openapi: 3.0.3
info:
  title: Users-SCIM
  description: Manage user profiles using SCIM protocol
  version: ''
servers:
  - url: https://api.sbx.transmitsecurity.io/cis
    description: Sandbox environment
  - url: https://api.transmitsecurity.io/cis
    description: Production environment (US)
  - url: https://api.eu.transmitsecurity.io/cis
    description: Production environment (EU)
  - url: https://api.ca.transmitsecurity.io/cis
    description: Production environment (CA)
  - url: https://api.au.transmitsecurity.io/cis
    description: Production environment (AU)
security: []
paths:
  /scim/Users:
    post:
      operationId: scimCreateUser
      summary: Create user
      description: >-
        Add a user to Transmit using SCIM protocol. <br><br>**Required
        permissions**: `apps:create`, `[appId]:create`, `users:create`.
      parameters:
        - name: Accept
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
        - name: Content-Type
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiCreateScimUserInputDto'
      responses:
        '201':
          description: The user has been successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiScimUser'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScimHttpError'
      security:
        - ClientAccessToken: []
    get:
      operationId: scimGetUsersGetRequest
      summary: Get scim users
      description: >-
        Search across your application’s users at Transmit. This endpoint also
        allows you to return all of your application’s users by sending no
        filters at all. <br><br>**Required permissions**: `apps:read`,
        `[appId]:read`, `users:read`, `apps:list`, `[appId]:list`, `users:list`.
      parameters:
        - name: startIndex
          required: false
          in: query
          description: The 1-based index of the first query result
          schema:
            default: 1
            type: number
        - name: count
          required: false
          in: query
          description: Number of users to return in page
          schema:
            maximum: 10000
            default: 1000
            type: number
        - name: sortBy
          required: false
          in: query
          description: The name of the field you wish to sort by
          schema:
            default: meta.created
            enum:
              - emails
              - phoneNumbers
              - meta.created
              - lastAuth
            type: string
        - name: sortOrder
          required: false
          in: query
          description: The order of the sort
          schema:
            default: asc
            enum:
              - asc
              - desc
            type: string
        - name: filter
          required: false
          in: query
          description: >-
            Search expression based on the [SCIM
            protocol](https://www.rfc-editor.org/rfc/rfc7644#section-3.4.2.2).
            For syntax and searchable fields, see [Search query
            syntax](/openapi/scim_search_syntax/)
          schema:
            type: string
        - name: attributes
          required: false
          in: query
          description: >-
            The names of the user's attributes to return in the response,
            overriding the set of attributes that would be returned by default
          schema:
            type: array
            items:
              type: string
        - name: excludedAttributes
          required: false
          in: query
          description: >-
            The names of the user's attributes to be removed from the default
            set of attributes to return
          schema:
            type: array
            items:
              type: string
        - name: Accept
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiGetAllScimUsersOutput'
      security:
        - ClientAccessToken: []
  /scim/Users/.search:
    post:
      operationId: scimGetUsersPostRequest
      summary: Get scim users
      description: >-
        Search across your application’s users at Transmit. This endpoint also
        allows you to return all of your application’s users by sending no
        filters at all. <br><br>**Required permissions**: `apps:read`,
        `[appId]:read`, `users:read`, `apps:list`, `[appId]:list`, `users:list`.
      parameters:
        - name: Accept
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
        - name: Content-Type
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetScimUsersQueryParamsPostRequest'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiGetAllScimUsersOutput'
      security:
        - ClientAccessToken: []
  /scim/Users/{user_id}:
    get:
      operationId: scimGetUserById
      summary: Get SCIM user by ID
      description: >-
        Search for a SCIM user by user ID. <br><br>**Required permissions**:
        `apps:read`, `[appId]:read`, `users:read`.
      parameters:
        - name: user_id
          required: true
          in: path
          description: The user ID to search for
          schema:
            type: string
        - name: Accept
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiScimUser'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScimHttpError'
      security:
        - ClientAccessToken: []
    put:
      operationId: scimReplaceUserAttributes
      summary: Replace user attributes
      description: >-
        Replace user attributes using SCIM protocol. <br><br>**Required
        permissions**: `apps:edit`, `[appId]:edit`, `users:edit`.
      parameters:
        - name: user_id
          required: true
          in: path
          description: ID of the user
          schema:
            type: string
        - name: Accept
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
        - name: Content-Type
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiReplaceScimUserInputDto'
      responses:
        '200':
          description: The user attributes have been successfully replaced.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiScimUser'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScimHttpError'
      security:
        - ClientAccessToken: []
    delete:
      operationId: scimDeleteUserById
      summary: Delete SCIM user by ID
      description: >-
        Delete a user from Transmit using SCIM protocol. <br><br>**Required
        permissions**: `apps:delete`, `[appId]:delete`, `users:delete`.
      parameters:
        - name: user_id
          required: true
          in: path
          description: The user ID to delete
          schema:
            type: string
        - name: Accept
          in: header
          description: application/scim+json
          required: true
          schema:
            type: string
      responses:
        '204':
          description: The user has been successfully deleted.
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScimHttpError'
      security:
        - ClientAccessToken: []
components:
  schemas:
    ApiGetAllScimUsersOutput:
      type: object
      properties:
        schemas:
          description: Schema uri
          type: array
          items:
            type: string
        totalResults:
          type: number
          description: Number of total user results
        Resources:
          description: The returned users
          type: array
          items:
            $ref: '#/components/schemas/ApiScimUser'
        startIndex:
          type: number
          description: >-
            The 1-based index of the first result in the current set of list
            results
        itemsPerPage:
          type: number
          description: The number of resources returned in a list response page
      required:
        - schemas
        - Resources
    ApiCreateScimUserInputDto:
      type: object
      properties:
        name:
          description: Full name
          allOf:
            - $ref: '#/components/schemas/ApiScimUserName'
        preferredLanguage:
          type: string
          description: The preferred language of the user
        emails:
          description: The emails for the user
          type: array
          items:
            $ref: '#/components/schemas/ApiScimUserEmail'
        phoneNumbers:
          description: The phone numbers for the user
          type: array
          items:
            $ref: '#/components/schemas/ApiScimUserPhoneNumber'
        photos:
          description: The photos for the user, only 1 can be sent
          type: array
          items:
            type: string
        addresses:
          description: The addresses for the user, only 1 can be stored
          type: array
          items:
            $ref: '#/components/schemas/ApiScimUserAddress'
        schemas:
          type: array
          description: >-
            One or more schemas that are used in the API call. The core schema
            'urn:ietf:params:scim:schemas:core:2.0:User' must be always
            specified.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:schemas:core:2.0:User
              - urn:ietf:params:scim:schemas:extension:CustomAppData:2.0:User
        urn:ietf:params:scim:schemas:extension:CustomAppData:2.0:User:
          type: object
          description: Custom app data object for app-related user info
        externalId:
          type: string
          description: A unique identifier in a tenant
        active:
          type: boolean
          description: A Boolean value indicating the user's administrative status
        userName:
          type: string
          description: Unique identifier for the user
        password:
          type: string
          description: The password for the user
        hashed_password:
          description: The hashed password for the user
          allOf:
            - $ref: '#/components/schemas/ApiHashedPasswordDto'
      required:
        - schemas
        - userName
    ApiScimUser:
      type: object
      properties:
        schemas:
          description: >-
            List of included SCIM schemas that are used to indicate the
            attributes contained within a resource.
          type: array
          items:
            type: string
        userName:
          type: string
          description: >-
            Unique identifier of the user. In Transmit, the username can be used
            for password authentication unless a primary email is used instead.
        name:
          description: Full name
          allOf:
            - $ref: '#/components/schemas/ApiScimUserName'
        displayName:
          type: string
          description: The name of the user, suitable for display to end-users
        preferredLanguage:
          type: string
          description: |-
            Indicates the user's preferred written or spoken languages and is
                  generally used for selecting a localized user interface
        active:
          type: boolean
          description: A Boolean value indicating the user's administrative status
        emails:
          description: Email addresses for the user.
