Add SCIM management

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2026-01-04 19:03:00 +01:00
parent b6799cbb01
commit cfc514c8e0
405 changed files with 4888 additions and 88927 deletions
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -75,6 +75,8 @@ const (
 	StateOfApplicabilityEntityType             uint16 = 49
 	StateOfApplicabilityControlEntityType      uint16 = 50
 	MembershipProfileEntityType                uint16 = 51
+	SCIMConfigurationEntityType                uint16 = 52
+	SCIMEventEntityType                        uint16 = 53
 )

 func NewEntityFromID(id gid.GID) (any, bool) {
@@ -173,8 +175,14 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &DataProtectionImpactAssessment{ID: id}, true
 	case TransferImpactAssessmentEntityType:
 		return &TransferImpactAssessment{ID: id}, true
+	case RightsRequestEntityType:
+		return &RightsRequest{ID: id}, true
 	case MembershipProfileEntityType:
 		return &MembershipProfile{ID: id}, true
+	case SCIMConfigurationEntityType:
+		return &SCIMConfiguration{ID: id}, true
+	case SCIMEventEntityType:
+		return &SCIMEvent{ID: id}, true
 	default:
 		return nil, false
 	}
@@ -390,6 +398,14 @@ var entityRegistry = map[uint16]EntityInfo{
 		Model: "MembershipProfile",
 		Table: "iam_membership_profiles",
 	},
+	SCIMConfigurationEntityType: {
+		Model: "SCIMConfiguration",
+		Table: "iam_scim_configurations",
+	},
+	SCIMEventEntityType: {
+		Model: "SCIMEvent",
+		Table: "iam_scim_events",
+	},
 }

 func EntityTable(entityType uint16) (string, bool) {
--- a/pkg/coredata/membership.go
+++ b/pkg/coredata/membership.go
@@ -393,6 +393,7 @@ UPDATE
    iam_memberships
 SET
    role = @role,
+    source = @source,
    updated_at = @updated_at
 WHERE
    id = @id
@@ -404,6 +405,7 @@ WHERE
 	args := pgx.StrictNamedArgs{
 		"id":         m.ID,
 		"role":       m.Role,
+		"source":     m.Source,
 		"updated_at": m.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())
@@ -672,3 +674,35 @@ WHERE
 	*m = memberships
 	return nil
 }
+
+func (m *Memberships) ResetSCIMSources(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) error {
+	q := `
+UPDATE iam_memberships
+SET
+    source = 'MANUAL',
+    updated_at = @updated_at
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND source = 'SCIM'
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{
+		"organization_id": organizationID,
+		"updated_at":      time.Now(),
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot reset SCIM membership sources: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/membership_source.go
+++ b/pkg/coredata/membership_source.go
@@ -24,6 +24,7 @@ type MembershipSource string
 const (
 	MembershipSourceManual MembershipSource = "MANUAL"
 	MembershipSourceSAML   MembershipSource = "SAML"
+	MembershipSourceSCIM   MembershipSource = "SCIM"
 )

