scim:schemas:core:2.0:User</spanx>.
          This MUST be equal to the <spanx style="verb">id</spanx> attribute
          of the associated <spanx style="verb">Schema</spanx> resource.</t>

          <t hangText="schemaExtensions"><vspace/>A list of URIs of the
          resource type's schema extensions. OPTIONAL. <list style="hanging">
              <t hangText="schema">The URI of an extended schema; e.g., <spanx
              style="verb">urn:edu:2.0:Staff</spanx>. This MUST be equal to
              the <spanx style="verb">id</spanx> attribute of a <spanx
              style="verb">Schema</spanx> resource. REQUIRED.</t>

              <t hangText="required">A Boolean value that specifies whether
              the schema extension is required for the resource type. If true,
              a resource of this type MUST include this schema extension and
              include any attributes declared as required in this schema
              extension. If false, a resource of this type MAY omit this
              schema extension. REQUIRED.</t>
            </list></t>
        </list></t>
    </section>

    <section anchor="schema-schema" title="Schema Schema">
      <t>The <spanx style="verb">Schema</spanx> schema specifies the
      attribute(s) and meta-data that constitute a <spanx style="verb">Schema</spanx>
      resource. Schema resources have mutability of <spanx style="verb">readOnly</spanx>
      and identified using the following URI: <figure>
          <artwork>urn:ietf:params:scim:schemas:core:2.0:Schema</artwork>
        </figure>Unlike other core resources the <spanx style="verb">Schema</spanx>
      resource MAY contain a complex object within a sub-attribute and all
      attributes are REQUIRED unless otherwise specified.</t>

      <t>The following Singular Attributes are defined: <list style="hanging">
          <t hangText="id">The unique URI of the schema. When applicable
          service providers MUST specify the URI specified in the core schema
          specification; e.g., <spanx style="verb">urn:ietf:params:scim:schemas:core:2.0:User</spanx>.
          Unlike most other schemas, which use some sort of a GUID for the
          <spanx style="verb">id</spanx>, the schema <spanx style="verb">id</spanx>
          is a URI so that it can be registered and is portable between
          different service providers and clients.</t>

          <t hangText="name">The schema's human readable name. When applicable
          service providers MUST specify the name specified in the core schema
          specification; e.g., <spanx style="verb">User</spanx> or <spanx
          style="verb">Group</spanx>. OPTIONAL.</t>

          <t hangText="description">The schema's human readable description.
          When applicable service providers MUST specify the description
          specified in the core schema specification. OPTIONAL.</t>
        </list></t>

      <t>The following multi-valued attribute is defined: <list
          style="hanging">
          <t hangText="attributes"><vspace/>A complex type with the following
          set of sub-attributes that defines service provider attributes and
          their qualities: <list style="hanging">
              <t hangText="name">The attribute's name.</t>

              <t hangText="type">The attribute's data type; e.g., <spanx
              style="verb">String</spanx>.</t>

              <t hangText="multiValued">Boolean value indicating the
              attribute's plurality.</t>

              <t hangText="description">The attribute's human readable
              description. When applicable service providers MUST specify the
              description specified in the core schema specification.</t>

              <t hangText="required">A Boolean value that specifies if the
              attribute is required.</t>

              <t hangText="canonicalValues">A collection of canonical values.
              When applicable service providers MUST specify the canonical
              types specified in the core schema specification; e.g., <spanx
              style="verb">work</spanx>, <spanx style="verb">home</spanx>.
              OPTIONAL.</t>

              <t hangText="caseExact">A Boolean value that specifies if the
              String attribute is case sensitive. The server SHALL use case
              sensitivity when evaluating filters. For attributes that are
              case exact, the server SHALL preserve case for any value
              submitted. If the attribute is case insensitive, the server MAY
              alter case for a submitted value.</t>

              <t hangText="mutability">A single keyword indicating what types
              of modifications an attribute MAY accept as follows: <list
                  style="hanging">
                  <t hangText="readOnly">The attribute SHALL NOT be
                  modified.</t>

                  <t hangText="readWrite">The attribute MAY be updated and
                  read at any time. DEFAULT.</t>

                  <t hangText="immutable">The attribute MAY be defined at
                  resource creation (e.g. POST) or at record replacement via
                  request (e.g. a PUT). The attribute SHALL NOT be
                  updated.</t>

                  <t hangText="writeOnly">The attribute MAY be updated at any
                  time. Attribute values SHALL NOT be returned (e.g. because
                  the value is a stored hash). Note: an attribute with
                  mutability of <spanx style="verb">writeOnly</spanx> usually
                  also has a returned setting of <spanx style="verb">never</spanx>.</t>
                </list></t>

              <t hangText="returned">A single keyword that indicates when an
              attribute and associated values are returned in response to a
              GET request or in response to a PUT, POST, or PATCH request.
              Valid keywords are: <list style="hanging">
                  <t hangText="always">The attribute is always returned
                  regardless of the contents of the <spanx style="verb">attributes</spanx>
                  parameter. For example, <spanx style="verb">id</spanx> is
                  always returned to identify a SCIM resource.</t>

                  <t hangText="never">The attribute is never returned. This
                  may occur because the original attribute value is not
                  retained by the service provider (e.g. such as with a hashed
                  value). A service provider MAY allow attributes to be used
                  in a search filter.</t>

                  <t hangText="default">The attribute is returned by default
                  in all SCIM operation responses where attribute values are
                  returned. If the GET request <spanx style="verb">attributes</spanx>
                  parameter is specified, attribute values are only returned
                  if the attribute is named in the attributes parameter.
                  DEFAULT.</t>

                  <t hangText="request">The attribute is returned in response
                  to any PUT, POST, or PATCH operations if the attribute was
                  specified by the client (for example, the attribute was
                  modified). The attribute is returned in a SCIM query
                  operation only if specified in the <spanx style="verb">attributes</spanx>
                  parameter.</t>
                </list></t>

              <t hangText="uniqueness">A single keyword value that specifies
              how the service provider enforces uniqueness of attribute
              values. A server MAY reject an invalid value based on uniqueness
              by returning HTTP Response code 400 (Bad Request). A client MAY
              enforce uniqueness on the client-side to a greater degree than
              the service provider enforces. For example, a client could make
              a value unique while the server has uniqueness of <spanx
              style="verb">none</spanx>. Valid keywords are: <list
                  style="hanging">
                  <t hangText="none">The values are not intended to be unique
                  in any way. DEFAULT.</t>

                  <t hangText="server">The value SHOULD be unique within the
                  context of the current SCIM endpoint (or tenancy) but MAY
                  not be globally unique (e.g. a <spanx style="verb">username</spanx>,
                  email address, or other server generated key or counter). No
                  two resources on the same server SHOULD possess the same
                  value.</t>

                  <t hangText="global">The value SHOULD be globally unique
                  (e.g. an email address, a GUID, or other value). No two
                  resources on any server SHOULD possess the same value.</t>
                </list></t>

