Access-review and identity-governance tools can read your Compound team roster through the SCIM 2.0 API. Each user comes back with their email, their status, and their Compound role, so the tool can review who has access to Compound and at what level.
Prerequisites
- SCIM provisioning enabled for your team. See SCIM Provisioning to enable it in Settings > Organization > Security.
- The SCIM Endpoint URL and the bearer token that Compound shows when you enable SCIM. If you no longer have the token, rotate it in Settings > Organization > Security and update every tool that uses it.
Your identity provider and your access-review tool can share the same endpoint and token.
Authentication
Send the bearer token in the Authorization header of every request:
Authorization: Bearer <SCIM bearer token>
A missing, wrong or revoked token, or a team with SCIM disabled, returns 401 Unauthorized with the body {"detail": "Invalid credentials"}. Responses use the content type application/scim+json.
Endpoints
All paths are relative to your SCIM Endpoint URL, which has the form https://<your Compound host>/scim/v2/<team id>/.
| Method and path | Returns |
|---|---|
GET /ServiceProviderConfig | The SCIM features Compound supports |
GET /Users | A page of users, with optional paging and filter |
GET /Users/{id} | One user |
List users
GET {SCIM Endpoint URL}/Users?startIndex=1&count=100
Authorization: Bearer <SCIM bearer token>
{
"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
"totalResults": 2,
"startIndex": 1,
"itemsPerPage": 2,
"Resources": [
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"id": "a1b2c3",
"externalId": "00u1abcd",
"userName": "jane@example.com",
"name": { "givenName": "Jane", "familyName": "Doe" },
"displayName": "Jane Doe",
"emails": [{ "value": "jane@example.com", "type": "work", "primary": true }],
"active": true,
"roles": [{ "value": "admin", "primary": true }],
"meta": {
"resourceType": "User",
"created": "2026-03-02T17:04:11Z",
"lastModified": "2026-09-14T08:30:00Z",
"location": "{SCIM Endpoint URL}/Users/a1b2c3"
}
},
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"id": "d4e5f6",
"externalId": "00u9wxyz",
"userName": "sam@example.com",
"name": { "givenName": "Sam", "familyName": "Lee" },
"displayName": "Sam Lee",
"emails": [{ "value": "sam@example.com", "type": "work", "primary": true }],
"active": false,
"meta": {
"resourceType": "User",
"created": "2026-01-20T12:00:00Z",
"lastModified": "2026-10-01T09:15:00Z",
"location": "{SCIM Endpoint URL}/Users/d4e5f6"
}
}
]
}
The list includes:
- Every current member of your team, including members who joined before SCIM was enabled.
- Users your identity provider deprovisioned, with
"active": false.
Paging
startIndex is 1-based and defaults to 1. count defaults to 100. Users are returned in a stable order, so a tool can read the whole roster by requesting pages until it has read totalResults users.
Filters
GET /Users accepts one filter at a time:
| Filter | Matching |
|---|---|
userName eq "jane@example.com" | Case-insensitive |
externalId eq "00u1abcd" | Case-sensitive |
URL-encode the filter, for example ?filter=userName%20eq%20%22jane%40example.com%22. Other operators and combined filters (and, or) return 400 Bad Request.
User attributes
| Attribute | Value |
|---|---|
id | Compound’s id for the user. Use it in GET /Users/{id} |
externalId | The id your identity provider assigned. Missing for a member your identity provider has not linked yet |
userName | The user’s email address |
name.givenName, name.familyName | The user’s name in Compound |
displayName | The user’s name, or the part of their email before @ when they have no name |
emails | One work email, the same as userName |
active | true while the user is a member of your team, false after they were removed |
roles | The user’s Compound role. Present only when active is true |
meta.created | When the user’s Compound account was created (UTC) |
meta.lastModified | When SCIM last changed the user, or meta.created if it never did (UTC) |
Roles
Each active user has exactly one role, returned as "roles": [{"value": "<role>", "primary": true}]:
value | Role | Access |
|---|---|---|
owner | Owner | Full control of the team, including billing, SSO, SCIM, member removal and team deletion. A team has exactly one Owner |
admin | Admin | Invites and removes members, manages billing and views the audit log |
manager | Manager | Manages groups, project agent properties and Organization Knowledge files, and views and exports the audit log |
member | Member | Standard access: creates agents, gives them tasks, and works in agents shared with them |
Roles are read-only over SCIM. Compound ignores roles in PUT and PATCH requests. Change a member’s role in Settings > Organization > Members.
Members who joined before SCIM
A member who was invited before SCIM was enabled is listed with no externalId. Your identity provider links them by sending a PUT or PATCH with their externalId. Compound links a member only when their current sign-in address is on your team’s verified domain, and refuses to deprovision a member who is not linked, so link them first. Remove a member whose address is off your domain in Settings > Organization > Members.
SCIM changes a user’s email or name only after the user is linked, and never changes the Owner’s email or name.
Errors
Every error other than 401 uses the SCIM error format:
{
"schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
"detail": "User d4e5f6 not found",
"status": "404"
}
| Status | Cause |
|---|---|
400 | Unsupported filter or malformed request |
404 | No user with that id on your team |
Supported SCIM features
GET /ServiceProviderConfig reports what Compound supports: filtering and PATCH are supported; bulk operations, sorting, ETags and password changes are not. Compound supports the SCIM User resource only, not Groups.