 func (s MembershipSource) String() string {
@@ -46,6 +47,8 @@ func (s *MembershipSource) Scan(value any) error {
 		*s = MembershipSourceManual
 	case "SAML":
 		*s = MembershipSourceSAML
+	case "SCIM":
+		*s = MembershipSourceSCIM
 	default:
 		return fmt.Errorf("invalid MembershipSource value: %q", str)
 	}
--- a/pkg/coredata/migrations/20260104T155201Z.sql
+++ b/pkg/coredata/migrations/20260104T155201Z.sql
@@ -0,0 +1,14 @@
+-- Create SCIM configurations table
+CREATE TABLE iam_scim_configurations (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    hashed_token BYTEA NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    CONSTRAINT iam_scim_configurations_organization_unique UNIQUE (organization_id)
+);
+
+CREATE INDEX idx_iam_scim_configurations_tenant_id ON iam_scim_configurations(tenant_id);
+CREATE INDEX idx_iam_scim_configurations_organization_id ON iam_scim_configurations(organization_id);
+
--- a/pkg/coredata/migrations/20260104T155202Z.sql
+++ b/pkg/coredata/migrations/20260104T155202Z.sql
@@ -0,0 +1,22 @@
+-- Create SCIM events table for debugging/audit
+CREATE TABLE iam_scim_events (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    scim_configuration_id TEXT NOT NULL REFERENCES iam_scim_configurations(id) ON DELETE CASCADE,
+    method TEXT NOT NULL,
+    path TEXT NOT NULL,
+    request_body TEXT,
+    response_body TEXT,
+    status_code INTEGER NOT NULL,
+    error_message TEXT,
+    membership_id TEXT REFERENCES iam_memberships(id) ON DELETE SET NULL,
+    ip_address INET NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+CREATE INDEX idx_iam_scim_events_tenant_id ON iam_scim_events(tenant_id);
+CREATE INDEX idx_iam_scim_events_organization_id ON iam_scim_events(organization_id);
+CREATE INDEX idx_iam_scim_events_scim_configuration_id ON iam_scim_events(scim_configuration_id);
+CREATE INDEX idx_iam_scim_events_created_at ON iam_scim_events(created_at DESC);
+
--- a/pkg/coredata/scim_configuration.go
+++ b/pkg/coredata/scim_configuration.go
@@ -0,0 +1,299 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	SCIMConfiguration struct {
+		ID             gid.GID   `db:"id"`
+		OrganizationID gid.GID   `db:"organization_id"`
+		HashedToken    []byte    `db:"hashed_token"`
+		CreatedAt      time.Time `db:"created_at"`
+		UpdatedAt      time.Time `db:"updated_at"`
+	}
+
+	SCIMConfigurations []*SCIMConfiguration
+)
+
+func (s *SCIMConfiguration) CursorKey(orderBy SCIMConfigurationOrderField) page.CursorKey {
+	switch orderBy {
+	case SCIMConfigurationOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (s *SCIMConfiguration) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
+	q := `SELECT organization_id FROM iam_scim_configurations WHERE id = $1 LIMIT 1;`
+
+	var organizationID gid.GID
+	if err := conn.QueryRow(ctx, q, s.ID).Scan(&organizationID); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrResourceNotFound
+		}
+		return nil, fmt.Errorf("cannot query scim configuration authorization attributes: %w", err)
+	}
+
+	return map[string]string{"organization_id": organizationID.String()}, nil
+}
+
+func (s *SCIMConfiguration) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	configID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    hashed_token,
+    created_at,
+    updated_at
+FROM
+    iam_scim_configurations
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": configID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_configurations: %w", err)
+	}
+
+	config, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMConfiguration])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_configuration: %w", err)
+	}
+
+	*s = config
+
+	return nil
+}
+
+func (s *SCIMConfiguration) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    hashed_token,
+    created_at,
+    updated_at
+FROM
+    iam_scim_configurations
+WHERE
+    %s
+    AND organization_id = @organization_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_configurations: %w", err)
+	}
+
+	config, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMConfiguration])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_configuration: %w", err)
+	}
+
+	*s = config
+
+	return nil
+}
+
+func (s *SCIMConfiguration) LoadByHashedToken(
+	ctx context.Context,
+	conn pg.Conn,
+	hashedToken []byte,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    hashed_token,
+    created_at,
+    updated_at
+FROM
+    iam_scim_configurations
+WHERE
+    hashed_token = @hashed_token
+LIMIT 1;
+`
+
+	args := pgx.StrictNamedArgs{"hashed_token": hashedToken}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_configurations: %w", err)
+	}
+
+	config, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMConfiguration])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_configuration: %w", err)
+	}
+
+	*s = config
+
+	return nil
+}
+
+func (s *SCIMConfiguration) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO iam_scim_configurations (
+    id,
+    tenant_id,
+    organization_id,
+    hashed_token,
+    created_at,
+    updated_at
+) VALUES (
+    @id,
+    @tenant_id,
+    @organization_id,
+    @hashed_token,
+    @created_at,
+    @updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":              s.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"organization_id": s.OrganizationID,
+		"hashed_token":    s.HashedToken,
+		"created_at":      s.CreatedAt,
+		"updated_at":      s.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "iam_scim_configurations_organization_unique" {
+				return ErrResourceAlreadyExists
+			}
+		}
+
+		return fmt.Errorf("cannot insert scim_configuration: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMConfiguration) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE iam_scim_configurations
+SET
+    hashed_token = @hashed_token,
+    updated_at = @updated_at
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":           s.ID,
+		"hashed_token": s.HashedToken,
+		"updated_at":   s.UpdatedAt,
+	}
+
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update scim_configuration: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMConfiguration) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM iam_scim_configurations
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": s.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete scim_configuration: %w", err)
+	}
+
+	return nil
+}
--- a/pkg/coredata/scim_configuration_order_field.go
+++ b/pkg/coredata/scim_configuration_order_field.go
@@ -0,0 +1,40 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	SCIMConfigurationOrderField string
+)
+
+const (
+	SCIMConfigurationOrderFieldCreatedAt SCIMConfigurationOrderField = "CREATED_AT"
+)
+
+func (p SCIMConfigurationOrderField) Column() string {
+	return string(p)
+}
+
+func (p SCIMConfigurationOrderField) String() string {
+	return string(p)
+}
+
+func (p SCIMConfigurationOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *SCIMConfigurationOrderField) UnmarshalText(text []byte) error {
+	*p = SCIMConfigurationOrderField(text)
+	return nil
+}
--- a/pkg/coredata/scim_event.go
+++ b/pkg/coredata/scim_event.go
@@ -0,0 +1,344 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"net"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	SCIMEvent struct {
+		ID                  gid.GID   `db:"id"`
+		OrganizationID      gid.GID   `db:"organization_id"`
+		SCIMConfigurationID gid.GID   `db:"scim_configuration_id"`
+		Method              string    `db:"method"`
+		Path                string    `db:"path"`
+		RequestBody         *string   `db:"request_body"`
+		ResponseBody        *string   `db:"response_body"`
+		StatusCode          int       `db:"status_code"`
+		ErrorMessage        *string   `db:"error_message"`
+		MembershipID        *gid.GID  `db:"membership_id"`
+		IPAddress           net.IP    `db:"ip_address"`
+		CreatedAt           time.Time `db:"created_at"`
+	}
+
+	SCIMEvents []*SCIMEvent
+)
+
+func (s *SCIMEvent) CursorKey(orderBy SCIMEventOrderField) page.CursorKey {
+	switch orderBy {
+	case SCIMEventOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (s *SCIMEvent) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
+	q := `SELECT organization_id FROM iam_scim_events WHERE id = $1 LIMIT 1;`
+
+	var organizationID gid.GID
+	if err := conn.QueryRow(ctx, q, s.ID).Scan(&organizationID); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrResourceNotFound
+		}
+		return nil, fmt.Errorf("cannot query scim event authorization attributes: %w", err)
+	}
+
+	return map[string]string{"organization_id": organizationID.String()}, nil
+}
+
+func (s *SCIMEvent) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	eventID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    method,
+    path,
+    request_body,
+    response_body,
+    status_code,
+    error_message,
+    membership_id,
+    ip_address,
+    created_at
+FROM
+    iam_scim_events
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": eventID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_events: %w", err)
+	}
+
+	event, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMEvent])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_event: %w", err)
+	}
+
+	*s = event
+
+	return nil
+}
+
+func (s *SCIMEvent) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO iam_scim_events (
+    id,
+    tenant_id,
+    organization_id,
+    scim_configuration_id,
+    method,
+    path,
+    request_body,
+    response_body,
+    status_code,
+    error_message,
+    membership_id,
+    ip_address,
+    created_at
+) VALUES (
+    @id,
+    @tenant_id,
+    @organization_id,
+    @scim_configuration_id,
+    @method,
+    @path,
+    @request_body,
+    @response_body,
+    @status_code,
+    @error_message,
+    @membership_id,
+    @ip_address,
+    @created_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                    s.ID,
+		"tenant_id":             scope.GetTenantID(),
+		"organization_id":       s.OrganizationID,
+		"scim_configuration_id": s.SCIMConfigurationID,
+		"method":                s.Method,
+		"path":                  s.Path,
+		"request_body":          s.RequestBody,
+		"response_body":         s.ResponseBody,
+		"status_code":           s.StatusCode,
+		"error_message":         s.ErrorMessage,
+		"membership_id":         s.MembershipID,
+		"ip_address":            s.IPAddress,
+		"created_at":            s.CreatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert scim_event: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMEvents) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[SCIMEventOrderField],
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    method,
+    path,
+    request_body,
+    response_body,
+    status_code,
+    error_message,
+    membership_id,
+    ip_address,
+    created_at
+FROM
+    iam_scim_events
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_events: %w", err)
+	}
+
+	events, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[SCIMEvent])
+	if err != nil {
+		return fmt.Errorf("cannot collect scim_events: %w", err)
+	}
+
+	*s = events
+
+	return nil
+}
+
+func (s *SCIMEvents) CountByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+    COUNT(*)
+FROM
+    iam_scim_events
+WHERE
+    %s
+    AND organization_id = @organization_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot count scim_events: %w", err)
+	}
+
+	return count, nil
+}
+
+func (s *SCIMEvents) LoadBySCIMConfigurationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	scimConfigurationID gid.GID,
+	cursor *page.Cursor[SCIMEventOrderField],
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    method,
+    path,
+    request_body,
+    response_body,
+    status_code,
+    error_message,
+    membership_id,
+    ip_address,
+    created_at
+FROM
+    iam_scim_events
+WHERE
+    %s
+    AND scim_configuration_id = @scim_configuration_id
+    AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"scim_configuration_id": scimConfigurationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_events: %w", err)
+	}
+
+	events, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[SCIMEvent])
+	if err != nil {
+		return fmt.Errorf("cannot collect scim_events: %w", err)
+	}
+
+	*s = events
+
+	return nil
+}
+
+func (s *SCIMEvents) CountBySCIMConfigurationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	scimConfigurationID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+    COUNT(*)
+FROM
+    iam_scim_events
+WHERE
+    %s
+    AND scim_configuration_id = @scim_configuration_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"scim_configuration_id": scimConfigurationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot count scim_events: %w", err)
+	}
+
+	return count, nil
+}
--- a/pkg/coredata/scim_event_order_field.go
+++ b/pkg/coredata/scim_event_order_field.go
@@ -0,0 +1,40 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	SCIMEventOrderField string
+)
+
+const (
+	SCIMEventOrderFieldCreatedAt SCIMEventOrderField = "CREATED_AT"
+)
+
+func (p SCIMEventOrderField) Column() string {
+	return string(p)
+}
+
+func (p SCIMEventOrderField) String() string {
+	return string(p)
+}
+
+func (p SCIMEventOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *SCIMEventOrderField) UnmarshalText(text []byte) error {
+	*p = SCIMEventOrderField(text)
+	return nil
+}
--- a/pkg/iam/errors.go
+++ b/pkg/iam/errors.go
@@ -318,6 +318,16 @@ func (e ErrSAMLConfigurationEmailDomainAlreadyExists) Error() string {
 	return fmt.Sprintf("SAML configuration email domain %q already exists", e.EmailDomain)
 }

