openapi: 3.1.0
info:
  license:
    name: HPE License
    url: https://www.hpe.com/us/en/software/licensing.html
  description: >-
    User and Group Management APIs compliant with [SCIM
    2.0](https://tools.ietf.org/html/rfc7644).
  version: v2.0
  title: HPE GreenLake SCIM User and Group Management APIs
servers:
  - url: https://global.api.greenlake.hpe.com
tags:
  - name: SCIM v2beta1
    description: >-
      [SCIM 2.0](https://tools.ietf.org/html/rfc7644)-compliant management
      operations for users and groups.
security:
  - Bearer: []
paths:
  /identity/v2beta1/scim/v2/extensions/Groups/{groupId}/users:
    get:
      tags:
        - SCIM v2beta1
      summary: List users assigned to a user group
      operationId: groupMembersSCIM
      description: Get users assigned to a user group.
      parameters:
        - in: path
          name: groupId
          description: >-
            The HPE GreenLake user group ID. Retrieve the ID from the `CREATE
            Group` endpoint or the `GET Group` endpoint.
          schema:
            type: string
          required: true
        - in: query
          name: count
          description: >-
            Specifies the number of query results to be returned in a query
            response page.
          schema:
            type: integer
            default: 200
            maximum: 200
          required: false
        - in: query
          name: startIndex
          description: Specifies the pagination start index. Index starts at 1.
          schema:
            type: integer
            default: 1
            minimum: 1
          required: false
      responses:
        '200':
          description: Returns users assigned to the group.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/UsersList'
        '400':
          description: Bad Request
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
  /identity/v2beta1/scim/v2/extensions/Users/{userId}/groups:
    get:
      tags:
        - SCIM v2beta1
      summary: List user groups assigned to a user
      operationId: userGroupMembersSCIM
      description: Get user groups assigned to a user.
      parameters:
        - in: path
          name: userId
          description: >-
            The HPE GreenLake global user ID. Retrieve the ID from the `CREATE
            User` endpoint or the `GET User` endpoint.
          schema:
            type: string
          required: true
        - in: query
          name: count
          description: >-
            Specifies the number of query results to be returned in a query
            response page.
          schema:
            type: integer
            default: 200
            minimum: 1
            maximum: 200
          required: false
        - in: query
          name: startIndex
          description: Specifies the pagination start index. Index starts at 1.
          schema:
            type: integer
            default: 1
            minimum: 1
          required: false
      responses:
        '200':
          description: Returns a list of user groups assigned to the user.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/GroupList'
        '400':
          description: Bad Request
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
  /identity/v2beta1/scim/v2/Users:
    post:
      tags:
        - SCIM v2beta1
      summary: Create a user
      operationId: createUserSCIM
      description: >-
        Creates a user. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      requestBody:
        description: Creates a user.
        required: true
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/CreateUser'
      responses:
        '201':
          description: User is successfully created.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/SCIMUser'
          headers:
            Location:
              description: The URL that points to the newly created user resource.
              schema:
                type: string
        '400':
          description: >-
            Bad Request. Request is unparsable, syntactically incorrect, or
            violates schema.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authorization failure
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict. User with given user name already exists.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - SCIM v2beta1
      summary: List users
      description: >-
        List users. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      operationId: listUsersSCIM
      parameters:
        - in: query
          name: filter
          description: |
            Return only the subset of users that match the filter. 
            The filter grammar is a subset of OData 4.0.
            <br><br>**NOTE:** The filter query parameter must use [URL
            encoding](https://en.wikipedia.org/wiki/URL_encoding). Most clients
            do this automatically with inputs provided to them specifically as
            query parameters. Encoding must be done manually for any query
            parameters provided as part of the URL. The reserved characters `!`
            `#` `$` `&` `'` `(` `)` `*` `+` `,` `/` `:` `;` `=` `?` `@` `[` `]`
            must be encoded with percent encoded equivalents. <br><br>

