SCIM API not available in IdentityIQ8.4

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.4

Hi Sailors,

Would like to know how to enable SCIM API in my identityIQ?

2

hi @Bernardc

In IdentityIQ 8.4, SCIM support is available through the IdentityIQ SCIM Service. To enable it, you typically need to:

  1. Verify that the SCIM feature is licensed and included in your deployment.
  2. Deploy and configure the SCIM web application/service as documented for your IIQ version.
  3. Configure authentication (commonly OAuth/JWT or the method supported in your environment).
  4. Update the SCIM configuration and endpoint settings.
  5. Restart the application server and validate the SCIM endpoints.
  6. Some helpful links

identityiq-scim-rest-api | SailPoint Developer Community

API Specifications | SailPoint Developer Community

3

Hi @haideralishaik ,

Am I right to say that enabling SCIM feature require additional license? It is not by default available for normal IIQ setup?

4

hi @Bernardc

I’m not entirely sure that SCIM requires a separate license in all IdentityIQ deployments. My understanding is that SCIM support depends on the IdentityIQ version and how the environment has been deployed/configured. The API documentation describes the SCIM endpoints and functionality, but I haven’t seen documentation explicitly stating that SCIM always requires an additional license or that it is enabled by default in every installation.

To be certain for your environment, I would recommend checking with SailPoint Support or your account representative, as they can confirm the features included with your licensed deployment. Has anyone from SailPoint been able to clarify the licensing requirements for SCIM in IIQ 8.4?

Thanks!

5

Hi @haideralishaik ,

When I try to call the SCIM Rest API, below error return:

{
    "status": "404",
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:Error"
    ]
}

It seems like SCIM v2 REST service is not installed and enabled in that IIQ environment.

6

hi @Bernardc

404 response from the SCIM endpoint typically indicates that the requested SCIM resource or endpoint is not available on the server. Based on the response you’ve shared, it does suggest that the SCIM service may not be deployed or enabled in that IdentityIQ environment.

A few things to verify:

  • Confirm the SCIM URL is correct (for example, the expected /scim/v2 path for your deployment).
  • Verify that the SCIM web application/service has been deployed and started successfully.
  • Check the application server logs for deployment or startup errors related to SCIM.
  • Validate that the environment and IIQ version support the SCIM endpoints you’re attempting to access.

If the endpoint itself is unavailable, a 404 is generally seen before authentication or authorization is even evaluated. Sharing the exact URL you’re calling (with sensitive details removed) may help identify whether it’s a deployment issue or simply an incorrect endpoint path.

7

Hi @haideralishaik ,

{"status":"404","schemas":["urn:ietf:params:scim:api:messages:2.0:Error"]}

The 404 error come after authentication

image
image1327×305 9.98 KB

8

hi @Bernardc

Thanks for sharing the screenshot.

Since you’re getting the browser authentication prompt and the request proceeds past authentication, it looks like the server is reachable and accepting the authentication challenge. The fact that the response is a SCIM-formatted 404.

Suggests that the SCIM application is responding, but the requested resource is not being found.

A few things I’d verify:

  • The exact endpoint URL and context path (/identityiq/scim/v2/Users).
  • Whether the SCIM application was deployed successfully without startup errors.
  • Access to discovery endpoints such as /identityiq/scim/v2/ServiceProviderConfig or /identityiq/scim/v2/ResourceTypes.
  • Application server logs for any SCIM-related errors when the request is received.

Since the error is being returned after authentication, this may not necessarily indicate that SCIM is not installed. It could also be an endpoint mapping, deployment, or configuration issue.

Do the /ServiceProviderConfig or /ResourceTypes endpoints return a valid response in your environment? That would help narrow down whether the SCIM service is up and running.

9

Hi @haideralishaik ,

It works now! Found out it is because additional / type in the URL.