              <t hangText="referenceTypes">The names of the resource types
              that may be referenced; e.g., <spanx style="verb">User</spanx>.
              This is only applicable for attributes that are of the <spanx
              style="verb">reference</spanx> <xref target="type-reference"/>
              data type.</t>
            </list></t>
        </list></t>
    </section>

    <section anchor="json_representation" title="JSON Representation">
      <section title="Minimal User Representation">
        <t>The following is a non-normative example of the minimal required
        SCIM representation in JSON format.</t>

        <figure anchor="minUserJSON"
                title="Example Minimal User JSON Representation">
          <artwork>{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "userName": "bjensen@example.com",
  "meta": {
    "resourceType": "User",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"3694e05e9dff590\"",
    "location": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646"
  }
}</artwork>
        </figure>
      </section>

      <section title="Full User Representation">
        <t>The following is a non-normative example of the fully populated
        SCIM representation in JSON format.</t>

        <figure anchor="fullUserJSON"
                title="Example Full User JSON Representation">
          <artwork>{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "externalId": "701984",
  "userName": "bjensen@example.com",
  "name": {
    "formatted": "Ms. Barbara J Jensen III",
    "familyName": "Jensen",
    "givenName": "Barbara",
    "middleName": "Jane",
    "honorificPrefix": "Ms.",
    "honorificSuffix": "III"
  },
  "displayName": "Babs Jensen",
  "nickName": "Babs",
  "profileUrl": "https://login.example.com/bjensen",
  "emails": [
    {
      "value": "bjensen@example.com",
      "type": "work",
      "primary": true
    },
    {
      "value": "babs@jensen.org",
      "type": "home"
    }
  ],
  "addresses": [
    {
      "type": "work",
      "streetAddress": "100 Universal City Plaza",
      "locality": "Hollywood",
      "region": "CA",
      "postalCode": "91608",
      "country": "USA",
      "formatted": "100 Universal City Plaza\nHollywood, CA 91608 USA",
      "primary": true
    },
    {
      "type": "home",
      "streetAddress": "456 Hollywood Blvd",
      "locality": "Hollywood",
      "region": "CA",
      "postalCode": "91608",
      "country": "USA",
      "formatted": "456 Hollywood Blvd\nHollywood, CA 91608 USA"
    }
  ],
  "phoneNumbers": [
    {
      "value": "555-555-5555",
      "type": "work"
    },
    {
      "value": "555-555-4444",
      "type": "mobile"
    }
  ],
  "ims": [
    {
      "value": "someaimhandle",
      "type": "aim"
    }
  ],
  "photos": [
    {
      "value": "https://photos.example.com/profilephoto/72930000000Ccne/F",
      "type": "photo"
    },
    {
      "value": "https://photos.example.com/profilephoto/72930000000Ccne/T",
      "type": "thumbnail"
    }
  ],
  "userType": "Employee",
  "title": "Tour Guide",
  "preferredLanguage":"en-US",
  "locale": "en-US",
  "timezone": "America/Los_Angeles",
  "active":true,
  "password":"t1meMa$heen",
  "groups": [
    {
      "value": "e9e30dba-f08f-4109-8486-d5c6a331660a",
      "$ref": "https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",
      "display": "Tour Guides"
    },
    {
      "value": "fc348aa8-3835-40eb-a20b-c726e15c55b5",
      "$ref": "https://example.com/v2/Groups/fc348aa8-3835-40eb-a20b-c726e15c55b5",
      "display": "Employees"
    },
    {
      "value": "71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7",
      "$ref": "https://example.com/v2/Groups/71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7",
      "display": "US Employees"
    }
  ],
  "x509Certificates": [
    {
      "value": "MIIDQzCCAqygAwIBAgICEAAwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx
                EzARBgNVBAgMCkNhbGlmb3JuaWExFDASBgNVBAoMC2V4YW1wbGUuY29tMRQwEgYD
                VQQDDAtleGFtcGxlLmNvbTAeFw0xMTEwMjIwNjI0MzFaFw0xMjEwMDQwNjI0MzFa
                MH8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRQwEgYDVQQKDAtl
                eGFtcGxlLmNvbTEhMB8GA1UEAwwYTXMuIEJhcmJhcmEgSiBKZW5zZW4gSUlJMSIw
                IAYJKoZIhvcNAQkBFhNiamVuc2VuQGV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0B
                AQEFAAOCAQ8AMIIBCgKCAQEA7Kr+Dcds/JQ5GwejJFcBIP682X3xpjis56AK02bc
                1FLgzdLI8auoR+cC9/Vrh5t66HkQIOdA4unHh0AaZ4xL5PhVbXIPMB5vAPKpzz5i
                PSi8xO8SL7I7SDhcBVJhqVqr3HgllEG6UClDdHO7nkLuwXq8HcISKkbT5WFTVfFZ
                zidPl8HZ7DhXkZIRtJwBweq4bvm3hM1Os7UQH05ZS6cVDgweKNwdLLrT51ikSQG3
                DYrl+ft781UQRIqxgwqCfXEuDiinPh0kkvIi5jivVu1Z9QiwlYEdRbLJ4zJQBmDr
                SGTMYn4lRc2HgHO4DqB/bnMVorHB0CC6AV1QoFK4GPe1LwIDAQABo3sweTAJBgNV
                HRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZp
                Y2F0ZTAdBgNVHQ4EFgQU8pD0U0vsZIsaA16lL8En8bx0F/gwHwYDVR0jBBgwFoAU
                dGeKitcaF7gnzsNwDx708kqaVt0wDQYJKoZIhvcNAQEFBQADgYEAA81SsFnOdYJt
                Ng5Tcq+/ByEDrBgnusx0jloUhByPMEVkoMZ3J7j1ZgI8rAbOkNngX8+pKfTiDz1R
                C4+dx8oU6Za+4NJXUjlL5CvV6BEYb1+QAEJwitTVvxB/A67g42/vzgAtoRUeDov1
                +GFiBZ+GNF/cAYKcMtGcrs2i97ZkJMo="
    }
  ],
  "meta": {
    "resourceType": "User",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"a330bc54f0671c9\"",
    "location": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646"
  }
}</artwork>
        </figure>
      </section>

      <section anchor="enterpriseUserRepresentation"
               title="Enterprise User Extension Representation">
        <t>The following is a non-normative example of the fully populated
        User using the enterprise User extension in JSON format.</t>

