> ## Documentation Index > Fetch the complete documentation index at: https://docs.plerion.com/llms.txt > Use this file to discover all available pages before exploring further. # Replace a user > Full replace of writable attributes; omitted writable attributes are cleared. id, groups, and meta are immutable, and so is the user's sign-in email: a write that would move it returns 400 with the scimType mutability, on every user, whether or not this API has written to them before. The first write to a Plerion user not yet under management adopts them, which sets the SCIM managed marker and nothing else. The Plerion extension is the exception to the replace rule. ssoUser changes only when you send it; omit the extension and the current value is kept. ## OpenAPI ````yaml /api-reference/scim-openapi.yaml put /v1/organization/scim/v2/Users/{userId} openapi: 3.1.0 info: title: Plerion SCIM 2.0 provisioning API version: v1 termsOfService: https://www.plerion.com/terms-and-conditions contact: name: Plerion Pty Ltd url: https://www.plerion.com/contact-us email: support@plerion.com license: name: Plerion Use License url: https://www.plerion.com/terms-and-conditions description: |- The Plerion SCIM 2.0 provisioning API lets an identity provider, a script, or any other client create, update, deactivate, and delete users in a Plerion organization, and keep its groups in sync as Plerion user groups. It follows RFC 7643 (schema) and RFC 7644 (protocol), so any SCIM 2.0 client can use it. SCIM does not have to be enabled on your single sign-on settings, and the organization does not need a SAML connection. The API reads and writes every user and every user group in the organization, whoever created them. A record maintained outside Plerion, by an identity provider sync or by calls to this API, is badged SCIM managed in the Plerion console. The badge is a marker, not a lock. Do not manage the same record from both an identity provider sync and by hand: the next sync can overwrite what you wrote. SCIM carries users and groups, not roles. Roles are granted in the Plerion console, to a user directly or to a user group. A user's effective permissions are the union of both. Requests are authenticated with a Plerion organization API key sent as a bearer token. The organization is resolved from the key, so no request names an organization. Write operations need a key with the readWrite access level. The Plerion console shows the exact SCIM base URL for your organization in the SCIM provisioning section of your single sign-on settings. Paste that value into your identity provider rather than assembling it by hand. For setup instructions, see the SCIM provisioning guides. servers: - url: https://{region}.api.plerion.com description: Production API server - Select your preferred region variables: region: default: au enum: - au - sg1 - in1 - us1 security: - organizationApiKey: [] tags: - name: Discovery x-displayName: Discovery description: >- The SCIM discovery endpoints describe what this service supports. Identity providers read them automatically when you test a connection, and they advertise only the features that are actually available. - name: Users x-displayName: Users description: >- Create, read, update, deactivate, and delete users in a Plerion organization. Writes need an organization API key with the readWrite access level. - name: Groups x-displayName: Groups description: >- Create, read, update, and delete user groups and their membership. Every user group in the organization is in scope, whether an identity provider pushed it or someone created it in the console. Writes need an organization API key with the readWrite access level. paths: /v1/organization/scim/v2/Users/{userId}: parameters: - $ref: '#/components/parameters/userId' put: tags: - Users summary: Replace a user description: > Full replace of writable attributes; omitted writable attributes are cleared. id, groups, and meta are immutable, and so is the user's sign-in email: a write that would move it returns 400 with the scimType mutability, on every user, whether or not this API has written to them before. The first write to a Plerion user not yet under management adopts them, which sets the SCIM managed marker and nothing else. The Plerion extension is the exception to the replace rule. ssoUser changes only when you send it; omit the extension and the current value is kept. operationId: replaceUser requestBody: required: true content: application/scim+json: schema: $ref: '#/components/schemas/User' application/json: schema: $ref: '#/components/schemas/User' responses: '200': description: The updated user. content: application/scim+json: schema: $ref: '#/components/schemas/User' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '429': $ref: '#/components/responses/TooManyRequests' components: parameters: userId: name: userId in: path required: true description: The Plerion-assigned user id (SCIM id). schema: type: string format: uuid schemas: User: type: object description: > SCIM core User as supported by Plerion. Other standard SCIM attributes are accepted and returned unchanged but do not affect Plerion behavior. The user's Plerion sign-in email is derived from the payload with no configuration: userName when that value is an email address, otherwise the primary