          type: array
          items:
            type: string
        phoneNumbers:
          description: Phone numbers for the user.
          type: array
          items:
            type: string
        photos:
          description: >-
            A URI that is a uniform resource locator (as defined in Section
            1.1.3 of [RFC3986]) that points to a resource location representing
            the user's image.
          type: array
          items:
            type: string
        addresses:
          description: The user's addresses
          type: array
          items:
            type: string
        id:
          type: string
          description: The ID of the user
        externalId:
          type: string
          description: The external ID of the user
        meta:
          description: A complex attribute containing resource metadata
          allOf:
            - $ref: '#/components/schemas/ApiScimMetaData'
        urn:ietf:params:scim:schemas:extension:CustomAppData:2.0:User:
          type: object
          description: Custom app data object for app-related user info
        urn:ietf:params:scim:schemas:extension:UserExtended:2.0:User:
          description: Extended user fields
          allOf:
            - $ref: '#/components/schemas/ApiUserExtendedScimDto'
      required:
        - schemas
        - userName
        - id
        - meta
        - urn:ietf:params:scim:schemas:extension:UserExtended:2.0:User
    ScimHttpError:
      type: object
      properties:
        schemas:
          type: string
        status:
          type: number
          example: 404
        detail:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
      required:
        - schemas
        - status
    GetScimUsersQueryParamsPostRequest:
      type: object
      properties:
        startIndex:
          type: number
          description: The 1-based index of the first query result
          default: 1
        count:
          type: number
          description: Number of users to return in page
          maximum: 10000
          default: 1000
        sortBy:
          type: string
          description: The name of the field you wish to sort by
          enum:
            - emails
            - phoneNumbers
            - meta.created
            - lastAuth
          default: meta.created
        sortOrder:
          type: string
          description: The order of the sort
          enum:
            - asc
            - desc
          default: asc
        filter:
          type: string
          description: >-
            Search expression based on the [SCIM
            protocol](https://www.rfc-editor.org/rfc/rfc7644#section-3.4.2.2).
            For syntax and searchable fields, see [Search query
            syntax](/openapi/scim_search_syntax/)
        attributes:
          description: >-
            The names of the user's attributes to return in the response,
            overriding the set of attributes that would be returned by default
          type: array
          items:
            type: string
        excludedAttributes:
          description: >-
            The names of the user's attributes to be removed from the default
            set of attributes to return
          type: array
          items:
            type: string
        schemas:
          type: array
          description: >-
            Schemas should be always set to
            ["urn:ietf:params:scim:api:messages:2.0:SearchRequest"]
          items:
            type: string
            enum:
              - urn:ietf:params:scim:api:messages:2.0:SearchRequest
      required:
        - schemas
    ApiReplaceScimUserInputDto:
      type: object
      properties:
        name:
          description: Full name
          allOf:
            - $ref: '#/components/schemas/ApiScimUserName'
        preferredLanguage:
          type: string
          description: The preferred language of the user
        emails:
          description: The emails for the user
          type: array
          items:
            $ref: '#/components/schemas/ApiScimUserEmail'
        phoneNumbers:
          description: The phone numbers for the user
          type: array
          items:
            $ref: '#/components/schemas/ApiScimUserPhoneNumber'
        photos:
          description: The photos for the user, only 1 can be sent
          type: array
          items:
            type: string
        addresses:
          description: The addresses for the user, only 1 can be stored
          type: array
          items:
            $ref: '#/components/schemas/ApiScimUserAddress'
        schemas:
          type: array
          description: >-
            One or more schemas that are used in the API call. The core schema
            'urn:ietf:params:scim:schemas:core:2.0:User' must be always
            specified.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:schemas:core:2.0:User
              - urn:ietf:params:scim:schemas:extension:CustomAppData:2.0:User
        urn:ietf:params:scim:schemas:extension:CustomAppData:2.0:User:
          type: object
          description: Custom app data object for app-related user info
        externalId:
          type: string
          description: A unique identifier in a tenant
        active:
          type: boolean
          description: A Boolean value indicating the user's administrative status
        userName:
          type: string
          description: Unique identifier for the user