        <figure anchor="enterpriseUserJSON"
                title="Example Enterprise User JSON Representation">
          <artwork>{
  "schemas": 
    [ "urn:ietf:params:scim:schemas:core:2.0:User", 
      "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "externalId": "701984",
  "userName": "bjensen@example.com",
  "name": {
    "formatted": "Ms. Barbara J Jensen III",
    "familyName": "Jensen",
    "givenName": "Barbara",
    "middleName": "Jane",
    "honorificPrefix": "Ms.",
    "honorificSuffix": "III"
  },
  "displayName": "Babs Jensen",
  "nickName": "Babs",
  "profileUrl": "https://login.example.com/bjensen",
  "emails": [
    {
      "value": "bjensen@example.com",
      "type": "work",
      "primary": true
    },
    {
      "value": "babs@jensen.org",
      "type": "home"
    }
  ],
  "addresses": [
    {
      "streetAddress": "100 Universal City Plaza",
      "locality": "Hollywood",
      "region": "CA",
      "postalCode": "91608",
      "country": "USA",
      "formatted": "100 Universal City Plaza\nHollywood, CA 91608 USA",
      "type": "work",
      "primary": true
    },
    {
      "streetAddress": "456 Hollywood Blvd",
      "locality": "Hollywood",
      "region": "CA",
      "postalCode": "91608",
      "country": "USA",
      "formatted": "456 Hollywood Blvd\nHollywood, CA 91608 USA",
      "type": "home"
     }
  ],
  "phoneNumbers": [
    {
      "value": "555-555-5555",
      "type": "work"
    },
    {
      "value": "555-555-4444",
      "type": "mobile"
    }
  ],
  "ims": [
    {
      "value": "someaimhandle",
      "type": "aim"
    }
  ],
  "photos": [
    {
      "value": "https://photos.example.com/profilephoto/72930000000Ccne/F",
      "type": "photo"
    },
    {
      "value": "https://photos.example.com/profilephoto/72930000000Ccne/T",
      "type": "thumbnail"
    }
  ],
  "userType": "Employee",
  "title": "Tour Guide",
  "preferredLanguage":"en-US",
  "locale": "en-US",
  "timezone": "America/Los_Angeles",
  "active":true,
  "password":"t1meMa$heen",
  "groups": [
    {
      "value": "e9e30dba-f08f-4109-8486-d5c6a331660a",
      "$ref": "/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",
      "display": "Tour Guides"
    },
    {
      "value": "fc348aa8-3835-40eb-a20b-c726e15c55b5",
      "$ref": "/Groups/fc348aa8-3835-40eb-a20b-c726e15c55b5",
      "display": "Employees"
    },
    {
      "value": "71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7",
      "$ref": "/Groups/71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7",
      "display": "US Employees"
    }
  ],
  "x509Certificates": [
    {
      "value": "MIIDQzCCAqygAwIBAgICEAAwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx
                EzARBgNVBAgMCkNhbGlmb3JuaWExFDASBgNVBAoMC2V4YW1wbGUuY29tMRQwEgYD
                VQQDDAtleGFtcGxlLmNvbTAeFw0xMTEwMjIwNjI0MzFaFw0xMjEwMDQwNjI0MzFa
                MH8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRQwEgYDVQQKDAtl
                eGFtcGxlLmNvbTEhMB8GA1UEAwwYTXMuIEJhcmJhcmEgSiBKZW5zZW4gSUlJMSIw
                IAYJKoZIhvcNAQkBFhNiamVuc2VuQGV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0B
                AQEFAAOCAQ8AMIIBCgKCAQEA7Kr+Dcds/JQ5GwejJFcBIP682X3xpjis56AK02bc
                1FLgzdLI8auoR+cC9/Vrh5t66HkQIOdA4unHh0AaZ4xL5PhVbXIPMB5vAPKpzz5i
                PSi8xO8SL7I7SDhcBVJhqVqr3HgllEG6UClDdHO7nkLuwXq8HcISKkbT5WFTVfFZ
                zidPl8HZ7DhXkZIRtJwBweq4bvm3hM1Os7UQH05ZS6cVDgweKNwdLLrT51ikSQG3
                DYrl+ft781UQRIqxgwqCfXEuDiinPh0kkvIi5jivVu1Z9QiwlYEdRbLJ4zJQBmDr
                SGTMYn4lRc2HgHO4DqB/bnMVorHB0CC6AV1QoFK4GPe1LwIDAQABo3sweTAJBgNV
                HRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZp
                Y2F0ZTAdBgNVHQ4EFgQU8pD0U0vsZIsaA16lL8En8bx0F/gwHwYDVR0jBBgwFoAU
                dGeKitcaF7gnzsNwDx708kqaVt0wDQYJKoZIhvcNAQEFBQADgYEAA81SsFnOdYJt
                Ng5Tcq+/ByEDrBgnusx0jloUhByPMEVkoMZ3J7j1ZgI8rAbOkNngX8+pKfTiDz1R
                C4+dx8oU6Za+4NJXUjlL5CvV6BEYb1+QAEJwitTVvxB/A67g42/vzgAtoRUeDov1
                +GFiBZ+GNF/cAYKcMtGcrs2i97ZkJMo="
    }
  ],
  "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
    "employeeNumber": "701984",
    "costCenter": "4130",
    "organization": "Universal Studios",
    "division": "Theme Park",
    "department": "Tour Operations",
    "manager": {
      "managerId": "26118915-6090-4610-87e4-49d8ca9f808d",
      "$ref": "/Users/26118915-6090-4610-87e4-49d8ca9f808d",
      "displayName": "John Smith"
    }
  },
  "meta": {
    "resourceType": "User",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"3694e05e9dff591\"",
    "location": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646"
  }
}</artwork>
        </figure>
      </section>

      <section title="Group Representation">
        <t>The following is a non-normative example of SCIM Group
        representation in JSON format.</t>

        <figure anchor="groupJSON" title="Example Group JSON Representation">
          <artwork>{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "id": "e9e30dba-f08f-4109-8486-d5c6a331660a",
  "displayName": "Tour Guides",
  "members": [
    {
      "value": "2819c223-7f76-453a-919d-413861904646",
      "$ref": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",
      "display": "Babs Jensen"
    },
    {
      "value": "902c246b-6245-4190-8e05-00816be7344a",
      "$ref": "https://example.com/v2/Users/902c246b-6245-4190-8e05-00816be7344a",
      "display": "Mandy Pepperidge"
    }
  ],
  "meta": {
    "resourceType": "Group",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"3694e05e9dff592\"",
    "location": "https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a"
  }
}</artwork>
        </figure>
      </section>

      <section title="Service Provider Configuration Representation">
        <t>The following is a non-normative example of the SCIM service
        provider configuration representation in JSON format.</t>

        <figure anchor="serviceProviderConfigJSON"
                title="Example Service Provider Config JSON Representation">
          <artwork>{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
  "documentationUrl":"http://example.com/help/scim.html",
  "patch": {
    "supported":true
  },
  "bulk": {
    "supported":true,
    "maxOperations":1000,
    "maxPayloadSize":1048576
  },
  "filter": {
    "supported":true,
    "maxResults": 200
  },
  "changePassword" : {
    "supported":true
  },
  "sort": {
    "supported":true
  },
  "etag": {
    "supported":true
  },
  "authenticationSchemes": [
    {
      "name": "OAuth Bearer Token",
      "description": "Authentication Scheme using the OAuth Bearer Token Standard",
      "specUrl":"http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-01",
      "documentationUrl":"http://example.com/help/oauth.html",
      "type":"oauthbearertoken",
      "primary": true
    },
    {
      "name": "HTTP Basic",
      "description": "Authentication Scheme using the Http Basic Standard",
      "specUrl":"http://www.ietf.org/rfc/rfc2617.txt",
      "documentationUrl":"http://example.com/help/httpBasic.html",
      "type":"httpbasic"
     }
  ],
  "meta": {
    "location":"https://example.com/v2/ServiceProviderConfig",
    "resourceType": "ServiceProviderConfig",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"3694e05e9dff594\""
  }
}</artwork>
        </figure>
      </section>