email, otherwise the work email. A user maintained outside Plerion, by an identity provider sync or by calls to this API, is badged SCIM managed in the Plerion console. The badge does not stop this API from changing the user, but the next sync may overwrite the change. properties: schemas: type: array items: type: string example: - urn:ietf:params:scim:schemas:core:2.0:User - urn:plerion:scim:schemas:extension:2.0:User id: type: string format: uuid readOnly: true description: Plerion-assigned identifier. Use it for all subsequent requests. externalId: type: string description: The identity provider's identifier for the user. Filterable. userName: type: string description: Required. Unique within the organization, case-insensitive. name: type: object properties: formatted: type: string givenName: type: string familyName: type: string displayName: type: string description: > The Plerion display name is taken from name.formatted, falling back to displayName, then "givenName familyName". emails: type: array items: $ref: '#/components/schemas/Email' active: type: boolean default: true description: > false deactivates the user. Sign-in is blocked, sessions end within seconds, and the user's API keys are revoked. The record is retained. groups: type: array readOnly: true items: $ref: '#/components/schemas/UserGroupRef' urn:plerion:scim:schemas:extension:2.0:User: $ref: '#/components/schemas/PlerionUserExtension' meta: $ref: '#/components/schemas/Meta' required: - schemas - userName Email: type: object properties: value: type: string description: The email address. type: type: string description: Label such as work or home. primary: type: boolean required: - value UserGroupRef: type: object readOnly: true description: > A user group the user belongs to. Returned only when requested with ?attributes=groups. properties: $ref: 946bec44-c140-4b47-b086-b5807b1d1382 value: type: string format: uuid description: Group id. display: type: string description: Group displayName. PlerionUserExtension: type: object description: > Plerion schema extension for the User resource, urn:plerion:scim:schemas:extension:2.0:User. It carries the one attribute SCIM has no place for: how the user signs in. properties: ssoUser: type: boolean default: true description: > true, the default on create, means the user signs in through your single sign-on connection. false creates a user who signs in with a password, which they set through the forgot password flow; no invitation email is sent. On PUT and PATCH the value changes only when the request sends it. A value that is not a boolean is rejected with 400. Meta: type: object readOnly: true properties: resourceType: type: string enum: - User - Group created: type: string format: date-time lastModified: type: string format: date-time version: type: string description: > Resource version identifier, for example W/"3". Conditional requests (If-Match, If-None-Match) are not supported. location: type: string format: uri Error: type: object description: RFC 7644 §3.12 error response. properties: schemas: type: array items: type: string const: urn:ietf:params:scim:api:messages:2.0:Error status: type: string description: HTTP status code as a string. example: '409' scimType: type: string enum: - invalidSyntax - invalidFilter - invalidPath - invalidValue - mutability - uniqueness detail: type: string example: A user with this userName already exists. required: - schemas - status responses: BadRequest: description: > Invalid request. The SCIM error body carries scimType invalidSyntax, invalidFilter, invalidPath, invalidValue, or mutability. content: application/scim+json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: > Missing or invalid API key. Rejected before the request reaches the SCIM service, so the body is plain JSON rather than a SCIM error. content: application/json: schema: type: object properties: message: type: string example: message: Unauthorized Forbidden: description: > Read-level key on a write operation, or an attempt to deactivate, delete, or change the role of a break-glass administrator. The detail then reads "A break-glass admin cannot be deactivated through SCIM" or "A break-glass admin cannot be deleted through SCIM", and the record is left untouched. Every other attribute of a break-glass administrator keeps syncing normally. content: application/scim+json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found. content: application/scim+json: schema: $ref: '#/components/schemas/Error' Conflict: description: | userName or email conflicts with an existing user (scimType uniqueness). content: application/scim+json: schema: $ref: '#/components/schemas/Error' TooManyRequests: description: Rate limited. Honor Retry-After and retry. headers: Retry-After: $ref: '#/components/headers/RetryAfter' content: application/scim+json: schema: $ref: '#/components/schemas/Error' headers: RetryAfter: description: Seconds to wait before retrying. schema: type: integer securitySchemes: organizationApiKey: type: http scheme: bearer description: > Plerion organization API key (plerion_oak_…), created by an organization admin in the Plerion console. Write operations require a key with readWrite access level; GET and .search work with read access level. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.