            **The Get Users API filters enabled are**:
            - displayName
            - userName

            **Supported operators**:
            - sw (starts with)
            - co (contains)
          examples:
            Filter starts with displayName:
              summary: Filter starts with displayName
              description: >-
                Search for users whose display names start with specific text.
                Useful for finding users by specific prefixes or searching for
                users with common name patterns.
              value: displayName sw "sample"
            Filter starts with userName:
              summary: Filter starts with userName
              description: >-
                Search for users whose user names start with specific text.
                Useful for finding users by specific prefixes or searching for
                users with common name patterns.
              value: userName sw "sample"
            Filter with both displayName and userName:
              summary: Filter with both displayName and userName
              description: Returns users whose email or name start with "sample" text.
              value: displayName sw "sample" or userName sw "sample"
            Filter contains displayName:
              summary: Filter contains displayName
              description: >-
                Find users with specific text in their user name. For example,
                searching for "admin" is useful for identifying administrative
                accounts across the organization.
              value: displayName co "sample"
            Filter contains userName:
              summary: Filter contains userName
              description: >-
                Find users with specific text anywhere in their user name (email
                address). This search is useful for identifying users with
                common email domains or patterns in their email addresses, such
                as finding all users with "admin" or team identifiers in their
                addresses.
              value: userName co "sample"
          schema:
            type: string
          required: false
        - in: query
          name: count
          description: >-
            Specifies the number of query results to be returned in a query
            response page.
          schema:
            type: integer
            default: 200
            minimum: 1
            maximum: 200
          required: false
        - in: query
          name: startIndex
          description: Specifies the pagination start index. Index starts at 1.
          schema:
            type: integer
            default: 1
            minimum: 1
          required: false
        - in: query
          name: sortBy
          description: Specifies the attribute to sort the returned results by.
          schema:
            type: string
            enum:
              - displayName
              - meta.lastLogin
          required: false
        - in: query
          name: sortOrder
          description: Specifies the sort order.
          schema:
            type: string
            enum:
              - ascending
              - descending
          required: false
      responses:
        '200':
          description: A list of user objects.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/UsersList'
        '400':
          description: Bad Request
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authorization failure
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
  /identity/v2beta1/scim/v2/Users/{userId}:
    get:
      tags:
        - SCIM v2beta1
      summary: Get a user
      operationId: getUserSCIM
      description: >-
        Retrieve a user. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      parameters:
        - in: path
          name: userId
          description: >-
            The HPE GreenLake global user ID. Retrieve the ID from the `CREATE
            User` endpoint or the `GET User` endpoint.
          schema:
            type: string
          required: true
      responses:
        '200':
          description: User is successfully returned.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/SCIMUser'
        '400':
          description: >-
            Bad Request. Request is unparsable, syntactically incorrect, or
            violates schema.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authorization failure
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - SCIM v2beta1
      summary: Delete a user
      operationId: deleteUserSCIM
      description: >-
        Delete a user. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      parameters:
        - in: path
          name: userId
          description: >-
            The HPE GreenLake global user ID. Retrieve the ID from the `CREATE
            User` endpoint or the `GET User` endpoint.
          schema:
            type: string
          required: true
      responses:
        '204':
          description: User deleted successfully.
        '401':
          description: Authorization failure
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource does not exist.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
    patch:
      tags:
        - SCIM v2beta1
      summary: Patch user attributes
      operationId: patchUserSCIM
      description: >-
        Updates one or more user attributes. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644), except the `attributes` field
        is not supported.
      parameters:
        - in: path
          name: userId
          description: >-
            The HPE GreenLake global user ID. Retrieve the ID from the `CREATE
            User` endpoint or the `GET User` endpoint.
          schema:
            type: string
          required: true
      requestBody:
        description: Add, remove, or replace one or more attributes on a specified user.
        required: true
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/UserPatch'
      responses:
        '200':
          description: Operation performed successfully. Changed user returned.
        '204':
          description: Operation performed successfully. No content returned.
        '400':
          description: Bad Request
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: User does not exist
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
  /identity/v2beta1/scim/v2/Groups:
    get:
      tags:
        - SCIM v2beta1
      summary: List user groups
      operationId: listGroupsSCIM
      description: >-
        Get a list of user groups. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      parameters:
        - in: query
          name: filter
          description: >
            Return only the subset of groups that match the filter. 

            The filter grammar is a subset of OData 4.0.

            <br><br>**NOTE:** The filter query parameter must use [URL

            encoding](https://en.wikipedia.org/wiki/URL_encoding). Most clients

            do this automatically with inputs provided to them specifically as

            query parameters. Encoding must be done manually for any query

            parameters provided as part of the URL. The reserved characters `!`

            `#` `$` `&` `'` `(` `)` `*` `+` `,` `/` `:` `;` `=` `?` `@` `[` `]`

            must be encoded with percent encoded equivalents. <br><br>


            **The Get Groups API filters enabled are**:


            Supported filters:

            - `displayName` (operators: `sw`, `eq`, `co`)

            -
            `urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group:source`
            (operators: `eq`)
          examples:
            StartsWith Filter with displayName:
              summary: Use the StartsWith filter with displayName
              description: >-
                Search for groups whose display names start with specific text.
                Useful for finding groups by specific prefixes or searching for
                groups with common naming patterns.
              value: displayName sw "sample"
            Equals Filter with displayName:
              summary: Use the equals filter with displayName
              description: >-
                Search for groups whose display name exactly matches the
                specified text. This filter is useful for finding specific
                groups when you know the exact group name, ensuring exact
                matches and no partial results.
              value: displayName eq "sample"
            Equals Filter with source:
              summary: Use the equals filter with source
              description: Returns groups whose source equals "Local"
              value: >-
                urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group:source
                eq "Local"
          schema:
            type: string
          required: false
        - in: query
          name: count
          description: Number of results to return in a page.
          schema:
            type: integer
            default: 200
            maximum: 200
          required: false
        - in: query
          name: startIndex
          description: Specifies the pagination start index. Index starts at 1.
          schema:
            type: integer
            default: 1
            minimum: 1
          required: false
      responses:
        '200':
          description: Returned a list of user groups.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/GroupList'
        '400':
          description: Bad Request
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - SCIM v2beta1
      summary: Create a user group
      operationId: createGroupSCIM
      description: >-
        Create a user group. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      requestBody:
        description: Create user group object.
        required: true
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/CreateGroup'
      responses:
        '201':
          description: User group successfully created.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/SCIMGroup'
          headers:
            Location:
              description: URL of the created user group.
              schema:
                type: string
        '400':
          description: >-
            Bad Request. Request is unparsable, syntactically incorrect, or
            violates schema.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authorization failure
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Conflict. Group with given name already exists.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
  /identity/v2beta1/scim/v2/Groups/{groupId}:
    get:
      tags:
        - SCIM v2beta1
      summary: Get a user group
      operationId: getGroupSCIM
      description: >-
        Get a user group. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      parameters:
        - in: path
          name: groupId
          description: >-
            The HPE GreenLake user group ID. Retrieve the ID from the `CREATE
            Group` endpoint or the `GET Group` endpoint.
          schema:
            type: string
          required: true
      responses:
        '200':
          description: Returned user group.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/SCIMGroup'
        '400':
          description: Bad Request
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
    patch:
      tags:
        - SCIM v2beta1
      summary: Update user group
      operationId: patchGroupSCIM
      description: >-
        Add or remove users from a user group, or update the group name or
        description. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      parameters:
        - in: path
          name: groupId
          description: >-
            The HPE GreenLake user group ID. Retrieve the ID from the `CREATE
            Group` endpoint or the `GET Group` endpoint.
          schema:
            type: string
          required: true
      requestBody:
        description: >-
          Add or remove users from a user group, or update the group name or
          description. The replace operation is not supported for group members.
        required: true
        content:
          application/scim+json:
            schema:
              $ref: '#/components/schemas/PatchOperation'
            examples:
              AddUsers:
                value:
                  schemas:
                    - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                    - op: add
                      value:
                        - display: Babs Jensen
                          $ref: >-
                            https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646
                          value: 2819c223-7f76-453a-919d-413861904646
                      path: members
              RemoveUsers:
                value:
                  schemas:
                    - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                    - op: remove
                      value:
                        - display: Babs Jensen
                          $ref: >-
                            https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646
                          value: 2819c223-7f76-453a-919d-413861904646
                      path: members
              UpdateGroupName:
                value:
                  schemas:
                    - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                    - op: replace
                      value: New group name
                      path: displayName
              UpdateGroupDescription:
                value:
                  schemas:
                    - urn:ietf:params:scim:api:messages:2.0:PatchOp
                  Operations:
                    - op: replace
                      value: New group description
                      path: >-
                        urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group:groupDescription
      responses:
        '200':
          description: Group patched successfully.
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/SCIMGroup'
        '400':
          description: Bad Request
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - SCIM v2beta1
      summary: Delete a user group
      operationId: deleteGroupSCIM
      description: >-
        Delete a user group. Compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      parameters:
        - in: path
          name: groupId
          description: >-
            The HPE GreenLake user group ID. Retrieve the ID from the `CREATE
            Group` endpoint or the `GET Group` endpoint.
          schema:
            type: string
          required: true
      responses:
        '204':
          description: User group deleted successfully.
        '400':
          description: Bad Request
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Too Many Requests
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/scim+json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  securitySchemes:
    Bearer:
      description: >-
        Access token compliant with
        [RFC8725](https://datatracker.ietf.org/doc/html/rfc8725). Issued by HPE
        GreenLake.
      type: http
      scheme: bearer
      bearerFormat: JWT
  schemas:
    CreateUser:
      type: object
      required:
        - userName
        - name
        - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User
        - schemas
      properties:
        schemas:
          type: array
          minItems: 2
          description: >-
            Collection of schema URIs that define the structure and valid
            attributes for this resource. Each URI represents a schema that
            determines which properties can be included and how they should be
            formatted.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:schemas:core:2.0:User
              - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User
              - >-
                urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:posix:User
          example:
            - urn:ietf:params:scim:schemas:core:2.0:User
            - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User
        userName:
          type: string
          description: >-
            Must be the same as the primary email address and must be a valid
            email address. This serves as the unique identifier for the user.
          example: abc@xyz.com
          minLength: 5
          maxLength: 100
        displayName:
          type: string
          description: The display name of a user.
          example: Barbara Jensen
          maxLength: 201
        urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User:
          $ref: '#/components/schemas/UserCreateExtension'
        urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:posix:User:
          $ref: '#/components/schemas/PosixUserExtension'
        name:
          $ref: '#/components/schemas/Name'
        emails:
          type: array
          items:
            $ref: '#/components/schemas/Email'
        active:
          type: boolean
          description: >-
            Indicates the current status of the user account. `true` indicates
            that the user is active.
          readOnly: false
          default: false
    Name:
      description: An object that includes the given name and family name of a user.
      type: object
      required:
        - familyName
        - givenName
      properties:
        familyName:
          type: string
          example: Jensen
          maxLength: 50
        givenName:
          type: string
          example: Barbara
          maxLength: 50
    Email:
      type: object
      required:
        - value
      properties:
        primary:
          type: boolean
          description: >-
            A boolean declaring if the email is the primary email or not. The
            first email provided is considered the primary email.
          example: true
        value:
          type: string
          description: The email address of the user. Must be a valid email address.
          example: abc@xyz.com
          minLength: 5
          maxLength: 100
    UserExtension:
      description: >-
        The SCIM user extension defines additional attributes and structure for
        user resources in the SCIM API. This extension is compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      type: object
      required:
        - countryCode
        - primaryEmailVerified
      properties:
        status:
          type: string
          description: Indicates the current status of the user account.
          readOnly: true
          enum:
            - STAGED
            - ACTIVE
            - ACTIVATING
          example: STAGED
        countryCode:
          type: string
          description: Specifies the user's country using a two-letter ISO code.
          example: US
        primaryEmailVerified:
          type: boolean
          description: >-
            A boolean declaring if the user's primary email was verified. `true`
            if the email is verified.
          readOnly: true
          example: true
        hpe_principal:
          type: string
          description: The security principal for role assignments.
          readOnly: true
          example: user:448ebfdb-7bc9-402f-9eb0-f9a86c06ca5a
        source:
          type: string
          description: >-
            The source of the user, defines where the user's lifecycle is being
            controlled from.
          readOnly: true
          enum:
            - Local
            - SCIM
            - External
          example: Local
        sourceInstance:
          type: string
          description: >
            The source instance is set according to the source of the user.