      <section anchor="resourceTypesRepresentation"
               title="Resource Type Representation">
        <t>The following is a non-normative example of the SCIM resource type
        representation in JSON format.</t>

        <figure anchor="resourceTypeJSON"
                title="Example Resource Type JSON Representation">
          <artwork>{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
  "id":"User",
  "name":"User",
  "endpoint": "/Users",
  "description": "Core User",
  "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
  "schemaExtensions": [
    {
      "schema": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
      "required": true
    }
  ],
  "meta": {
    "location":"https://example.com/v2/ResourceTypes/User",
    "resourceType": "ResourceType",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"3694e05e9dff595\""
  }
}</artwork>
        </figure>
      </section>

      <section title="Schema Representation">
        <t>The following is intended as normative example of the SCIM Schema
        representation in JSON format. Where permitted individual values and
        schema MAY change. Included but not limited to, are schemas for User,
        Group, and enterprise user.</t>

        <figure anchor="schemaJSON" title="Eample Schema JSON Representation">
          <artwork>{[
  {
    "id" : "urn:ietf:params:scim:schemas:core:2.0:User",
    "name" : "User",
    "description" : "Core User",
    "attributes" : [
      {
        "name" : "id",
        "type" : "string",
        "multiValued" : false,
        "description" : "Unique identifier for the SCIM resource as defined by the Service Provider. Each representation of the resource MUST include a non-empty id value. This identifier MUST be unique across the Service Provider's entire set of resources. It MUST be a stable, non-reassignable identifier that does not change when the same resource is returned in subsequent requests. The value of the id attribute is always issued by the Service Provider and MUST never be specified by the Service Consumer. REQUIRED.",
        "required" : true,
        "caseExact" : false,
        "mutability" : "readOnly",
        "returned" : "always",
        "uniqueness" : "server"
      },
      {
        "name" : "externalId",
        "type" : "string",
        "multiValued" : false,
        "description" : "An identifier for the Resource as defined by the Service Consumer.",
        "required" : true,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "userName",
        "type" : "string",
        "multiValued" : false,
        "description" : "Unique identifier for the User typically used by the user to directly authenticate to the service provider. Each User MUST include a non-empty userName value.  This identifier MUST be unique across the Service Consumer's entire set of Users.  REQUIRED",
        "required" : true,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "server"
      },
      {
        "name" : "name",
        "type" : "complex",
        "multiValued" : false,
        "description" : "The components of the user's real name. Providers MAY return just the full name as a single string in the formatted sub-attribute, or they MAY return just the individual component attributes using the other sub-attributes, or they MAY return both. If both variants are returned, they SHOULD be describing the same name, with the formatted name indicating how the component attributes should be combined.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "formatted",
            "type" : "string",
            "multiValued" : false,
            "description" : "The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g. Ms. Barbara J Jensen, III.).",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "familyName",
            "type" : "string",
            "multiValued" : false,
            "description" : "The family name of the User, or Last Name in most Western languages (e.g. Jensen given the full name Ms. Barbara J Jensen, III.).",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "givenName",
            "type" : "string",
            "multiValued" : false,
            "description" : "The given name of the User, or First Name in most Western languages (e.g. Barbara given the full name Ms. Barbara J Jensen, III.).",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "middleName",
            "type" : "string",
            "multiValued" : false,
            "description" : "The middle name(s) of the User (e.g. Robert given the full name Ms. Barbara J Jensen, III.).",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "honorificPrefix",
            "type" : "string",
            "multiValued" : false,
            "description" : "The honorific prefix(es) of the User, or Title in most Western languages (e.g. Ms. given the full name Ms. Barbara J Jensen, III.).",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "honorificSuffix",
            "type" : "string",
            "multiValued" : false,
            "description" : "The honorific suffix(es) of the User, or Suffix in most Western languages (e.g. III. given the full name Ms. Barbara J Jensen, III.).",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "displayName",
        "type" : "string",
        "multiValued" : false,
        "description" : "The name of the User, suitable for display to end-users. The name SHOULD be the full name of the User being described if known",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "nickName",
        "type" : "string",
        "multiValued" : false,
        "description" : "The casual way to address the user in real life, e.g. \"Bob\" or \"Bobby\" instead of \"Robert\".  This attribute SHOULD NOT be used to represent a User's username (e.g. bjensen or mpepperidge)",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "profileUrl",
        "type" : "string",
        "multiValued" : false,
        "description" : "A fully qualified URL to a page representing the User's online profile",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "title",
        "type" : "string",
        "multiValued" : false,
        "description" : "The user's title, such as \"Vice President.\"",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "userType",
        "type" : "string",
        "multiValued" : false,
        "description" : "Used to identify the organization to user relationship. Typical values used might be \"Contractor\", \"Employee\", \"Intern\", \"Temp\", \"External\", and \"Unknown\" but any value may be used ",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "preferredLanguage",
        "type" : "string",
        "multiValued" : false,
        "description" : "Indicates the User's preferred written or spoken language.  Generally used for selecting a localized User interface. e.g., 'en_US' specifies the language English and country US.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "locale",
        "type" : "string",
        "multiValued" : false,
        "description" : "Used to indicate the User's default location for purposes of localizing items such as currency, date time format, numerical representations, etc.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "timezone",
        "type" : "string",
        "multiValued" : false,
        "description" : "The User's time zone in the \"Olson\" timezone database format [19]; e.g.,'America/Los_Angeles'",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "active",
        "type" : "boolean",
        "multiValued" : false,
        "description" : "A Boolean value indicating the User's administrative status.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "password",
        "type" : "string",
        "multiValued" : false,
        "description" : "The User's clear text password.  This attribute is intended to be used as a means to specify an initial password when creating a new User or to reset an existing User's password.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "writeOnly",
        "returned" : "never",
        "uniqueness" : "none"
      },
      {
        "name" : "emails",
        "type" : "complex",
        "multiValued" : true,
        "description" : "E-mail addresses for the user. The value SHOULD be canonicalized by the Service Provider, e.g. bjensen@example.com instead of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and other.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "E-mail addresses for the user. The value SHOULD be canonicalized by the Service Provider, e.g. bjensen@example.com instead of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and other.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "display",
            "type" : "string",
            "multiValued" : false,
            "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function; e.g., 'work' or 'home'.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [
              "work",
              "home",
              "other"
            ],
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "primary",
            "type" : "boolean",
            "multiValued" : false,
            "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred mailing address or primary e-mail address. The primary attribute value 'true' MUST appear no more than once.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "phoneNumbers",
        "type" : "complex",
        "multiValued" : true,
        "description" : "Phone numbers for the User.  The value SHOULD be canonicalized by the Service Provider according to format in RFC3966 [20] e.g. 'tel:+1-201-555-0123'.  Canonical Type values of work, home, mobile, fax, pager and other.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "Phone number of the User",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "display",
            "type" : "string",
            "multiValued" : false,
            "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function; e.g., 'work' or 'home' or 'mobile' etc.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [
              "work",
              "home",
              "mobile",
              "fax",
              "pager",
              "other"
            ],
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "primary",
            "type" : "boolean",
            "multiValued" : false,
            "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred phone number or primary phone number. The primary attribute value 'true' MUST appear no more than once.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "ims",
        "type" : "complex",
        "multiValued" : true,
        "description" : "Instant messaging addresses for the User.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "Instant messaging address for the User.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "display",
            "type" : "string",
            "multiValued" : false,
            "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function; e.g., 'aim', 'gtalk', 'mobile' etc.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [
              "aim",
              "gtalk",
              "icq",
              "xmpp",
              "msn",
              "skype",
              "qq",
              "yahoo"
            ],
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "primary",
            "type" : "boolean",
            "multiValued" : false,
            "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred messenger or primary messenger. The primary attribute value 'true' MUST appear no more than once.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "photos",
        "type" : "complex",
        "multiValued" : true,
        "description" : "URLs of photos of the User.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "URL of a photo of the User.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "display",
            "type" : "string",
            "multiValued" : false,
            "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function; e.g., 'photo' or 'thumbnail'.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [
              "photo",
              "thumbnail"
            ],
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "primary",
