Skip to main content
Version: 2.0

Introduction

Xporter provides a school-scoped SCIM 2.0 (System for Cross-domain Identity Management) API for partners who need to provision users and groups from school MIS data.

SCIM 2.0 is an industry-standard protocol supported natively by Microsoft Entra ID, Okta, Google Workspace, Salesforce, and many other platforms. Integrating via SCIM allows you to automatically sync school staff and student accounts and group memberships without building a bespoke connector.

Operation mode — pull only​

This API operates in pull mode only. Xporter acts as a SCIM provider (source of truth); your identity platform pulls school user and group data from Xporter into its own directory.

ModeSupportedDescription
Pull (read)✅ YesYour IdP reads /Users and /Groups from Xporter
Push (write)❌ NoWrite-back from an IdP into Xporter is not supported

Write operations — POST, PUT, PATCH, and DELETE on /Users or /Groups — are not implemented and will return 405 Method Not Allowed.

Microsoft Entra ID / Okta note: When configuring a SCIM inbound provisioning connector pointing at this API, use import-only (read) mode. The Microsoft Entra SCIM Validator also tests write operations; those test cases will report failures — this is expected behaviour and does not affect the read provisioning flow.

Base URL​

https://xporter.groupcall.com/api/scim/v2

Authentication​

The API uses a bearer token.

Step 1 — Obtain a bearer token​

Send a POST request to /auth/token. Two credential delivery methods are supported:

Option A — HTTP Basic authentication (recommended for Postman / custom integrations)​

Pass credentials in an Authorization: Basic header. The username format is rp|estab:

Authorization: Basic <base64(rp|estab:sharedSecret)>

Example request

POST /api/scim/v2/auth/token HTTP/1.1
Host: xporter.groupcall.com
Authorization: Basic cGFydG5lci1ycHwzMjgxMTEwOnN1cGVyLXNlY3JldA==
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

Option B — OAuth 2.0 client credentials in request body (required for Microsoft Entra ID, Okta, and other IdP SCIM connectors)​

Pass credentials as application/x-www-form-urlencoded body parameters. Set client_id to your rp|estab value and client_secret to your shared secret:

POST /api/scim/v2/auth/token HTTP/1.1
Host: xporter.groupcall.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=partner-rp%7C3281110&client_secret=super-secret

Successful response (200 OK)

{
  "access_token": "<token>",
  "token_type": "Bearer",
  "expires_in": 3600
}

Error response (401 Unauthorized)

{
  "error": "invalid_client",
  "error_description": "Request contains an invalid client ID or secret"
}

Step 2 — Call protected endpoints​

Include the token in the Authorization header of every subsequent request:

Authorization: Bearer <token>

All responses use Content-Type: application/scim+json.

Query parameter support​

Collection endpoints (/Users, /Groups) support the following query parameters.

ParameterDescription
filterSCIM RFC 7644 filter expression (see endpoint docs for examples)
startIndex1-based index of the first result to return (default: 1)
countMaximum number of results to return
sortByAttribute name to sort by
sortOrderascending or descending

Supported filter operators: eq, ne, co, sw, ew, gt, ge, lt, le, pr

Delta sync — retrieve only records modified since a point in time:

filter=meta.lastModified gt "2026-01-01T00:00:00Z"

HTTP status codes​

CodeScenario
200 OKRequest succeeded.
400 Bad RequestInvalid request.
401 UnauthorizedInvalid or missing bearer token, or invalid credentials on the token endpoint.
403 ForbiddenThe token is valid but the caller is not authorised to access the requested data.
404 Not FoundThe requested resource does not exist.
405 Method Not AllowedWrite operations are not supported (this API is pull-only).
500 Internal Server ErrorAn unexpected server-side error occurred.

Integration checklist​

  • Obtain your relying party identifier (rp), establishment identifier (estab), and shared secret from the Xporter platform.
  • Call POST /auth/token and cache the access_token — reuse it until expires_in seconds have elapsed.
  • When 401 is received on a data endpoint, re-authenticate and retry once.
  • Use startIndex + count to page through large result sets (1-based index).
  • Use filter=meta.lastModified gt "<timestamp>" for efficient delta sync after initial load.
  • Users with active: false should be treated as deletion candidates.
  • Member value fields in Groups align with User id fields — join directly without additional lookups.

Authentication​

Bearer token obtained from POST /auth/token.

Security Scheme Type:

http

HTTP Authorization Scheme:

bearer

Bearer format:

JWT