            It will be the following according to the source type:


            - **Local**—A user managed by the current organization. 
              A user was directly added to the organization from the **Organization users** page on the platform. 
              Alternatively, A user was automatically added to the organization
                when they were added to an organization workspace.
              - **Source instance**—The current organization's `orgId`.

            - **SCIM**—Users were added to the organization through a SCIM
            integration with an external IdP. For example, Azure.
              - **Source instance**—The SCIM integration's `scimId`

            - **External**—A user managed by a different organization. Users
            were automatically added to the organization when they were added to
            an organization workspace through propagation from an external
            organization.
              - **Source instance**—The external controlling organization's `orgId`.
          readOnly: true
          example: d27e9581-f879-4c3d-b902-29c0a48f0002
    UserCreateExtension:
      description: >
        The SCIM user creation extension defines additional attributes and
        structure

        for creating user resources in the SCIM API. This extension is compliant

        with [SCIM 2.0](https://tools.ietf.org/html/rfc7644).
      type: object
      required:
        - countryCode
      properties:
        status:
          type: string
          description: >-
            Indicates the current status of the user account. This field is
            automatically managed by the system based on the user's lifecycle
            events.
          readOnly: true
          enum:
            - STAGED
            - ACTIVE
          example: STAGED
        countryCode:
          type: string
          description: Specifies the user's country using a two-letter ISO country code.
          example: US
          pattern: '[A-Z]{2}'
        primaryEmailVerified:
          type: boolean
          description: >-
            A boolean declaring if the user's primary email was verified. `true`
            if the email is verified.
          readOnly: true
          example: true
        hpe_principal:
          type: string
          description: >-
            The unique identifier of the security principal for role-based
            access control (RBAC) assignments.
          readOnly: true
          example: user:448ebfdb-7bc9-402f-9eb0-f9a86c06ca5a
    GroupExtension:
      description: |
        The SCIM group extension defines additional attributes and structure
        for group resources in the SCIM API. This extension is compliant
        with [SCIM 2.0](https://tools.ietf.org/html/rfc7644).
      type: object
      properties:
        hpe_principal:
          type: string
          description: The security principal for role assignments.
          readOnly: true
          example: user-group:448ebfdb-7bc9-402f-9eb0-f9a86c06ca5a
        groupDescription:
          type: string
          description: >-
            A description of the user group. This might include the group's
            purpose or responsibilities. This helps administrators understand
            the group's role in the Organization.
          example: Office users
        source:
          type: string
          description: >-
            The source of the user group, defines where the user's group
            lifecycle is being controlled from.
          readOnly: true
          enum:
            - Local
            - SCIM
            - External
          example: Local
        sourceInstance:
          type: string
          description: >
            The source instance is set according to the source of the user
            group.

            It will be the following according to the source type:


            - **Local**—A group managed by the current organization. 
              - **Source instance**—The current organization's `orgId`.

            - **SCIM**—A group managed by a SCIM integration, for example,
            Azure.
              - **Source instance**—The SCIM Integration's `scimId`.