            "type" : "boolean",
            "multiValued" : false,
            "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute, e.g. the preferred photo or thumbnail. The primary attribute value 'true' MUST appear no more than once.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "addresses",
        "type" : "complex",
        "multiValued" : true,
        "description" : "A physical mailing address for this User, as described in (address Element). Canonical Type Values of work, home, and other. The value attribute is a complex type with the following sub-attributes.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "formatted",
            "type" : "string",
            "multiValued" : false,
            "description" : "The full mailing address, formatted for display or use with a mailing label. This attribute MAY contain newlines.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "streetAddress",
            "type" : "string",
            "multiValued" : false,
            "description" : "The full street address component, which may include house number, street name, PO BOX, and multi-line extended street address information. This attribute MAY contain newlines.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "locality",
            "type" : "string",
            "multiValued" : false,
            "description" : "The city or locality component.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "region",
            "type" : "string",
            "multiValued" : false,
            "description" : "The state or region component.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "postalCode",
            "type" : "string",
            "multiValued" : false,
            "description" : "The zipcode or postal code component.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "country",
            "type" : "string",
            "multiValued" : false,
            "description" : "The country name component.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function; e.g., 'work' or 'home'.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [
              "work",
              "home",
              "other"
            ],
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "groups",
        "type" : "complex",
        "multiValued" : true,
        "description" : "A list of groups that the user belongs to, either thorough direct membership, nested groups, or dynamically calculated",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "The identifier of the User's group.",
            "readOnly" : false,
            "required" : false,
            "caseExact" : false,
            "mutability" : "readOnly",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "$ref",
            "type" : "string",
            "multiValued" : false,
            "description" : "The URI of the corresponding Group resource to which the user belongs",
            "readOnly" : false,
            "required" : false,
            "caseExact" : false,
            "mutability" : "readOnly",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "display",
            "type" : "string",
            "multiValued" : false,
            "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
            "readOnly" : true,
            "required" : false,
            "caseExact" : false,
            "mutability" : "readOnly",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function; e.g., 'direct' or 'indirect'.",
            "readOnly" : false,
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [
              "direct",
              "indirect"
            ],
            "mutability" : "readOnly",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readOnly",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "entitlements",
        "type" : "complex",
        "multiValued" : true,
        "description" : "A list of entitlements for the User that represent a thing the User has.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "The value of an entitlement.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "display",
            "type" : "string",
            "multiValued" : false,
            "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [],
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "primary",
            "type" : "boolean",
            "multiValued" : false,
            "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute. The primary attribute value 'true' MUST appear no more than once.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "roles",
        "type" : "complex",
        "multiValued" : true,
        "description" : "A list of roles for the User that collectively represent who the User is; e.g., 'Student', 'Faculty'.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "The value of a role.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "display",
            "type" : "string",
            "multiValued" : false,
            "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [],
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "primary",
            "type" : "boolean",
            "multiValued" : false,
            "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute. The primary attribute value 'true' MUST appear no more than once.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "x509Certificates",
        "type" : "complex",
        "multiValued" : true,
        "description" : "A list of certificates issued to the User.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "The value of a X509 certificate.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "display",
            "type" : "string",
            "multiValued" : false,
            "description" : "A human readable name, primarily used for display purposes. READ-ONLY.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the attribute's function.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [],
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "primary",
            "type" : "boolean",
            "multiValued" : false,
            "description" : "A Boolean value indicating the 'primary' or preferred attribute value for this attribute. The primary attribute value 'true' MUST appear no more than once.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }
    ],
    "meta" : {
      "resourceType" : "Schema",
      "created" : "2010-01-23T04:56:22Z",
      "lastModified" : "2014-02-04T00:00:00Z",
      "version" : "W/\"3694e05e9dff596\"",
      "location" : "https://example.com/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User"
    }
  },
  {
    "id" : "urn:ietf:params:scim:schemas:core:2.0:Group",
    "name" : "Group",
    "description" : "Core Group",
    "attributes" : [
      {
        "name" : "id",
        "type" : "string",
        "multiValued" : false,
        "description" : "Unique identifier for the SCIM resource as defined by the Service Provider. Each representation of the resource MUST include a non-empty id value. This identifier MUST be unique across the Service Provider's entire set of resources. It MUST be a stable, non-reassignable identifier that does not change when the same resource is returned in subsequent requests. The value of the id attribute is always issued by the Service Provider and MUST never be specified by the Service Consumer. REQUIRED.",
        "required" : true,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "always",
        "uniqueness" : "server"
      },
      {
        "name" : "externalId",
        "type" : "string",
        "multiValued" : false,
        "description" : "An identifier for the Resource as defined by the Service Consumer.",
        "required" : true,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "displayName",
        "type" : "string",
        "multiValued" : false,
        "description" : "A human readable name for the Group.  REQUIRED.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "members",
        "type" : "complex",
        "multiValued" : false,
        "description" : "A list of members of the Group.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "string",
            "multiValued" : false,
            "description" : "The identifier of the member of this Group.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "immutable",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "$ref",
            "type" : "string",
            "multiValued" : false,
            "description" : "The URI of the corresponding to the member resource of this Group.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "immutable",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "type",
            "type" : "string",
            "multiValued" : false,
            "description" : "A label indicating the type of resource; e.g., 'User' or 'Group'.",
            "required" : false,
            "caseExact" : false,
            "canonicalValues" : [
              "User",
              "Group"
            ],
            "mutability" : "immutable",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }
    ],
    "meta" : {
      "resourceType" : "Schema",
      "created" : "2010-01-23T04:56:22Z",
      "lastModified" : "2014-02-04T00:00:00Z",
      "version" : "W/\"3694e05e9dff596\"",
      "location" : "https://example.com/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group"
    }
  },
  {
    "id" : "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
    "name" : "EnterpriseUser",
    "description" : "Enterprise User",
    "attributes" : [
      {
        "name" : "employeeNumber",
        "type" : "string",
        "multiValued" : false,
        "description" : "Numeric or alphanumeric identifier assigned to a person, typically based on order of hire or association with an organization.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "costCenter",
        "type" : "string",
        "multiValued" : false,
        "description" : "Identifies the name of a cost center.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "organization",
        "type" : "string",
        "multiValued" : false,
        "description" : "Identifies the name of an organization.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "division",
        "type" : "string",
        "multiValued" : false,
        "description" : "Identifies the name of a division.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "department",
        "type" : "string",
        "multiValued" : false,
        "description" : "Identifies the name of a department.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },
      {
        "name" : "manager",
        "type" : "complex",
        "multiValued" : false,
        "description" : "The User's manager. A complex type that optionally allows Service Providers to represent organizational hierarchy by referencing the \"id\" attribute of another User.",
        "required" : false,
        "caseExact" : false,
        "subAttributes" : [
          {
            "name" : "managerId",
            "type" : "string",
            "multiValued" : false,
            "description" : "The id of the SCIM resource representing the User's  manager.  REQUIRED.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "$ref",
            "type" : "string",
            "multiValued" : false,
            "description" : "The URI of the SCIM resource representing the User's manager.  REQUIRED.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },
          {
            "name" : "displayName",
            "type" : "string",
            "multiValued" : false,
            "description" : "The displayName of the User's manager.  OPTIONAL and READ-ONLY.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readOnly",
            "returned" : "default",
            "uniqueness" : "none"
          }
        ],
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      }
    ],
    "meta" : {
      "resourceType" : "Schema",
      "created" : "2010-01-23T04:56:22Z",
      "lastModified" : "2014-02-04T00:00:00Z",
      "version" : "W/\"3694e05e9dff596\"",
      "location" : "https://example.com/v2/Schemas/urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
    }
  }
]}</artwork>
        </figure>
      </section>
    </section>