+type ErrNoSCIMConfigurationFound struct{ OrganizationID gid.GID }
+
+func NewNoSCIMConfigurationFoundError(organizationID gid.GID) error {
+	return &ErrNoSCIMConfigurationFound{OrganizationID: organizationID}
+}
+
+func (e ErrNoSCIMConfigurationFound) Error() string {
+	return fmt.Sprintf("SCIM configuration not found for organization %q", e.OrganizationID)
+}
+
 // TenantAccessError is used by API recovery middleware to translate authorization/tenant failures
 // into a consistent client-facing error response.
 //
--- a/pkg/iam/iam_actions.go
+++ b/pkg/iam/iam_actions.go
@@ -64,4 +64,14 @@ const (
 	ActionSAMLConfigurationUpdate = "iam:saml-configuration:update"
 	ActionSAMLConfigurationDelete = "iam:saml-configuration:delete"
 	ActionSAMLConfigurationList   = "iam:saml-configuration:list"
+
+	// SCIM Configuration actions
+	ActionSCIMConfigurationCreate = "iam:scim-configuration:create"
+	ActionSCIMConfigurationGet    = "iam:scim-configuration:get"
+	ActionSCIMConfigurationUpdate = "iam:scim-configuration:update"
+	ActionSCIMConfigurationDelete = "iam:scim-configuration:delete"
+
+	// SCIM Event actions
+	ActionSCIMEventList = "iam:scim-event:list"
+	ActionSCIMEventGet  = "iam:scim-event:get"
 )
--- a/pkg/iam/iam_policies.go
+++ b/pkg/iam/iam_policies.go
@@ -153,6 +153,16 @@ var IAMOwnerPolicy = policy.NewPolicy(
 	policy.Allow("iam:saml-configuration:*").
 		WithSID("full-saml-access").
 		When(policy.Equals("principal.organization_id", "resource.organization_id")),
+
+	// Full access to SCIM configuration management (scoped to own organization)
+	policy.Allow("iam:scim-configuration:*").
+		WithSID("full-scim-configuration-access").
+		When(policy.Equals("principal.organization_id", "resource.organization_id")),
+
+	// Full access to SCIM event viewing (scoped to own organization)
+	policy.Allow("iam:scim-event:*").
+		WithSID("full-scim-event-access").
+		When(policy.Equals("principal.organization_id", "resource.organization_id")),
 ).
 	WithDescription("Full IAM access for organization owners")

@@ -218,8 +228,25 @@ var IAMAdminPolicy = policy.NewPolicy(
 		ActionSAMLConfigurationDelete,
 	).
 		WithSID("deny-saml-management"),
+
+	// Can view SCIM configuration and events (scoped to own organization)
+	policy.Allow(
+		ActionSCIMConfigurationGet,
+		ActionSCIMEventList,
+		ActionSCIMEventGet,
+	).
+		WithSID("scim-admin-view-access").
+		When(policy.Equals("principal.organization_id", "resource.organization_id")),
+
+	// Cannot manage SCIM configurations (only owner can)
+	policy.Deny(
+		ActionSCIMConfigurationCreate,
+		ActionSCIMConfigurationUpdate,
+		ActionSCIMConfigurationDelete,
+	).
+		WithSID("deny-scim-management"),
 ).
-	WithDescription("IAM admin access - can manage members but cannot delete organization or manage SAML")
+	WithDescription("IAM admin access - can manage members but cannot delete organization or manage SAML/SCIM")

 // IAMViewerPolicy defines permissions for organization viewers.
 var IAMViewerPolicy = policy.NewPolicy(
--- a/pkg/iam/organization_service.go
+++ b/pkg/iam/organization_service.go
@@ -28,6 +28,7 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/filevalidation"
 	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam/scim"
 	"go.probo.inc/probo/pkg/mail"
 	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/statelesstoken"
@@ -1089,6 +1090,275 @@ func (s OrganizationService) CountSAMLConfigurations(
 	return count, err
 }

+func (s OrganizationService) ListSCIMEvents(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor[coredata.SCIMEventOrderField],
+) (*page.Page[*coredata.SCIMEvent, coredata.SCIMEventOrderField], error) {
+	var (
+		scope      = coredata.NewScopeFromObjectID(organizationID)
+		scimEvents = coredata.SCIMEvents{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := scimEvents.LoadByOrganizationID(ctx, conn, scope, organizationID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load scim events: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(scimEvents, cursor), nil
+}
+
+func (s OrganizationService) CountSCIMEvents(
+	ctx context.Context,
+	organizationID gid.GID,
+) (int, error) {
+	var (
+		scope = coredata.NewScopeFromObjectID(organizationID)
+		count int
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			scimEvents := coredata.SCIMEvents{}
+			count, err = scimEvents.CountByOrganizationID(ctx, conn, scope, organizationID)
+			if err != nil {
+				return fmt.Errorf("cannot count scim events: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	return count, err
+}
+
+func (s OrganizationService) GetSCIMConfiguration(
+	ctx context.Context,
+	organizationID gid.GID,
+) (*coredata.SCIMConfiguration, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(organizationID)
+		config = &coredata.SCIMConfiguration{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := config.LoadByOrganizationID(ctx, conn, scope, organizationID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewNoSCIMConfigurationFoundError(organizationID)
+				}
+
+				return fmt.Errorf("cannot load SCIM configuration: %w", err)
+			}
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return config, nil
+}
+
+func (s OrganizationService) CreateSCIMConfiguration(
+	ctx context.Context,
+	organizationID gid.GID,
+) (*coredata.SCIMConfiguration, string, error) {
+	token, err := scim.GenerateToken()
+	if err != nil {
+		return nil, "", err
+	}
+
+	hashedToken := scim.HashToken(token)
+	now := time.Now()
+
+	config := &coredata.SCIMConfiguration{
+		ID:             gid.New(organizationID.TenantID(), coredata.SCIMConfigurationEntityType),
+		OrganizationID: organizationID,
+		HashedToken:    hashedToken,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+
+	scope := coredata.NewScopeFromObjectID(organizationID)
+
+	err = s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			err := config.Insert(ctx, tx, scope)
+			if err != nil {
+				if err == coredata.ErrResourceAlreadyExists {
+					return scim.NewSCIMConfigurationAlreadyExistsError(organizationID)
+				}
+				return fmt.Errorf("cannot insert SCIM configuration: %w", err)
+			}
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, "", err
+	}
+
+	return config, token, nil
+}
+
+func (s OrganizationService) DeleteSCIMConfiguration(
+	ctx context.Context,
+	organizationID gid.GID,
+	configID gid.GID,
+) error {
+	scope := coredata.NewScopeFromObjectID(configID)
+
+	return s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			config := &coredata.SCIMConfiguration{}
+			err := config.LoadByID(ctx, tx, scope, configID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return scim.NewSCIMConfigurationNotFoundError(configID)
+				}
+
+				return fmt.Errorf("cannot load SCIM configuration: %w", err)
+			}
+
+			if config.OrganizationID != organizationID {
+				return scim.NewSCIMConfigurationNotFoundError(configID)
+			}
+
+			memberships := &coredata.Memberships{}
+			err = memberships.ResetSCIMSources(ctx, tx, scope, config.OrganizationID)
+			if err != nil {
+				return fmt.Errorf("cannot reset membership sources: %w", err)
+			}
+
+			err = config.Delete(ctx, tx, scope)
+			if err != nil {
+				return fmt.Errorf("cannot delete SCIM configuration: %w", err)
+			}
+
+			return nil
+		},
+	)
+}
+
+func (s OrganizationService) RegenerateSCIMToken(
+	ctx context.Context,
+	organizationID gid.GID,
+	configID gid.GID,
+) (*coredata.SCIMConfiguration, string, error) {
+	token, err := scim.GenerateToken()
+	if err != nil {
+		return nil, "", err
+	}
+
+	hashedToken := scim.HashToken(token)
+	config := &coredata.SCIMConfiguration{}
+	scope := coredata.NewScopeFromObjectID(configID)
+
+	err = s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			err := config.LoadByID(ctx, tx, scope, configID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return scim.NewSCIMConfigurationNotFoundError(configID)
+				}
+
+				return fmt.Errorf("cannot load SCIM configuration: %w", err)
+			}
+
+			if config.OrganizationID != organizationID {
+				return scim.NewSCIMConfigurationNotFoundError(configID)
+			}
+
+			config.HashedToken = hashedToken
+			config.UpdatedAt = time.Now()
+
+			err = config.Update(ctx, tx, scope)
+			if err != nil {
+				return fmt.Errorf("cannot update SCIM configuration: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, "", err
+	}
+
+	return config, token, nil
+}
+
+func (s OrganizationService) ListSCIMEventsByConfigID(
+	ctx context.Context,
+	scimConfigurationID gid.GID,
+	cursor *page.Cursor[coredata.SCIMEventOrderField],
+) (*page.Page[*coredata.SCIMEvent, coredata.SCIMEventOrderField], error) {
+	var (
+		scope      = coredata.NewScopeFromObjectID(scimConfigurationID)
+		scimEvents = coredata.SCIMEvents{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := scimEvents.LoadBySCIMConfigurationID(ctx, conn, scope, scimConfigurationID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load scim events: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(scimEvents, cursor), nil
+}
+
+func (s OrganizationService) CountSCIMEventsByConfigID(
+	ctx context.Context,
+	scimConfigurationID gid.GID,
+) (int, error) {
+	var (
+		scope = coredata.NewScopeFromObjectID(scimConfigurationID)
+		count int
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			scimEvents := coredata.SCIMEvents{}
+			count, err = scimEvents.CountBySCIMConfigurationID(ctx, conn, scope, scimConfigurationID)
+			if err != nil {
+				return fmt.Errorf("cannot count scim events: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	return count, err
+}
+
 func (s OrganizationService) CreateSAMLConfiguration(
 	ctx context.Context,
 	organizationID gid.GID,
--- a/pkg/iam/saml/service.go
+++ b/pkg/iam/saml/service.go
@@ -322,27 +322,40 @@ func (s *Service) HandleAssertion(
 				}
 			}