            - **External**—A group managed by a different organization.
              - **Source instance**—The external controlling organization's ID.
          readOnly: true
          example: d27e9581-f879-4c3d-b902-29c0a48f0002
    Error:
      type: object
      required:
        - schemas
        - status
        - detail
      properties:
        schemas:
          type: array
          items:
            type: string
            enum:
              - urn:ietf:params:scim:api:messages:2.0:Error
              - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Error
        scimType:
          description: >
            A machine-readable error type that indicates the nature of the
            error.

            This is a SCIM-specific error type.
          type: string
          example: invalidSyntax
        detail:
          type: string
          description: Additional detailed information about the error.
          example: Request is unparsable, syntactically incorrect, or violates schema.
        status:
          type: string
          description: The HTTP status code
          example: '400'
        urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Error:
          $ref: '#/components/schemas/GLPErrorExtension'
    GLPErrorExtension:
      description: >
        The HPE GreenLake error extension defines additional attributes and
        structure

        for error responses in the SCIM API.
      type: object
      required:
        - httpStatusCode
        - errorCode
        - message
        - debugId
      properties:
        httpStatusCode:
          type: integer
          description: http error code
          example: 400
        errorCode:
          type: string
          description: >-
            A unique machine-friendly, but human-readable identifier for the
            error.
          example: HPE_GL_IDENTITY_BAD_REQUEST
        message:
          type: string
          description: A user-friendly error message.
          example: Bad request
        debugId:
          type: string
          description: >-
            A unique identifier for the instance of this error. This can be used
            to help with troubleshooting.
          example: a1f13ec0-8391-46ed-8517-f13ef13da145
    UserMeta:
      type: object
      properties:
        created:
          description: The date and time the resource was created.
          type: string
          readOnly: true
          example: '2022-01-01T00:00:00Z'
        lastModified:
          description: The date and time the resource was last modified.
          type: string
          readOnly: true
          example: '2022-01-01T00:00:00Z'
        lastLogin:
          description: The date and time the user last logged in.
          type: string
          readOnly: true
          example: '2022-01-01T00:00:00Z'
        location:
          type: string
          description: The resource location URI.
          readOnly: true
          example: /identity/v2beta1/scim/v2/Users/12345161346147c6bc2bdeae11012345
        resourceType:
          type: string
          readOnly: true
          enum:
            - User
          example: User
        version:
          type: string
          description: The version of the resource.
          readOnly: true
          example: 1
      description: resource metadata
    SCIMUser:
      description: >
        The SCIM user schema defines the attributes and structure for user
        resources

        in the SCIM API. This schema is compliant with [SCIM
        2.0](https://tools.ietf.org/html/rfc7644).
      type: object
      required:
        - schemas
        - id
        - active
        - userName
        - displayName
        - meta
        - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User
        - name
      properties:
        schemas:
          type: array
          description: >-
            Collection of URIs that identify the schemas used to define the
            structure and attributes of this User resource. These schemas
            determine which properties are valid for the resource.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:schemas:core:2.0:User
              - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User
              - >-
                urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:posix:User
          example:
            - urn:ietf:params:scim:schemas:core:2.0:User
            - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User
          required:
            - urn:ietf:params:scim:schemas:core:2.0:User
            - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User
        id:
          type: string
          description: >-
            HPE GreenLake global user ID unique resource identifier randomly
            generated by the system.
          readOnly: true
          example: 448ebfdb-7bc9-402f-9eb0-f9a86c06ca5a
        active:
          type: boolean
          description: >-
            A boolean indicating whether the user is active in the system. When
            `true`, the user is active.
          readOnly: true
          default: false
        userName:
          type: string
          description: Must be the same as work type email address.
          example: abc@xyz.com
        displayName:
          type: string
          description: The display name for the user.
          example: Joe Smith
        meta:
          $ref: '#/components/schemas/UserMeta'
        urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:User:
          $ref: '#/components/schemas/UserExtension'
        name:
          $ref: '#/components/schemas/Name'
        emails:
          type: array
          items:
            $ref: '#/components/schemas/Email'
        urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:posix:User:
          $ref: '#/components/schemas/PosixUserExtension'
    PatchOperation:
      type: object
      required:
        - schemas
        - Operations
      properties:
        schemas:
          type: array
          minItems: 1
          description: >
            Collection of schema URIs that define the structure and valid
            attributes for this resource.