    <section anchor="Security" title="Security Considerations" toc="default">
      <t>The SCIM Core schema contains personally identifiable information as
      well as other sensitive data. Aside from prohibiting password values in
      a SCIM response this specification does not provide any means or
      guarantee of confidentiality.</t>
    </section>

    <section title="IANA Considerations">
      <section title="New Registration of SCIM URN Sub-namespace">
        <t>IANA has created a registry for new IETF URN sub-namespaces, <spanx
        style="verb">urn:ietf:params:scim:</spanx>, per <xref
        target="RFC3553"/>. The registration request is as follows:</t>

        <t>Per <xref target="RFC3553"/>, IANA has registered a new URN
        sub-namespace, <spanx style="verb">urn:ietf:params:scim</spanx>.<list
            style="symbols">
            <t>Registry name: scim</t>

            <t>Specification: [this document]</t>

            <t>Repository: [see <xref target="scimNamespace"/>]</t>

            <t>Index value: values [see <xref target="scimNamespace"/>]</t>
          </list></t>
      </section>

      <section anchor="scimNamespace" title="URN Sub-Namespace for SCIM">
        <t>SCIM schemas and SCIM messages utilize URIs to identify the schema
        in use or other relevant context. This section creates and registers
        an IETF URN Sub-namespace for use in the SCIM specifications and
        future extensions.</t>

        <section title="Specification Template">
          <t><list style="hanging">
              <t hangText="Namespace ID:"><vspace blankLines="1"/> The
              Namespace ID <spanx style="verb">scim</spanx> is requested.</t>

              <t hangText="Registration Information:"><vspace blankLines="1"/>
              Version: 1</t>

              <t>Date: [[insert final submission date]]</t>

              <t hangText="Declared registrant of the namespace:"><list
                  style="hanging">
                  <t hangText="Registering organization"><vspace
                  blankLines="0"/> The Internet Engineering Task Force</t>

                  <t hangText="Designated contact"><vspace blankLines="0"/> A
                  designated expert will monitor the SCIM public mailing list,
                  <spanx style="verb">scim@ietf.org</spanx>.</t>
                </list></t>

              <t hangText="Declaration of Syntactic Structure:"><vspace
              blankLines="1"/> The Namespace Specific String (NSS) of all URNs
              that use the "scim" NID shall have the following structure:
              <figure>
                  <artwork>urn:ietf:params:scim:{type}:{name}{:sName}:{vers}{:class}{:resType}</artwork>
                </figure> The keywords have the following meaning: <list
                  style="hanging">
                  <t hangText="type"><vspace blankLines="0"/> The entity type
                  which is either <spanx style="verb">schemas</spanx> or
                  <spanx style="verb">api</spanx>.</t>

                  <t hangText="name"><vspace blankLines="0"/> A required
                  US-ASCII string that conforms to the URN syntax requirements
                  (see <xref target="RFC2141"/> ) and defines a major
                  namespace of object used within SCIM (e.g. <spanx
                  style="verb">core</spanx>, <spanx style="verb">extension</spanx>
                  ). The name "extension" MAY be used when the registered
                  schema it refers to is intended to be used as an extension
                  to another schema.</t>

                  <t anchor="sName"><vspace blankLines="0"/> An optional
                  US-ASCII string that conforms to the URN syntax requirements
                  (see <xref target="RFC2141"/> ) and defines a sub-class of
                  object used within SCIM (e.g. <spanx style="verb">enterprise</spanx>).</t>

                  <t hangText="vers"><vspace blankLines="0"/>The first SCIM
                  protocol version number where the URN is valid (e.g. <spanx
                  style="verb">2.0</spanx> ).</t>

                  <t hangText="class"><vspace blankLines="0"/>An optional
                  US-ASCII string that conforms to the URN syntax requirements
                  (see <xref target="RFC2141"/> ) and defines a major class of
                  object used within SCIM.</t>

                  <t hangText="resType"><vspace blankLines="0"/> An optional
                  US-ASCII string that conforms to the URN syntax requirements
                  (see <xref target="RFC2141"/> ) and typically is used when
                  referring to a resource type within SCIM (e.g. User).</t>
                </list></t>

              <t hangText="Relevant Ancillary Documentation:"><vspace
              blankLines="1"/>None</t>

              <t hangText="Identifier Uniqueness Considerations:"><vspace
              blankLines="1"/>The designated contact shall be responsible for
              reviewing and enforcing uniqueness.</t>

              <t hangText="Identifier Persistence Considerations:"><vspace
              blankLines="1"/>Once a name has been allocated it MUST NOT be
              re-allocated for a different purpose. The rules provided for
              assignments of values within a sub-namespace MUST be constructed
              so that the meaning of values cannot change. This registration
              mechanism is not appropriate for naming values whose meaning may
              change over time.</t>

