SCIM Auditable Event Methods on Confluent Cloud

Auditable event methods for Confluent Cloud ORGANIZATION resources are triggered by actions, or operations, on System for Cross-domain Identity Management (SCIM) provisioning. These operations include enabling SCIM for an organization, managing SCIM tokens, and creating, updating, or deleting users through a SCIM client.

Organization

The following action on an organization generates an auditable event message when it changes SCIM provisioning for the organization.

Method name	Action triggering an auditable event message
UpdateOrganization	A request to update organization-level settings. Generated when enabling or disabling SCIM provisioning for the organization.

UpdateOrganization

The UpdateOrganization event is generated by a request to update organization-level settings, such as enabling or disabling SCIM provisioning.

To view example event messages, expand the following dropdowns:

SCIM tokens

The following actions, or operations, on a SCIM API token generate auditable event messages. A SCIM token authenticates requests from a SCIM client, such as an identity provider, to the Confluent Cloud SCIM API. These events are generated whether the token is managed through a single sign-on (SSO) connection-scoped endpoint or through the organization-level SCIM token endpoints.

Method name	Action triggering an auditable event message
CreateSCIMToken	A request to create a SCIM token.
ListSCIMTokens	A request to get a list of SCIM tokens.
DeleteSCIMToken	A request to delete a SCIM token.

CreateSCIMToken

The CreateSCIMToken event is generated by a request to create a SCIM token.

To view example event messages, expand the following dropdowns:

ListSCIMTokens

The ListSCIMTokens event is generated by a request to get a list of SCIM tokens.

To view an example event message, expand the following dropdown:

DeleteSCIMToken

The DeleteSCIMToken event is generated by a request to delete a SCIM token.

To view example event messages, expand the following dropdowns:

SCIM users

The following actions, or operations, on a user through the Confluent Cloud SCIM API generate auditable event messages. These requests are made by a SCIM client, such as an identity provider, rather than by a Confluent Cloud user directly. As a result, the authenticationInfo.principal in these events identifies the SCIM client through an externalAccount rather than a confluentUser.

Method name	Action triggering an auditable event message
SCIMCreateUser	A request to create a user.
SCIMSearchUsers	A request to search for users.
SCIMGetUser	A request to get the details of a user.
SCIMPutUser	A request to replace a user’s attributes.
SCIMPatchUser	A request to update specific attributes of a user.
SCIMDeleteUser	A request to delete a user.

SCIMCreateUser

The SCIMCreateUser event is generated by a request to create a user through the SCIM API.

To view example event messages, expand the following dropdowns:

SCIMSearchUsers

The SCIMSearchUsers event is generated by a request to search for users through the SCIM API.

To view an example event message, expand the following dropdown:

SCIMGetUser

The SCIMGetUser event is generated by a request to get the details of a user through the SCIM API.

To view an example event message, expand the following dropdown:

SCIMPutUser

The SCIMPutUser event is generated by a request to replace a user’s attributes through the SCIM API.

To view example event messages, expand the following dropdowns:

Success: Update names

{
   "datacontenttype":"application/json",
   "data": {
      "serviceName":"crn://confluent.cloud/",
      "methodName":"SCIMPutUser",
      "cloudResources": [
         {
            "scope": {
               "resources": [
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"abc-123"
                  }
               ]
            },
            "resource": {
               "type":"USER",
               "resourceId":"u-abc123"
            }
         }
      ],
      "authenticationInfo": {
         "principal": {
            "externalAccount": {
               "namespace": [
                  {
                     "type":"idp",
                     "id":"my-sso-connection"
                  }
               ],
               "subject":"scim-client:my-sso-connection"
            }
         },
         "result":"SUCCESS"
      },
      "requestMetadata": {
         "requestId": [
            "de32c2b987036d0ef3fb0987ba4ebd8c"
         ],
         "clientAddress": [
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request": {
         "accessType":"MODIFICATION",
         "data": {
            "active": true,
            "name": {
               "familyName":"Doe-updated",
               "givenName":"Jane-updated"
            },
            "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName":"someone@example.com"
         }
      },
      "result": {
         "status":"SUCCESS",
         "data": {
            "meta": {
               "created":"2025-12-18T07:00:22.488471Z",
               "lastModified":"2025-12-18T07:00:22.488471Z",
               "location":"https://api.confluent.cloud/scim/v2/users/u-abc123",
               "resourceType":"User"
            },
            "name": {
               "givenName":"Jane-updated",
               "familyName":"Doe-updated"
            },
            "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName":"someone@example.com",
            "active": true,
            "id":"u-abc123"
         }
      },
      "resourceName":"crn://confluent.cloud/organization=abc-123/user=u-abc123"
   },
   "subject":"crn://confluent.cloud/organization=abc-123/user=u-abc123",
   "specversion":"1.0",
   "id":"6266b5ff-4fe6-4837-9320-06b691e4905c",
   "source":"crn://confluent.cloud/",
   "time":"2025-12-18T07:06:29.812886824Z",
   "type":"io.confluent.cloud/request"
}

Success: Deactivate user

{
   "datacontenttype":"application/json",
   "data": {
      "serviceName":"crn://confluent.cloud/",
      "methodName":"SCIMPutUser",
      "cloudResources": [
         {
            "scope": {
               "resources": [
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"abc-123"
                  }
               ]
            },
            "resource": {
               "type":"USER",
               "resourceId":"u-abc123"
            }
         }
      ],
      "authenticationInfo": {
         "principal": {
            "externalAccount": {
               "namespace": [
                  {
                     "type":"idp",
                     "id":"my-sso-connection"
                  }
               ],
               "subject":"scim-client:my-sso-connection"
            }
         },
         "result":"SUCCESS"
      },
      "requestMetadata": {
         "requestId": [
            "0589dcc24aad0898f1b401f6e5cfd813"
         ],
         "clientAddress": [
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request": {
         "accessType":"MODIFICATION",
         "data": {
            "active": false,
            "name": {
               "familyName":"Doe",
               "givenName":"Jane"
            },
            "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName":"someone@example.com"
         }
      },
      "result": {
         "status":"SUCCESS",
         "data": {
            "userName":"someone@example.com",
            "active": false,
            "id":"u-abc123",
            "meta": {
               "location":"https://api.confluent.cloud/scim/v2/users/u-abc123",
               "resourceType":"User",
               "created":"2025-12-18T07:00:22.488471Z",
               "lastModified":"2025-12-18T07:09:46.357458Z"
            },
            "name": {
               "familyName":"Doe",
               "givenName":"Jane"
            },
            "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:User"
            ]
         }
      },
      "resourceName":"crn://confluent.cloud/organization=abc-123/user=u-abc123"
   },
   "subject":"crn://confluent.cloud/organization=abc-123/user=u-abc123",
   "specversion":"1.0",
   "id":"550d4d39-0cc6-4cfd-9259-3208ef6b6c4d",
   "source":"crn://confluent.cloud/",
   "time":"2025-12-18T07:09:53.862306284Z",
   "type":"io.confluent.cloud/request"
}

SCIMPatchUser

The SCIMPatchUser event is generated by a request to update specific attributes of a user through the SCIM API.

To view example event messages, expand the following dropdowns:

Success: Update names

{
   "datacontenttype":"application/json",
   "data": {
      "serviceName":"crn://confluent.cloud/",
      "methodName":"SCIMPatchUser",
      "cloudResources": [
         {
            "scope": {
               "resources": [
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"abc-123"
                  }
               ]
            },
            "resource": {
               "type":"USER",
               "resourceId":"u-abc123"
            }
         }
      ],
      "authenticationInfo": {
         "principal": {
            "externalAccount": {
               "namespace": [
                  {
                     "type":"idp",
                     "id":"my-sso-connection"
                  }
               ],
               "subject":"scim-client:my-sso-connection"
            }
         },
         "result":"SUCCESS"
      },
      "requestMetadata": {
         "requestId": [
            "7dd09c6f7d71fed264e548409c1be3b1"
         ],
         "clientAddress": [
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request": {
         "accessType":"MODIFICATION",
         "data": {
            "Operations": [
               {
                  "op":"replace",
                  "path":"",
                  "value": {
                     "name": {
                        "familyName":"new-last",
                        "givenName":"new-first"
                     }
                  }
               }
            ],
            "schemas": [
               "urn:ietf:params:scim:api:messages:2.0:PatchOp"
            ]
         }
      },
      "result": {
         "status":"SUCCESS",
         "data": {
            "active": true,
            "id":"u-abc123",
            "meta": {
               "created":"2025-12-04T10:25:35.463396Z",
               "lastModified":"2025-12-18T07:25:33.847085Z",
               "location":"https://api.confluent.cloud/scim/v2/users/u-abc123",
               "resourceType":"User"
            },
            "name": {
               "familyName":"new-last",
               "givenName":"new-first"
            },
            "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName":"someone@example.com"
         }
      },
      "resourceName":"crn://confluent.cloud/organization=abc-123/user=u-abc123"
   },
   "subject":"crn://confluent.cloud/organization=abc-123/user=u-abc123",
   "specversion":"1.0",
   "id":"d153fee8-b6e3-4d42-ae59-1b4b952686ff",
   "source":"crn://confluent.cloud/",
   "time":"2025-12-18T07:25:33.880240518Z",
   "type":"io.confluent.cloud/request"
}

Success: Deactivate user

{
   "datacontenttype":"application/json",
   "data": {
      "serviceName":"crn://confluent.cloud/",
      "methodName":"SCIMPatchUser",
      "cloudResources": [
         {
            "scope": {
               "resources": [
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"abc-123"
                  }
               ]
            },
            "resource": {
               "type":"USER",
               "resourceId":"u-abc123"
            }
         }
      ],
      "authenticationInfo": {
         "principal": {
            "externalAccount": {
               "namespace": [
                  {
                     "type":"idp",
                     "id":"my-sso-connection"
                  }
               ],
               "subject":"scim-client:my-sso-connection"
            }
         },
         "result":"SUCCESS"
      },
      "requestMetadata": {
         "requestId": [
            "79c819c3c2be9f628e263c0313365e9a"
         ],
         "clientAddress": [
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "request": {
         "accessType":"MODIFICATION",
         "data": {
            "Operations": [
               {
                  "path":"active",
                  "value": false,
                  "op":"replace"
               }
            ],
            "schemas": [
               "urn:ietf:params:scim:api:messages:2.0:PatchOp"
            ]
         }
      },
      "result": {
         "status":"SUCCESS",
         "data": {
            "meta": {
               "created":"2025-12-04T10:25:35.463396Z",
               "lastModified":"2025-12-18T07:25:33.847085Z",
               "location":"https://api.confluent.cloud/scim/v2/users/u-abc123",
               "resourceType":"User"
            },
            "name": {
               "familyName":"new-last",
               "givenName":"new-first"
            },
            "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:User"
            ],
            "userName":"someone@example.com",
            "active": false,
            "id":"u-abc123"
         }
      },
      "resourceName":"crn://confluent.cloud/organization=abc-123/user=u-abc123"
   },
   "subject":"crn://confluent.cloud/organization=abc-123/user=u-abc123",
   "specversion":"1.0",
   "id":"a2bdb6c4-a20f-42b8-b562-7b02b65f4ffe",
   "source":"crn://confluent.cloud/",
   "time":"2025-12-18T07:27:21.748645057Z",
   "type":"io.confluent.cloud/request"
}

SCIMDeleteUser

The SCIMDeleteUser event is generated by a request to delete a user through the SCIM API.

To view an example event message, expand the following dropdown: