Breve descripción general

El proveedor de servicios de SCIM de WalkMe te permite administrar de forma programada usuarios y grupos utilizando un punto final compatible con SCIM 2.0. WalkMe expone una API REST basada en la especificación del Sistema para la Gestión de Identidades entre dominios (SCIM 2.0).

Esta API te permite hacer lo siguiente:

• Crea, lee, actualiza, parchea y elimina usuarios y grupos.
• Busca usuarios y grupos con filtrado y paginación.
• Obtén información sobre el proveedor de servicios de WalkMe, los esquemas disponibles y los tipos de recursos

Acceso

Acceder en la consola:

1. Abre la consola de WalkMe:
   
   • Centro de datos de EE. UU.
   • Centro de datos de la UE
   • Centro de datos SAP de Estados Unidos
   • Centro de datos SAP de UE
   • Centro de datos FedRAMP
   • Centro de datos de Canadá
2. Ve a la categoría Administrador
3. Selecciona Centro de integración
4. Selecciona Integración de SCIM

Configurar la integración de SCIM

Habilitar SCIM en WalkMe

Antes de activar SCIM, primero debes crear una integración de SCIM en el Centro de administración de WalkMe.

1. En la página de integración de SCIM, selecciona + Crear integración de SCIM

2. Introduce el Nombre de la integración para identificar la integración (por ejemplo, "Producción" o "Staging")

3. Selecciona el Tipo de autorización

   1. Autenticación básica: utiliza un nombre de usuario y una contraseña para la autenticación

   2. Token de portador: utiliza un token de portador para la autenticación

4. Selecciona Generar credenciales

1. Si seleccionas Autenticación básica, se abre una ventana emergente que muestra las credenciales de SCIM generadas para esta integración:

   1. URL base de SCIM: la URL de punto final para la configuración de SCIM de tu proveedor de identidad

   2. Nombre de usuario: el nombre de usuario generado automáticamente para la autenticación

   3. Contraseña: la contraseña generada automáticamente para la autenticación

2. Selecciona Listo para completar la configuración de la integración de SCIM en WalkMe

1. Si seleccionas Bearer Token, se abre una ventana emergente que muestra las credenciales de SCIM generadas para esta integración:

   1. URL base de SCIM: la URL de punto final para la configuración de SCIM de tu proveedor de identidad

   2. Bearer Token: el token seguro utilizado para la autenticación

2. Selecciona Listo para completar la configuración de la integración de SCIM en WalkMe

Puntos finales y parámetros de la API SCIM 2.0

Esta API utiliza SCIM 2.0. Para obtener más información, consulta Esquema básico de SCIM (RFC 7643)

URL base

• EE. UU.: https://papi-us01.walkme.cloud.sap/deepui/api/scim/v2

• UE: https://papi-eu01.walkme.cloud.sap/deepui/api/scim/v2

Autenticación

Todas las solicitudes requieren autenticación HTTP básica o autenticación Bearer Token:

• Autenticación básica:

  • Autorización: básica <base64 (nombre de usuario:contraseña)>

• Bearer Token:

  • Authorization: Bearer token de portador <generado>

Gestión de usuarios

EndPoints

• /Usuarios: crea un usuario (POST) u obtén una lista de usuarios (GET)

• /Usuarios/{id}: Obtener (GET), actualizar (PUT), parchear (PATCH) o eliminar (ELIMINAR) un usuario

GET /Usuarios

Obtiene una lista de usuarios con filtrado y paginación opcional

Parámetros de URL:

• startIndex: índice basado en 1 del primer usuario que devolverá El valor predeterminado es 1. (Opcional)

• recuento: (Opcional) Número de usuarios que se devolverán por página (máximo 1000). El valor predeterminado es 1000. (Opcional)

• filtro: expresión del filtro SCIM (Opcional)

  • Operadores compatibles: eq, ne, co, sw, ew, gt, ge, lt, le, pr

{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
    "totalResults": 1,
    "itemsPerPage": 1000,
    "startIndex": 1,
    "Resources": [
        {
            "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
            "userName": "john.doe@example.com",
            "name": {
                "formatted": "John Doe",
                "familyName": "Doe",
                "givenName": "John"
            },
            "displayName": "John Doe",
            "active": true,
            "emails": [
                {
                    "value": "john.doe@example.com",
                    "type": "work",
                    "primary": true
                }
            ],
            "groups": [],
            "schemas": [
                "urn:ietf:params:scim:schemas:core:2.0:User",
                "urn:ietf:params:scim:schemas:extension:sap:2.0:User"
            ],
            "urn:ietf:params:scim:schemas:extension:sap:2.0:User": {
                "userUuid": "b2c3d4e5-f6a7-8901-bcde-f23456789012"
            },
            "meta": {
                "resourceType": "User",
                "location": "<BASE_URL>/Users/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                "created": "2025-12-02T11:30:23Z",
                "lastModified": "2025-12-02T11:30:23Z",
                "version": "1.0"
            }
        }
    ]
}

Response codes:

• 200 OK: Success

• 400 Bad Request: Invalid request or filter

• 401 Unauthorized: Invalid credentials

• 403 Forbidden: Access denied

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

POST /Users

Creates a new user.

Required attributes:

• userName: Must be unique (case-insensitive)
• emails: Must include at least one email with primary: true

Auto-generated attributes:

• id: System-generated UUID
• urn:ietf:params:scim:schemas:extension:sap:2.0:User.userUuid: Auto-generated if not provided

{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:sap:2.0:User"
    ],
    "userName": "john.doe@example.com",
    "name": {
        "formatted": "John Doe",
        "familyName": "Doe",
        "givenName": "John"
    },
    "displayName": "John Doe",
    "emails": [
        {
            "value": "john.doe@example.com",
            "type": "work",
            "primary": true
        }
    ],
    "active": true
}

Response codes:

• 201 Created: User created successfully

• 400 Bad Request: Missing required attributes or invalid values

• 401 Unauthorized: Invalid credentials

• 409 Conflict: userName already exists

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

GET /Users/{id}

Gets a specific user by their id (UUID).

Path parameters:

• id: User UUID (not userName)

Response codes:

• 200 OK: Success
• 401 Unauthorized: Invalid credentials
• 404 Not Found: User does not exist
• 429 Too Many Requests: Rate limit exceeded
• 500 Internal Server Error

PUT /Users/{id}

Replaces all user attributes. ReadOnly attributes are preserved and cannot be changed.

Path parameters:

id: User UUID (not userName)

Response codes:

• 200 OK: User updated successfully

• 400 Bad Request: Invalid request

• 401 Unauthorized: Invalid credentials

• 404 Not Found: User does not exist

• 409 Conflict: userName conflict

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

PATCH /Users/{id}

Path parameters:

• id: User UUID (not userName)

Supported operations:

• add, replace, remove

{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
        {
            "op": "replace",
            "path": "active",
            "value": false
        },
        {
            "op": "add",
            "path": "emails",
            "value": [
                {
                    "value": "secondary@example.com",
                    "type": "home"
                }
            ]
        }
    ]
}

Response codes:

• 200 OK: User updated successfully

• 400 Bad Request: Invalid operation or path

• 401 Unauthorized: Invalid credentials

• 404 Not Found: User does not exist

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

DELETE /Users{id}

Deletes a user.

Path parameters:

• id: User UUID (not userName)

Response codes:

• 204 No Content: User deleted successfully

• 401 Unauthorized: Invalid credentials

• 404 Not Found: User does not exist

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

Group management

EndPoints

• /Groups: Create a group (POST) or get a list of groups (GET)

• /Groups/{id}: Get (GET), update (PUT), patch (PATCH), or delete (DELETE) a group

GET /Groups

Gets a list of groups with optional filtering and pagination.

URL parameters:

• startIndex:1-based index of the first group to return. Default is 1. (Optional)

• count: Number of groups to return per page (maximum 1000). Default is 1000. (Optional)

• filter: SCIM filter expression used to search for specific groups. Default is none. (Optional)

GET /Groups?filter=displayName sw "Sales"&count=50

{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
    "totalResults": 1,
    "itemsPerPage": 1000,
    "startIndex": 1,
    "Resources": [
        {
            "id": "d737377c-f8ba-4df7-b290-78b9a2bff8e9",
            "displayName": "Sales Team",
            "members": [
                {
                    "value": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                    "$ref": "<BASE_URL>/Users/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
                    "type": "User"
                }
            ],
            "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
            "meta": {
                "resourceType": "Group",
                "location": "<BASE_URL>/Groups/d737377c-f8ba-4df7-b290-78b9a2bff8e9", 

Response codes:

• 200 OK: Success
• 400 Bad Request: Invalid filter
• 401 Unauthorized: Invalid credentials
• 429 Too Many Requests: Rate limit exceeded
• 500 Internal Server Error

POST /Groups

Creates a new group.