              <t>As the SCIM specifications are updated and the SCIM protocol
              version is adjusted, a new registration will be made when
              significant changes are made. Example, <spanx style="verb">urn:ietf:params:scim:schemas:core:1.0 (externally defined, not previously registered)</spanx>
              and <spanx style="verb">urn:ietf:params:scim:schemas:core:2.0</spanx>.</t>

              <t hangText="Process of Identifier Assignment:"><vspace
              blankLines="1"/> Identifiers with namespace type "schema" (e.g.
              <spanx style="verb">urn:ietf:params:scim:schemas</spanx> ) are
              assigned after the review of the assigned contact via the SCIM
              public mailing list, <spanx style="verb">scim@ietf.org</spanx>
              as documented in <xref target="schemaReg"/>.</t>

              <t>Namespaces with type "api" (e.g. <spanx style="verb">urn:ietf:params:scim:api</spanx>
              ) are reserved for IETF approved SCIM specifications. Namespaces
              with type "param" are reserved for future use.</t>

              <t hangText="Process of Identifier Resolution:"><vspace
              blankLines="1"/> The namespace is not currently listed with a
              Resolution Discovery System (RDS), but nothing about the
              namespace prohibits the future definition of appropriate
              resolution methods or listing with an RDS.</t>

              <t hangText="Rules for Lexical Equivalence:"><vspace
              blankLines="1"/> No special considerations; the rules for
              lexical equivalence specified in <xref target="RFC2141"/>
              apply.</t>

              <t hangText="Conformance with URN Syntax:"><vspace
              blankLines="1"/> No special considerations.</t>

              <t hangText="Validation Mechanism:"><vspace blankLines="1"/>
              None specified.</t>

              <t hangText="Scope:"><vspace blankLines="1"/> Global.</t>
            </list></t>
        </section>

        <section title="Pre-Registered SCIM Schema Identifiers">
          <t>The following SCIM Identifiers are defined: <list style="hanging">
              <t hangText="urn:ietf:params:scim:schemas:core:2.0"><vspace
              blankLines="1"/> SCIM Core Schema as specified in <xref
              target="schema"/> and <xref
              target="initialSchemaRegistry"/>.</t>

              <t
              hangText="urn:ietf:params:scim:schemas:extension:enterprise:2.0"><vspace
              blankLines="1"/> Enterprise schema extensions as defined in
              <xref target="enterpriseUser"/> and <xref
              target="initialSchemaRegistry"/>.</t>
            </list></t>
        </section>
      </section>

      <section anchor="schemaReg" title="Registering SCIM Schemas">
        <t>This section defines the process for registering new SCIM schemas
        with IANA. A schema URI is used as a value in the schemas attribute (
        <xref target="schemas-attribute"/> ) for the purpose of distinguishing
        extensions used in a SCIM resource.</t>

        <section title="Registration Procedure">
          <t>The IETF has created a mailing list, scim@ietf.org, which can be
          used for public discussion of SCIM schema proposals prior to
          registration. Use of the mailing list is strongly encouraged. The
          IESG has appointed a designated expert who will monitor the
          scim@ietf.org mailing list and review registrations.</t>

          <t>Registration of new schemas MUST be reviewed by the designated
          expert and published in an RFC. A Standards Track RFC is REQUIRED
          for the registration of new value data types that modify existing
          properties. A Standards Track RFC is also REQUIRED for registration
          of SCIM schema URIs that modify SCIM schema previously documented in
          a Standards Track RFC.</t>

          <t>The registration procedure begins when a completed registration
          template, defined in the sections below, is sent to scim@ietf.org
          and iana@iana.org. Within two weeks, the designated expert is
          expected to tell IANA and the submitter of the registration whether
          the registration is approved, approved with minor changes, or
          rejected with cause. When a registration is rejected with cause, it
          can be re-submitted if the concerns listed in the cause are
          addressed. Decisions made by the designated expert can be appealed
          to the IESG Applications Area Director, then to the IESG. They
          follow the normal appeals procedure for IESG decisions.</t>

          <t>Once the registration procedure concludes successfully, IANA
          creates or modifies the corresponding record in the SCIM schema
          registry. The completed registration template is discarded.</t>

          <t>An RFC specifying new schema URI MUST include the completed
          registration templates, which MAY be expanded with additional
          information. These completed templates are intended to go in the
          body of the document, not in the IANA Considerations section. The
          RFC SHOULD include any attributes defined.</t>
        </section>

        <section title="Schema Registration Template">
          <t>A SCIM schema URI is defined by completing the following
          template: <list style="hanging">
              <t hangText="Schema URI:">Schema URI: A unique URI for the SCIM
              schema extension.</t>

              <t hangText="Schema Name:">A descriptive name of the schema
              extension (e.g. Generic Device)</t>

              <t hangText="Intended or Associated Resource Type:">A value
              defining the resource type (e.g. "Device").</t>

              <t hangText="Purpose:">A description of the purpose of the
              extension and/or its intended use.</t>

              <t hangText="Single-value Attributes:">A list and description of
              single-valued attributes defined including complex
              attributes.</t>

              <t hangText="Multi-valued Attributes:">A list and description of
              multi-valued attributes defined including complex
              attributes.</t>
            </list></t>
        </section>
      </section>

      <section anchor="initialSchemaRegistry"
               title="Initial SCIM Schema Registry">
        <t>The IANA has created and will maintain the following registries for
        SCIM schema URIs with pointers to appropriate reference documents.</t>

        <texttable title="SCIM Schema URIs for Data Resources">
          <ttcol>Schema URI</ttcol>

          <ttcol>Name</ttcol>

          <ttcol>Reference</ttcol>

          <c>urn:ietf:params:scim:schemas:core:2.0:User</c>

          <c>User Resource</c>

          <c>See <xref target="user-resource"/></c>

          <c>urn:ietf:params:scim:schemas:extension:enterprise:2.0:User</c>

          <c>Enterprise User Extension</c>

          <c>See <xref target="enterpriseUser"/></c>

          <c>urn:ietf:params:scim:schemas:core:2.0:Group</c>

          <c>Group Resource</c>

          <c>See <xref target="group-resource"/></c>
        </texttable>

        <texttable title="SCIM Server Related Schema URIs">
          <ttcol>Schema URI</ttcol>

          <ttcol>Name</ttcol>

          <ttcol>Reference</ttcol>

          <c>urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig</c>

          <c>Service Provider Configuration Schema</c>

          <c>See <xref target="serviceProviderConfig"/></c>

          <c>urn:ietf:params:scim:schemas:core:2.0:ResourceType</c>

          <c>Resource Type Config</c>

          <c>See <xref target="resource-type-schema"/></c>

          <c>urn:ietf:params:scim:schemas:core:2.0:Schema</c>

          <c>Schema Definitions Schema</c>

          <c>See <xref target="schema-schema"/></c>
        </texttable>
      </section>
    </section>
  </middle>

  <back>
    <references title="Normative References">
      <?rfc include="reference.RFC.2119"?>