-			if role != nil {
-				membership.Role = *role
-				membership.UpdatedAt = now
+			if membership.Source != coredata.MembershipSourceSCIM {
+				needsUpdate := false

-				err = membership.Update(ctx, tx, scope)
-				if err != nil {
-					return fmt.Errorf("cannot update membership: %w", err)
+				if role != nil {
+					membership.Role = *role
+					membership.UpdatedAt = now
+					needsUpdate = true
 				}
-			}

-			memberProfile := &coredata.MembershipProfile{}
-			err = memberProfile.LoadByMembershipID(ctx, tx, scope, membership.ID)
-			if err != nil {
-				return fmt.Errorf("cannot load membership profile: %w", err)
-			}
+				if membership.Source == coredata.MembershipSourceManual {
+					membership.Source = coredata.MembershipSourceSAML
+					membership.UpdatedAt = now
+					needsUpdate = true
+				}

-			memberProfile.FullName = fullname
-			memberProfile.UpdatedAt = now
-			err = memberProfile.Update(ctx, tx, scope)
-			if err != nil {
-				return fmt.Errorf("cannot update membership profile: %w", err)
+				if needsUpdate {
+					err = membership.Update(ctx, tx, scope)
+					if err != nil {
+						return fmt.Errorf("cannot update membership: %w", err)
+					}
+				}
+
+				memberProfile := &coredata.MembershipProfile{}
+				err = memberProfile.LoadByMembershipID(ctx, tx, scope, membership.ID)
+				if err != nil {
+					return fmt.Errorf("cannot load membership profile: %w", err)
+				}
+
+				memberProfile.FullName = fullname
+				memberProfile.UpdatedAt = now
+				err = memberProfile.Update(ctx, tx, scope)
+				if err != nil {
+					return fmt.Errorf("cannot update membership profile: %w", err)
+				}
 			}

 			return nil
--- a/pkg/iam/service.go
+++ b/pkg/iam/service.go
@@ -272,3 +272,59 @@ func (s *Service) GetPersonalAPIKey(ctx context.Context, personalAPIKeyID gid.GI

 	return personalAPIKey, nil
 }
+
+func (s *Service) GetSCIMConfiguration(ctx context.Context, scimConfigurationID gid.GID) (*coredata.SCIMConfiguration, error) {
+	var (
+		scope             = coredata.NewScopeFromObjectID(scimConfigurationID)
+		scimConfiguration = &coredata.SCIMConfiguration{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := scimConfiguration.LoadByID(ctx, conn, scope, scimConfigurationID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return scim.NewSCIMConfigurationNotFoundError(scimConfigurationID)
+				}
+
+				return fmt.Errorf("cannot load SCIM configuration: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return scimConfiguration, nil
+}
+
+func (s *Service) GetSCIMEvent(ctx context.Context, scimEventID gid.GID) (*coredata.SCIMEvent, error) {
+	var (
+		scope     = coredata.NewScopeFromObjectID(scimEventID)
+		scimEvent = &coredata.SCIMEvent{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := scimEvent.LoadByID(ctx, conn, scope, scimEventID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return fmt.Errorf("SCIM event not found: %s", scimEventID)
+				}
+
+				return fmt.Errorf("cannot load SCIM event: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return scimEvent, nil
+}
--- a/pkg/probo/actions.go
+++ b/pkg/probo/actions.go
@@ -284,6 +284,7 @@ const (
 	ActionDataProtectionImpactAssessmentCreate = "core:data-protection-impact-assessment:create"
 	ActionDataProtectionImpactAssessmentUpdate = "core:data-protection-impact-assessment:update"
 	ActionDataProtectionImpactAssessmentDelete = "core:data-protection-impact-assessment:delete"
+	ActionDataProtectionImpactAssessmentExport = "core:data-protection-impact-assessment:export"

 	// TransferImpactAssessment actions
 	ActionTransferImpactAssessmentList   = "core:transfer-impact-assessment:list"
--- a/pkg/server/api/connect/v1/schema.graphql
+++ b/pkg/server/api/connect/v1/schema.graphql
@@ -123,6 +123,16 @@ type Mutation {
  deleteSAMLConfiguration(
    input: DeleteSAMLConfigurationInput!
  ): DeleteSAMLConfigurationPayload @session(required: PRESENT)
+
+  createSCIMConfiguration(
+    input: CreateSCIMConfigurationInput!
+  ): CreateSCIMConfigurationPayload @session(required: PRESENT)
+  deleteSCIMConfiguration(
+    input: DeleteSCIMConfigurationInput!
+  ): DeleteSCIMConfigurationPayload @session(required: PRESENT)
+  regenerateSCIMToken(
+    input: RegenerateSCIMTokenInput!
+  ): RegenerateSCIMTokenPayload @session(required: PRESENT)
 }

 type Identity implements Node {
@@ -216,6 +226,8 @@ type Organization implements Node {
    before: CursorKey
  ): SAMLConfigurationConnection @goField(forceResolver: true)

+  scimConfiguration: SCIMConfiguration @goField(forceResolver: true)
+
  viewerMembership: Membership @goField(forceResolver: true)

  permission(action: String!): Boolean!
@@ -239,6 +251,7 @@ enum MembershipSource
  MANUAL
    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipSourceManual")
  SAML @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipSourceSAML")
+  SCIM @goEnum(value: "go.probo.inc/probo/pkg/coredata.MembershipSourceSCIM")
 }

 type Membership implements Node {
@@ -333,6 +346,43 @@ type SSOAvailability {
  organizationId: ID
 }

+type SCIMConfiguration implements Node {
+  id: ID!
+  endpointUrl: String! @goField(forceResolver: true)
+  createdAt: Datetime!
+  updatedAt: Datetime!
+  organization: Organization @goField(forceResolver: true)
+
+  events(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: SCIMEventOrder
+  ): SCIMEventConnection @goField(forceResolver: true)
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type SCIMEvent implements Node {
+  id: ID!
+  method: String!
+  path: String!
+  statusCode: Int!
+  requestBody: String
+  responseBody: String
+  errorMessage: String
+  membership: Membership @goField(forceResolver: true)
+  ipAddress: String!
+  createdAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
 enum InvitationStatus
  @goModel(model: "go.probo.inc/probo/pkg/coredata.InvitationStatus") {
  PENDING
@@ -478,6 +528,36 @@ type SAMLConfigurationEdge {
  cursor: CursorKey!
 }