URL parameters:

• displayName: Human-readable name (not required, not unique - multiple groups can have the same name) (Required)

• members: Array of member objects (Optional)

{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
    "displayName": "Engineering Team",
    "members": [
        {
            "value": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
            "type": "User"
        }
    ]
}

{
    "id": "e8f9a0b1-c2d3-4567-89ab-cdef01234567",
    "displayName": "Engineering Team",
    "members": [
        {
            "value": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
            "$ref": "<BASE_URL>/Users/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
            "type": "User"
        }
    ],
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
    "meta": {
        "resourceType": "Group",
        "location": "<BASE_URL>/Groups/e8f9a0b1-c2d3-4567-89ab-cdef01234567",
        "created": "2025-12-02T11:30:23Z",
        "lastModified": "2025-12-02T11:30:23Z",
        "version": "1.0"
    }
}

Response codes:

• 201 Created: Group created successfully

• 400 Bad Request: Invalid request

• 401 Unauthorized: Invalid credentials

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

GET /Groups/{id}

Gets a specific group by UUID.

Path parameters:

• id: Group UUID

Response codes:

• 200 OK: Success

• 401 Unauthorized: Invalid credentials

• 404 Not Found: Group does not exist

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

PUT /Groups/{id}

Replaces all group attributes including members.

Path parameters:

• id: Group UUID

Response codes:

• 200 OK: Group updated successfully

• 400 Bad Request: Invalid operation

• 401 Unauthorized: Invalid credentials

• 404 Not Found: Group does not exist

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

PATCH /Groups/{id}

Partially updates a group. Commonly used to add/remove members.

Path parameters:

id - Group UUID

{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
        {
            "op": "add",
            "path": "members",
            "value": [
                {
                    "value": "user-uuid-here",
                    "type": "User"
                }
            ]
        }
    ]
}

{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
        {
            "op": "remove",
            "path": "members[value eq \"user-uuid-here\"]"
        }
    ]
}

Response codes:

• 200 OK: Group updated successfully

• 400 Bad Request: Invalid operation

• 401 Unauthorized: Invalid credentials

• 404 Not Found: Group does not exist

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

DELETE /Groups/{id}

Deletes a group.

Path Parameters:

• id: Group UUID

Response codes:

• 204 No Content: Group deleted successfully

• 401 Unauthorized: Invalid credentials

• 404 Not Found: Group does not exist

• 429 Too Many Requests: Rate limit exceeded

• 500 Internal Server Error

Service provider information

EndPoints

• /ServiceProviderConfig: Get information about the Service Provider

• /Schemas: Get information on the schemas used for user and group management

GET /ServiceProviderConfig

Gets information about the SCIM service provider capabilities.

{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
    "patch": {
        "supported": true
    },
    "bulk": {
        "supported": false
    },
    "filter": {
        "supported": true,
        "maxResults": 1000
    },
    "changePassword": {
        "supported": false
    },
    "sort": {
        "supported": false
    },
    "etag": {
        "supported": false
    },
    "authenticationSchemes": [
        {
            "name": "HTTP Basic",
            "description": "Basic authentication scheme",
            "specUri": "https://www.ietf.org/rfc/rfc2617",
            "primary": true,
            "type": "Basic authentication"
        }
    ],
    "meta": {
        "location": "<BASE_URL>/ServiceProviderConfig",
        "resourceType": "ServiceProviderConfig"
    }
}

GET /Schemas

Gets information on all supported SCIM schemas.

Supported schemas:

• urn:ietf:params:scim:schemas:core:2.0:User

• urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

• urn:ietf:params:scim:schemas:extension:sap:2.0:User

• urn:ietf:params:scim:schemas:core:2.0:Group