      <?rfc include="reference.RFC.2141"?>

      <?rfc include='reference.RFC.3553' ?>

      <?rfc include='reference.RFC.3629' ?>

      <?rfc include="reference.RFC.3986"?>

      <?rfc include="reference.RFC.3966"?>

      <?rfc include="reference.RFC.7159"?>

      <?rfc include="reference.RFC.4647"?>

      <?rfc include="reference.RFC.5234"?>

      <?rfc include="reference.RFC.5646"?>

      <?rfc include="reference.RFC.6557"?>

      <?rfc include="reference.RFC.7231"?>

      <reference anchor="XML-Schema">
        <front>
          <title>XML Schema Part 2: Datatypes Second Edition</title>

          <author fullname="Paul V. Biron" initials="P." surname="Biron">
            <organization>Kaiser Permanente for Health Level
            Seven</organization>
          </author>

          <author fullname="Ashok Malhotra" initials="A." surname="Malhotra">
            <organization>Microsoft (formerly of IBM)</organization>
          </author>

          <date day="28" month="October" year="2004"/>
        </front>

        <format target="http://www.w3.org/TR/xmlschema-2/" type="HTML"/>
      </reference>
    </references>

    <references title="Informative References">
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.2277.xml'?>

      <?rfc include="reference.RFC.4512"?>

      <?rfc include="reference.RFC.6749"?>

      <reference anchor="Olson-TZ">
        <front>
          <title>Sources for Time Zone and Daylight Saving Time Data</title>

          <author>
            <organization/>
          </author>

          <date/>
        </front>

        <format target="http://www.twinsun.com/tz/tz-link.htm" type="HTML"/>
      </reference>

      <reference anchor="ISO3166">
        <front>
          <title>ISO 3166:1988 (E/F) - Codes for the representation of names
          of countries - The International Organization for Standardization,
          3rd edition</title>

          <author>
            <organization/>
          </author>

          <date day="15" month="08" year="1988"/>
        </front>
      </reference>

      <reference anchor="ISO639-2">
        <front>
          <title>ISO639-2: Codes for the Representation of Names of
          Languages</title>

          <author>
            <organization>ISO 639.2 Registration Authority</organization>
          </author>

          <date day="25" month="July" year="2013"/>
        </front>

        <format target="http://www.loc.gov/standards/iso639-2/php/code_list.php"
                type="HTML"/>
      </reference>

      <reference anchor="PortableContacts">
        <front>
          <title>Portable Contacts 1.0 Draft C - Schema Only</title>

          <author fullname="Joeseph Smarr" initials="J." surname="Smarr">
            <organization abbrev="plaxo">Plaxo</organization>
          </author>

          <date day="5" month="August" year="2008"/>
        </front>

        <format target="http://www.portablecontacts.net/draft-schema.html"
                type="HTML"/>
      </reference>
    </references>

    <section title="Acknowledgements">
      <t>The editors would like to acknowledge the contribution and work of
      the past draft editors: <list>
          <t>Chuck Mortimore, Salesforce</t>

          <t>Patrick Harding, Ping</t>

          <t>Paul Madsen, Ping</t>

          <t>Trey Drake, UnboundID</t>
        </list></t>

      <t>The SCIM Community would like to thank the following people for the
      work they've done in the research, formulation, drafting, editing, and
      support of this specification.</t>

      <t><list style="empty">
          <t>Morteza Ansari (morteza.ansari@cisco.com)</t>

          <t>Sidharth Choudhury (schoudhury@salesforce.com)</t>

          <t>Samuel Erdtman (samuel@erdtman.se)</t>

          <t>Kelly Grizzle (kelly.grizzle@sailpoint.com)</t>

          <t>Chris Phillips (cjphillips@gmail.com)</t>

          <t>Erik Wahlstroem (erik@wahlstromstekniska.se)</t>

          <t>Phil Hunt (phil.hunt@yahoo.com)</t>
        </list></t>

      <t>Special thanks to Joeseph Smarr, who's excellent work on the Portable
      Contacts Specification <xref target="PortableContacts"/> provided a
      basis for the SCIM schema structure and text.</t>
    </section>

    <section title="Change Log">
      <t>[[This section to be removed prior to publication as an RFC]]</t>

      <t>Draft 02 - KG - Addition of schema extensibility</t>

      <t>Draft 03 - PH - Revisions based on following tickets: <list>
          <t>09 - Attribute uniquenes</t>

          <t>10 - Returnability of attributes</t>

          <t>35 - Attribute mutability (replaces readOnly)</t>

          <t>52 - Minor textual changes</t>

          <t>53 - Standard use of term client (some was consumer)</t>

          <t>56 - Make manager attribute consistent with other $ref attrs</t>

          <t>58 - Add optional id to ResourceType objects for consistency</t>

          <t>59 - Fix capitalization per IETF editor practices</t>

          <t>60 - Changed <eref> tags to normal <xref> and
          <reference> tags</t>
        </list></t>

      <t>Draft 04 - PH - Revisions based on the following tickets: <list>
          <t>43 - Drop short-hand notation for complex multi-valued
          attributes</t>

          <t>61 - Specify attribute name limitations</t>

          <t>62 - Fix 'mutability' normative language</t>

          <t>63 - Fix incorrect EnterpriseUser schema reference</t>

          <t>68 - Update JSON references from RFC4627 to RFC7159</t>

          <t>71 - Made corrections to language tags in compliance with BCP47 /
          RFC5646</t>
        </list></t>

      <t>Draft 05 - PH - Revisions based on the following tickets <list>
          <t>23 - Clarified that the server is not required to preserve case
          for case insensitive strings</t>

          <t>41 - Add IANA considerations</t>

          <t>72 - Added text to indicate UTF-8 is default and mandatory
          encoding format per BCP18</t>

          <t>- Typo corrections and removed some redundant text</t>
        </list></t>

      <t>Draft 06 - PH - Revisions based on the following tickets <list>
          <t>63 - Corrected enterprise user URI in 14.2 and section 7, URI
          namespace changes due to ticket #41</t>

          <t>66 - Updated reference to final HTTP/1.1 drafts (RFC 7230)</t>

          <t>41 - Add IANA considerations</t>

          <t>- Removed redundant text (e.g. SAML binding, replaced REST with
          HTTP)</t>

          <t>- Reordered introduction, definitions and notation sections to
          follow typical format</t>

          <t>- meta.attributes removed due to new PURGE command in draft 04
          (no longer used)</t>
        </list></t>

      <t>Draft 07 - PH - Edits and revisions<list>
          <t>- Dropped use of the term API in favour of HTTP protocol or just
          protocol.</t>

          <t>- Clarified meaning of null and unassigned</t>
        </list></t>

      <t>Draft 08 - PH - Revised IANA namespace to urn:ietf:params:scim per
      RFC3553</t>

      <t>Draft 09 - PH - Editorial revisions and clarifications<list>
          <t>Removed duplicate text from Schema Schema section</t>

          <t>Removed "operation" attribute from Multi-valued Attribute
          sub-attribute definitions. This was used in the old PATCH command
          and is no longer valid.</t>

          <t>Revised some layout to make indentation and definition of
          attributes more clear (added vspace elements)</t>
        </list></t>
    </section>
  </back>
</rfc>