+enum SCIMEventOrderField
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SCIMEventOrderField") {
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.SCIMEventOrderFieldCreatedAt"
+    )
+}
+
+input SCIMEventOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.SCIMEventOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: SCIMEventOrderField!
+}
+
+type SCIMEventConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.SCIMEventConnection"
+  ) {
+  edges: [SCIMEventEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int @goField(forceResolver: true)
+}
+
+type SCIMEventEdge {
+  node: SCIMEvent!
+  cursor: CursorKey!
+}
+
 type PageInfo {
  hasNextPage: Boolean!
  hasPreviousPage: Boolean!
@@ -752,3 +832,31 @@ type UpdateSAMLConfigurationPayload {
 type DeleteSAMLConfigurationPayload {
  deletedSamlConfigurationId: ID!
 }
+
+input CreateSCIMConfigurationInput {
+  organizationId: ID!
+}
+
+input DeleteSCIMConfigurationInput {
+  organizationId: ID!
+  scimConfigurationId: ID!
+}
+
+input RegenerateSCIMTokenInput {
+  organizationId: ID!
+  scimConfigurationId: ID!
+}
+
+type CreateSCIMConfigurationPayload {
+  scimConfiguration: SCIMConfiguration!
+  token: String!
+}
+
+type DeleteSCIMConfigurationPayload {
+  deletedScimConfigurationId: ID!
+}
+
+type RegenerateSCIMTokenPayload {
+  scimConfiguration: SCIMConfiguration!
+  token: String!
+}
--- a/pkg/server/api/connect/v1/schema/schema.go
+++ b/pkg/server/api/connect/v1/schema/schema.go
--- a/pkg/server/api/connect/v1/types/scim_configuration.go
+++ b/pkg/server/api/connect/v1/types/scim_configuration.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func NewSCIMConfiguration(scimConfiguration *coredata.SCIMConfiguration) *SCIMConfiguration {
+	return &SCIMConfiguration{
+		ID: scimConfiguration.ID,
+		Organization: &Organization{
+			ID: scimConfiguration.OrganizationID,
+		},
+		CreatedAt: scimConfiguration.CreatedAt,
+		UpdatedAt: scimConfiguration.UpdatedAt,
+	}
+}
--- a/pkg/server/api/connect/v1/types/scim_event.go
+++ b/pkg/server/api/connect/v1/types/scim_event.go
@@ -0,0 +1,82 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	SCIMEventOrderBy OrderBy[coredata.SCIMEventOrderField]
+
+	SCIMEventConnection struct {
+		TotalCount int
+		Edges      []*SCIMEventEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+)
+
+func NewSCIMEventConnection(
+	p *page.Page[*coredata.SCIMEvent, coredata.SCIMEventOrderField],
+	resolver any,
+	parentID gid.GID,
+) *SCIMEventConnection {
+	edges := make([]*SCIMEventEdge, len(p.Data))
+	for i, scimEvent := range p.Data {
+		edges[i] = NewSCIMEventEdge(scimEvent, p.Cursor.OrderBy.Field)
+	}
+
+	return &SCIMEventConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: resolver,
+		ParentID: parentID,
+	}
+}
+
+func NewSCIMEventEdge(scimEvent *coredata.SCIMEvent, orderField coredata.SCIMEventOrderField) *SCIMEventEdge {
+	return &SCIMEventEdge{
+		Node:   NewSCIMEvent(scimEvent),
+		Cursor: scimEvent.CursorKey(orderField),
+	}
+}
+
+func NewSCIMEvent(scimEvent *coredata.SCIMEvent) *SCIMEvent {
+	event := &SCIMEvent{
+		ID:           scimEvent.ID,
+		Method:       scimEvent.Method,
+		Path:         scimEvent.Path,
+		StatusCode:   scimEvent.StatusCode,
+		RequestBody:  scimEvent.RequestBody,
+		ResponseBody: scimEvent.ResponseBody,
+		ErrorMessage: scimEvent.ErrorMessage,
+		IPAddress:    scimEvent.IPAddress.String(),
+		CreatedAt:    scimEvent.CreatedAt,
+	}
+
+	if scimEvent.MembershipID != nil {
+		event.Membership = &Membership{
+			ID: *scimEvent.MembershipID,
+		}
+	}
+
+	return event
+}
--- a/pkg/server/api/connect/v1/types/types.go
+++ b/pkg/server/api/connect/v1/types/types.go
@@ -94,6 +94,15 @@ type CreateSAMLConfigurationPayload struct {
 	SamlConfigurationEdge *SAMLConfigurationEdge `json:"samlConfigurationEdge"`
 }

+type CreateSCIMConfigurationInput struct {
+	OrganizationID gid.GID `json:"organizationId"`
+}
+
+type CreateSCIMConfigurationPayload struct {
+	ScimConfiguration *SCIMConfiguration `json:"scimConfiguration"`
+	Token             string             `json:"token"`
+}
+
 type DeleteInvitationInput struct {
 	OrganizationID gid.GID `json:"organizationId"`
 	InvitationID   gid.GID `json:"invitationId"`
@@ -128,6 +137,15 @@ type DeleteSAMLConfigurationPayload struct {
 	DeletedSamlConfigurationID gid.GID `json:"deletedSamlConfigurationId"`
 }

+type DeleteSCIMConfigurationInput struct {
+	OrganizationID      gid.GID `json:"organizationId"`
+	ScimConfigurationID gid.GID `json:"scimConfigurationId"`
+}
+
+type DeleteSCIMConfigurationPayload struct {
+	DeletedScimConfigurationID gid.GID `json:"deletedScimConfigurationId"`
+}
+
 type ForgotPasswordInput struct {
 	Email mail.Addr `json:"email"`
 }
@@ -233,6 +251,7 @@ type Organization struct {
 	Members            *MembershipConnection        `json:"members,omitempty"`
 	Invitations        *InvitationConnection        `json:"invitations,omitempty"`
 	SamlConfigurations *SAMLConfigurationConnection `json:"samlConfigurations,omitempty"`
+	ScimConfiguration  *SCIMConfiguration           `json:"scimConfiguration,omitempty"`
 	ViewerMembership   *Membership                  `json:"viewerMembership,omitempty"`
 	Permission         bool                         `json:"permission"`
 }
@@ -280,6 +299,16 @@ type PersonalAPIKeyEdge struct {
 type Query struct {
 }