        password:
          type: string
          description: The password for the user
        hashed_password:
          description: The hashed password for the user
          allOf:
            - $ref: '#/components/schemas/ApiHashedPasswordDto'
      required:
        - schemas
    ApiScimUserEmail:
      type: object
      properties:
        value:
          type: string
          description: Email
        primary:
          type: boolean
          description: Indicates if email is the primary email of the user
          default: false
      required:
        - value
    ApiScimUserPhoneNumber:
      type: object
      properties:
        value:
          type: string
          description: Phone number
        primary:
          type: boolean
          description: Indicates if phone number is the primary phone number of the user
          default: false
      required:
        - value
    ApiScimUserAddress:
      type: object
      properties:
        streetAddress:
          type: string
          description: >-
            The full street address component, which may include house number,
            street name, P.O. box, and multi-line extended street address
            information
        locality:
          type: string
          description: The city or locality component
        region:
          type: string
          description: The state or region component
        postalCode:
          type: string
          description: The zip code or postal code component
        country:
          type: string
          description: The country name component
    ApiScimUserName:
      type: object
      properties:
        honorificPrefix:
          type: string
          description: Title
        givenName:
          type: string
          description: User's first name
        familyName:
          type: string
          description: User's last name
        middleName:
          type: string
          description: User's middle name
    ApiHashedPasswordDto:
      type: object
      properties:
        password:
          type: string
        salt:
          type: string
        algorithm:
          type: string
          description: Hash type of the hashed password
          enum:
            - argon2
            - firebaseScrypt
            - bcrypt
            - sha
            - sha1
            - sha2
            - md5
            - smd5
            - sha512
            - ssha
            - ssha256
            - ssha512
            - sha256
            - aholdLegacySha256
      required:
        - password
        - algorithm
    ApiScimMetaData:
      type: object
      properties:
        resourceType:
          type: string
          description: Resource type
        created:
          format: date-time
          type: string
          description: The date time that the resource was created
        lastModified:
          format: date-time
          type: string
          description: The date time that the resource was last modified
        location:
          type: string
          description: The URI of the resource
    ApiUserExtendedScimDto:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/Status'
        lastAuth:
          format: date-time
          type: string
          description: The last time the user authenticated
        passwordInformation:
          description: Password information
          allOf:
            - $ref: '#/components/schemas/ApiPasswordInformation'
      required:
        - status
        - lastAuth
        - passwordInformation
    Status:
      type: string
      enum:
        - Active
        - Disabled
        - Pending
    ApiPasswordInformation:
      type: object
      properties:
        expired:
          type: boolean
          description: Whether the password is currently expired
        temporary:
          type: boolean
          description: Whether the password must be reset after first use
        updated_at:
          type: number
          description: >-
            The date the password was last updated, as unix epoch in
            milliseconds
        expires_in:
          format: date-time
          type: string
          description: The date the password will be expired
      required:
        - expired
        - temporary
        - updated_at
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
    UserAccessToken:
      type: http
      description: >-
        A token returned upon end-user authentication, which provides access to
        resources and data for the user and app for which it was generated
      scheme: bearer
      bearerFormat: JWT
    AdminAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token generated by a management application using the [token
        endpoint](/openapi/token.openapi/other/getaccesstoken). It provides
        access to all resources for the tenant and its apps
    ClientAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token generated by an end-user application using the [token
        endpoint](/openapi/token.openapi/other/getaccesstoken). It provides
        access to resources and data on the tenant level or associated with the
        specific application (but not other apps in the tenant)
    OrgAdminAccessToken:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: /oidc/token
          scopes: {}
      description: >-
        A token returned upon B2B authentication for a user that has the
        organizationAdmin or organizationCreator role.
