Skip to main content
This page is about sending events out to a receiver you run. To read the SCIM requests your identity provider sent in, see Review received SCIM requests.
SCIM Events tell your systems when Living Security’s SCIM service creates, changes, deactivates or deletes a user or group. Each event is a signed Security Event Token (SET), as RFC 9967 defines, pushed to an HTTPS receiver you run.

What you need

  • A native SCIM connection on the organization.
  • The Manage Identity Provider permission.
  • An HTTPS receiver on the public internet. Living Security does not send events to private, loopback, link-local or cloud metadata addresses, and does not follow redirects.

Add a receiver

Add up to five receivers to a connection. For each receiver, choose:

What your receiver gets

Each event is an HTTP POST with Content-Type: application/secevent+jwt. The body is a compact JWS signed with ES256. The SET has these claims: A notice event lists the changed attributes, for example { "attributes": ["emails", "title"] }. A full event carries data. A delete event is empty.

Verify each event

  1. Read the kid from the JWS header.
  2. Get your region’s public keys from {regional API host}/api/v1/scim/events/jwks.json. Cache them, and fetch them again when you see a kid you do not know.
  3. Check the signature, typ (secevent+jwt), iss and aud.
  4. Store the event, then answer 202 Accepted. Use jti to drop duplicates.
To refuse an event, answer 400 with { "err": "invalid_audience" } or another RFC 8935 error code.

Delivery and failures

  • Events arrive in the order of the changes. When there is no backlog, an event arrives within about five minutes of its change.
  • Each receiver gets at most 25 events every two minutes. A burst of changes therefore takes longer: for example, 100 changes take at least eight minutes to deliver.
  • Only 202 counts as delivered. A server error, a timeout or any other success code is retried with the same jti.
  • An event your receiver refuses with a 4xx is not sent again. The SCIM card shows the error.
  • After a day of failures, at least ten in a row, the receiver becomes dead and gets no events. A receiver whose address becomes private is dead at once. Resume it on the SCIM card after you fix it; delivery continues from where it stopped.

Discovery

While a connection has an active receiver, its ServiceProviderConfig includes securityEvents with the event URIs it sends and "asyncRequest": "none". Living Security does not support Prefer: respond-async or polled delivery (RFC 8936).