+type RegenerateSCIMTokenInput struct {
+	OrganizationID      gid.GID `json:"organizationId"`
+	ScimConfigurationID gid.GID `json:"scimConfigurationId"`
+}
+
+type RegenerateSCIMTokenPayload struct {
+	ScimConfiguration *SCIMConfiguration `json:"scimConfiguration"`
+	Token             string             `json:"token"`
+}
+
 type RemoveMemberInput struct {
 	OrganizationID gid.GID `json:"organizationId"`
 	MembershipID   gid.GID `json:"membershipId"`
@@ -364,6 +393,41 @@ type SAMLConfigurationEdge struct {
 	Cursor page.CursorKey     `json:"cursor"`
 }

+type SCIMConfiguration struct {
+	ID           gid.GID              `json:"id"`
+	EndpointURL  string               `json:"endpointUrl"`
+	CreatedAt    time.Time            `json:"createdAt"`
+	UpdatedAt    time.Time            `json:"updatedAt"`
+	Organization *Organization        `json:"organization,omitempty"`
+	Events       *SCIMEventConnection `json:"events,omitempty"`
+	Permission   bool                 `json:"permission"`
+}
+
+func (SCIMConfiguration) IsNode()             {}
+func (this SCIMConfiguration) GetID() gid.GID { return this.ID }
+
+type SCIMEvent struct {
+	ID           gid.GID     `json:"id"`
+	Method       string      `json:"method"`
+	Path         string      `json:"path"`
+	StatusCode   int         `json:"statusCode"`
+	RequestBody  *string     `json:"requestBody,omitempty"`
+	ResponseBody *string     `json:"responseBody,omitempty"`
+	ErrorMessage *string     `json:"errorMessage,omitempty"`
+	Membership   *Membership `json:"membership,omitempty"`
+	IPAddress    string      `json:"ipAddress"`
+	CreatedAt    time.Time   `json:"createdAt"`
+	Permission   bool        `json:"permission"`
+}
+
+func (SCIMEvent) IsNode()             {}
+func (this SCIMEvent) GetID() gid.GID { return this.ID }
+
+type SCIMEventEdge struct {
+	Node   *SCIMEvent     `json:"node"`
+	Cursor page.CursorKey `json:"cursor"`
+}
+
 type SSOAvailability struct {
 	Available      bool     `json:"available"`
 	SamlConfigID   *gid.GID `json:"samlConfigId,omitempty"`
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -1090,6 +1090,57 @@ func (r *mutationResolver) DeleteSAMLConfiguration(ctx context.Context, input ty
 	return &types.DeleteSAMLConfigurationPayload{DeletedSamlConfigurationID: input.SamlConfigurationID}, nil
 }

+// CreateSCIMConfiguration is the resolver for the createSCIMConfiguration field.
+func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input types.CreateSCIMConfigurationInput) (*types.CreateSCIMConfigurationPayload, error) {
+	if ok := r.Authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate, nil); !ok {
+		return nil, nil
+	}
+
+	config, token, err := r.iam.OrganizationService.CreateSCIMConfiguration(ctx, input.OrganizationID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot create scim configuration", log.Error(err))
+		return nil, gqlutils.InternalServerError(ctx)
+	}
+
+	return &types.CreateSCIMConfigurationPayload{
+		ScimConfiguration: types.NewSCIMConfiguration(config),
+		Token:             token,
+	}, nil
+}
+
+// DeleteSCIMConfiguration is the resolver for the deleteSCIMConfiguration field.
+func (r *mutationResolver) DeleteSCIMConfiguration(ctx context.Context, input types.DeleteSCIMConfigurationInput) (*types.DeleteSCIMConfigurationPayload, error) {
+	if ok := r.Authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete, nil); !ok {
+		return nil, nil
+	}
+
+	err := r.iam.OrganizationService.DeleteSCIMConfiguration(ctx, input.OrganizationID, input.ScimConfigurationID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot delete scim configuration", log.Error(err))
+		return nil, gqlutils.InternalServerError(ctx)
+	}
+
+	return &types.DeleteSCIMConfigurationPayload{DeletedScimConfigurationID: input.ScimConfigurationID}, nil
+}
+
+// RegenerateSCIMToken is the resolver for the regenerateSCIMToken field.
+func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types.RegenerateSCIMTokenInput) (*types.RegenerateSCIMTokenPayload, error) {
+	if ok := r.Authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate, nil); !ok {
+		return nil, nil
+	}
+
+	config, token, err := r.iam.OrganizationService.RegenerateSCIMToken(ctx, input.OrganizationID, input.ScimConfigurationID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot regenerate scim token", log.Error(err))
+		return nil, gqlutils.InternalServerError(ctx)
+	}
+
+	return &types.RegenerateSCIMTokenPayload{
+		ScimConfiguration: types.NewSCIMConfiguration(config),
+		Token:             token,
+	}, nil
+}
+
 // LogoURL is the resolver for the logoUrl field.
 func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
 	if ok := r.Authorize(ctx, obj.ID, iam.ActionOrganizationGet, nil); !ok {
@@ -1216,6 +1267,26 @@ func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *type
 	return types.NewSAMLConfigurationConnection(page, r, obj.ID), nil
 }

+// ScimConfiguration is the resolver for the scimConfiguration field.
+func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types.Organization) (*types.SCIMConfiguration, error) {
+	if ok := r.Authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet, nil); !ok {
+		return nil, nil
+	}
+
+	config, err := r.iam.OrganizationService.GetSCIMConfiguration(ctx, obj.ID)
+	if err != nil {
+		var notFound *iam.ErrNoSCIMConfigurationFound
+		if errors.As(err, &notFound) {
+			return nil, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot get scim configuration", log.Error(err))
+		return nil, gqlutils.InternalServerError(ctx)
+	}
+
+	return types.NewSCIMConfiguration(config), nil
+}
+
 // ViewerMembership is the resolver for the viewerMembership field.
 func (r *organizationResolver) ViewerMembership(ctx context.Context, obj *types.Organization) (*types.Membership, error) {
 	if ok := r.Authorize(ctx, obj.ID, iam.ActionMembershipList, nil); !ok {
@@ -1358,6 +1429,24 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			}
 			return types.NewPersonalAPIKey(personalAPIKey), nil
 		}
+	case coredata.SCIMConfigurationEntityType:
+		action = iam.ActionSCIMConfigurationGet
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
+			scimConfiguration, err := r.iam.GetSCIMConfiguration(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewSCIMConfiguration(scimConfiguration), nil
+		}
+	case coredata.SCIMEventEntityType:
+		action = iam.ActionSCIMEventGet
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
+			scimEvent, err := r.iam.GetSCIMEvent(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+			return types.NewSCIMEvent(scimEvent), nil
+		}
 	default:
 		return nil, fmt.Errorf("unsupported entity type: %d", id.EntityType())
 	}
@@ -1452,6 +1541,127 @@ func (r *sAMLConfigurationConnectionResolver) TotalCount(ctx context.Context, ob
 	return nil, gqlutils.InternalServerError(ctx)
 }

