SCIM API guide

Third-party systems can call the System for Cross-domain Identity Management (SCIM) API to synchronize user directories.

 

legal notice

By using this API and its documentation and building an integration, you agree to the Additional API Terms and Guidelines.

API overview

The System for Cross-domain Identity Management (SCIM) API uses the SCIM protocol to let third-party systems call Indeed on the user's behalf and synchronize user directories for Indeed PLUS integrations. These users typically belong to resource groups that isolate them from Indeed.com users. Resource groups give the third-party system direct ownership of these users — including create, delete, and permission assignment — without requiring the user to create an Indeed account.

End users never have a consumer Indeed.com account and cannot sign in to Indeed directly. They sign in only through the third-party system, and only to access APIs in that system's context.

SCIM API use cases

Third-party caller	Calls the SCIM API to
Applicant tracking systems (ATSs)	Provision their employer users into Indeed resource groups so the users can access tools like Scout.
Recruit-owned job boards	Link their users to Indeed to access Indeed's moderation capabilities.
Partners, such as Glassdoor	Manage user linking for a consistent experience across Glassdoor and Indeed.

For supported and optional schemas, see SCIM API schemas.

To start this integration or ask questions, contact fim-team@indeed.com.

---

API steps

---

1. Authenticate

If you are not already a partner, become an Indeed partner (opens in a new window).

When you become an Indeed partner, Indeed creates an app for your integration. Sign in to Partner Console (opens in a new window) to view the app and your OAuth credentials: client ID, secret, and a 3-legged OAuth authorization code. Exchange those credentials for an access token to authenticate API calls.

To get an access token, send a POST request to https://apis.indeed.com/oauth/v2/tokens with these headers and body parameters, using a command-line tool like curl (opens in a new window) or a UI tool like Insomnia (opens in a new window).

Don't expose the client secret to end users. Indeed recommends generating tokens in the backend.

curl -L 'https://apis.indeed.com/oauth/v2/tokens' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'client_id=<client_id>' \
  -d 'client_secret=<client_secret>' \
  -d 'grant_type=client_credentials' \
  -d 'scope=employer_access'

The request headers are:

Get an access token request headers

Header	Value
Accept	application/json
Content-Type	application/x-www-form-urlencoded

The request body parameters are:

Get an access token request body parameters

Request body parameter	Value	Description
client_id	<client_id>	Replace with your client ID.
client_secret	<client_secret>	Replace with your client secret.
grant_type	client_credentials	Requests the client credentials grant (2-legged OAuth).
scope	employer_access	Lists employer accounts associated with the user that registered the app, or gets an access token for an associated employer account.

{
  "access_token": "<access_token>",
  "scope": "employer_access",
  "token_type": "Bearer",
  "expires_in": 3600
}

Your token expires in one hour (3600 seconds). Refresh your token hourly.

The SCIM service validates the token's signature, issuer, audience, and expiration time. If the token is invalid or expired, the service returns HTTP 401 Unauthorized.

---

2. Get user details by criteria

GET https://api.indeed.com/scim/v2/Users

Get details for the Indeed account associated with the requesting tenant.

Use this operation to synchronize user data between an Identity Provider (IdP) and a Service Provider (SP).

For example, during a full synchronization, the IdP queries the SP to identify which users to add, delete, or update so the SP matches the IdP after all operations complete.

This operation returns at most one user. If multiple users match the criteria, the operation returns an error.

For reference information and example requests and responses, see Get user details by criteria.

---

3. Get user details by ID

GET https://api.indeed.com/scim/v2/Users/:id

Get details for an Indeed user account by its unique user ID.

Use this operation to access or verify a user's details, such as profile information, roles, or group memberships.

For example, when a user changes in the IdP, the IdP queries the SP for the current state of the SP user, then sends POST or PUT commands to align the SP with the IdP.

For reference information and example requests and responses, see Get user details by ID.

---

4. Create user

POST https://api.indeed.com/scim/v2/Users

Create an Indeed account. When an employee joins an organization, the IdP calls this operation to add the user's information to the SP so the user has access to the necessary resources and services from day one.

The required and optional fields are:

Fields for the create and update user operations

Field	Required	Optional
One primary email	✓
externalId	✓
familyName	✓
givenName	✓
locale		✓
phoneNumbers		✓
preferredLanguage		✓
timezone		✓
title		✓
username	✓
userType	✓
EmployerOrganizations		✓

For reference information and example requests and responses, see Create user.

---

5. Update user by ID

PUT https://api.indeed.com/scim/v2/Users/:id

Update an Indeed account. This operation overwrites every value on the account, even when an attribute is empty or omitted.

The required and optional fields are:

Fields for the create and update user operations

Field	Required	Optional
One primary email	✓
externalId	✓
familyName	✓
givenName	✓
locale		✓
phoneNumbers		✓
preferredLanguage		✓
timezone		✓
title		✓
username	✓
userType	✓
EmployerOrganizations		✓

For reference information and example requests and responses, see Update user by ID.

---

6. Delete user by ID

DELETE https://api.indeed.com/scim/v2/Users/:id

Hard-delete an Indeed user account and erase the user's identity data from Indeed.

When an employee leaves the organization, the IdP calls this operation to remove the user from the system. The operation erases the user's identity data within Indeed and prevents reactivation, removing the user's access to the organization's resources and services.

This operation does not sanitize all Personally Identifiable Information (PII) for the user across all Indeed platforms. Before or after you call the DELETE operation, process any GDPR-related data sanitization requests through the appropriate channels. Both requests are handled correctly regardless of the order.

For reference information and example requests and responses, see Delete user by ID.

---

See also

RFCs

• RFC 3966: The tel URI for Telephone Numbers (opens in a new window)
• RFC 7642: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements (opens in a new window)
• RFC 7643: System for Cross-domain Identity Management: Core Schema (opens in a new window)
• RFC 7644: System for Cross-domain Identity Management: Protocol (opens in a new window)

Guides

• HTTP request headers
• oauth/v2/tokens endpoint
• Error response
• Troubleshoot OAuth errors

 

Was this page helpful?