+// EndpointURL is the resolver for the endpointUrl field.
+func (r *sCIMConfigurationResolver) EndpointURL(ctx context.Context, obj *types.SCIMConfiguration) (string, error) {
+	return r.baseURL.WithPath("/api/connect/v1/scim/2.0").MustString(), nil
+}
+
+// Organization is the resolver for the organization field.
+func (r *sCIMConfigurationResolver) Organization(ctx context.Context, obj *types.SCIMConfiguration) (*types.Organization, error) {
+	if ok := r.Authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, nil); !ok {
+		return nil, nil
+	}
+
+	if obj.Organization == nil {
+		return nil, nil
+	}
+
+	if gqlutils.OnlyIDSelected(ctx) {
+		return &types.Organization{
+			ID: obj.Organization.ID,
+		}, nil
+	}
+
+	organization, err := r.iam.OrganizationService.GetOrganization(ctx, obj.Organization.ID)
+	if err != nil {
+		var errOrganizationNotFound *iam.ErrOrganizationNotFound
+		if errors.As(err, &errOrganizationNotFound) {
+			return nil, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot get organization for scim configuration", log.Error(err))
+		return nil, gqlutils.InternalServerError(ctx)
+	}
+
+	return types.NewOrganization(organization), nil
+}
+
+// Events is the resolver for the events field.
+func (r *sCIMConfigurationResolver) Events(ctx context.Context, obj *types.SCIMConfiguration, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SCIMEventOrderBy) (*types.SCIMEventConnection, error) {
+	if ok := r.Authorize(ctx, obj.ID, iam.ActionSCIMEventList, nil); !ok {
+		return nil, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.SCIMEventOrderField]{
+		Field:     coredata.SCIMEventOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy.Field = coredata.SCIMEventOrderField(orderBy.Field)
+		pageOrderBy.Direction = page.OrderDirection(orderBy.Direction)
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	events, err := r.iam.OrganizationService.ListSCIMEventsByConfigID(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list scim events", log.Error(err))
+		return nil, gqlutils.InternalServerError(ctx)
+	}
+
+	return types.NewSCIMEventConnection(events, r, obj.ID), nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *sCIMConfigurationResolver) Permission(ctx context.Context, obj *types.SCIMConfiguration, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// Membership is the resolver for the membership field.
+func (r *sCIMEventResolver) Membership(ctx context.Context, obj *types.SCIMEvent) (*types.Membership, error) {
+	if ok := r.Authorize(ctx, obj.Membership.ID, iam.ActionMembershipGet, nil); !ok {
+		return nil, nil
+	}
+
+	if obj.Membership == nil {
+		return nil, nil
+	}
+
+	if gqlutils.OnlyIDSelected(ctx) {
+		return &types.Membership{
+			ID: obj.Membership.ID,
+		}, nil
+	}
+
+	membership, err := r.iam.GetMembership(ctx, obj.Membership.ID)
+	if err != nil {
+		var errMembershipNotFound *iam.ErrMembershipNotFound
+		if errors.As(err, &errMembershipNotFound) {
+			return nil, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot get membership for scim event", log.Error(err))
+		return nil, gqlutils.InternalServerError(ctx)
+	}
+
+	return types.NewMembership(membership), nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *sCIMEventResolver) Permission(ctx context.Context, obj *types.SCIMEvent, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *sCIMEventConnectionResolver) TotalCount(ctx context.Context, obj *types.SCIMEventConnection) (*int, error) {
+	if ok := r.Authorize(ctx, obj.ParentID, iam.ActionSCIMEventList, nil); !ok {
+		return nil, nil
+	}
+
+	switch obj.Resolver.(type) {
+	case *sCIMConfigurationResolver:
+		count, err := r.iam.OrganizationService.CountSCIMEvents(ctx, obj.ParentID)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot count scim events", log.Error(err))
+			return nil, gqlutils.InternalServerError(ctx)
+		}
+		return &count, nil
+	}
+
+	r.logger.ErrorCtx(ctx, "unsupported resolver", log.Any("resolver", obj.Resolver))
+	return nil, gqlutils.InternalServerError(ctx)
+}
+
 // Identity is the resolver for the identity field.
 func (r *sessionResolver) Identity(ctx context.Context, obj *types.Session) (*types.Identity, error) {
 	if gqlutils.OnlyIDSelected(ctx) {
@@ -1542,6 +1752,19 @@ func (r *Resolver) SAMLConfigurationConnection() schema.SAMLConfigurationConnect
 	return &sAMLConfigurationConnectionResolver{r}
 }

+// SCIMConfiguration returns schema.SCIMConfigurationResolver implementation.
+func (r *Resolver) SCIMConfiguration() schema.SCIMConfigurationResolver {
+	return &sCIMConfigurationResolver{r}
+}
+
+// SCIMEvent returns schema.SCIMEventResolver implementation.
+func (r *Resolver) SCIMEvent() schema.SCIMEventResolver { return &sCIMEventResolver{r} }
+
+// SCIMEventConnection returns schema.SCIMEventConnectionResolver implementation.
+func (r *Resolver) SCIMEventConnection() schema.SCIMEventConnectionResolver {
+	return &sCIMEventConnectionResolver{r}
+}
+
 // Session returns schema.SessionResolver implementation.
 func (r *Resolver) Session() schema.SessionResolver { return &sessionResolver{r} }

@@ -1563,5 +1786,8 @@ type personalAPIKeyConnectionResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type sAMLConfigurationResolver struct{ *Resolver }
 type sAMLConfigurationConnectionResolver struct{ *Resolver }
+type sCIMConfigurationResolver struct{ *Resolver }
+type sCIMEventResolver struct{ *Resolver }
+type sCIMEventConnectionResolver struct{ *Resolver }
 type sessionResolver struct{ *Resolver }
 type sessionConnectionResolver struct{ *Resolver }