            Each URI represents a schema that determines which properties can be
            included and how they should be formatted.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:api:messages:2.0:PatchOp
          example:
            - urn:ietf:params:scim:api:messages:2.0:PatchOp
        Operations:
          type: array
          items:
            $ref: '#/components/schemas/Operation'
    Operation:
      type: object
      required:
        - op
        - path
        - value
      properties:
        op:
          type: string
          description: >
            Operation performed by patch.

            - `add` or `Add`—If the user was already a member of this group, no
            changes will be made to the resource and a success response will be
            returned.

            - `remove` or `Remove`—If any of the requested users to be removed
            are not a member of this group, a success (204) response will be
            returned.

            - `replace` or `Replace`—Change the name or description of the
            group.
          enum:
            - add
            - Add
            - remove
            - Remove
            - replace
            - Replace
          example: add
        value:
          anyOf:
            - type: string
              description: New value for the attribute being modified.
            - type: array
              description: A list of users to patch the user group with.
              items:
                required:
                  - display
                  - $ref
                  - value
                type: object
                description: Users to be added to the group or removed from the group.
                properties:
                  display:
                    type: string
                    description: The display name of the resource.
                    example: Babs Jensen
                  $ref:
                    type: string
                    description: URI to the resource.
                    example: >-
                      https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646
                  value:
                    type: string
                    description: User ID.
                    example: 2819c223-7f76-453a-919d-413861904646
        path:
          type: string
          description: Attribute path describing the target of the operation.
          enum:
            - members
            - displayName
            - >-
              urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group:groupDescription
    CreateGroup:
      type: object
      required:
        - displayName
        - schemas
      properties:
        schemas:
          type: array
          minItems: 1
          description: >
            Collection of schema URIs that define the structure and valid
            attributes for this resource.

            Each URI represents a schema that determines which properties can be
            included and how they should be formatted.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:schemas:core:2.0:Group
              - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group
          example:
            - urn:ietf:params:scim:schemas:core:2.0:Group
            - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group
          required:
            - urn:ietf:params:scim:schemas:core:2.0:Group
        displayName:
          type: string
          description: The display name of the user group.
          example: Demo Group
          maxLength: 201
        urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group:
          $ref: '#/components/schemas/GroupExtension'
    SCIMGroup:
      type: object
      required:
        - schemas
        - id
        - displayName
        - meta
        - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group
      properties:
        schemas:
          type: array
          description: >
            Collection of schema URIs that define the structure and valid
            attributes for this resource.

            Each URI represents a schema that determines which properties can be
            included and how they should be formatted.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:schemas:core:2.0:Group
              - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group
          example:
            - urn:ietf:params:scim:schemas:core:2.0:Group
            - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group
          required:
            - urn:ietf:params:scim:schemas:core:2.0:Group
            - urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group
        id:
          type: string
          description: The unique identifier for an HPE GreenLake user group.
          readOnly: true
          example: 448ebfdb-7bc9-402f-9eb0-f9a86c06ca5a
        displayName:
          type: string
          description: >
            Unique display name for the user group. A valid `displayName` can
            contain alphanumeric characters, space, 
                  or any of the following: `-`, `/`, `_`, `.`, `!`, `(`, `)`, `[`, `]`, `<`, `>`
          example: Sales Group
          maxLength: 201
        meta:
          $ref: '#/components/schemas/GroupMeta'
        urn:ietf:params:scim:schemas:extensions:hpe-greenlake:2.0:Group:
          $ref: '#/components/schemas/GroupExtension'
    GroupMeta:
      type: object
      properties:
        created:
          type: string
          description: The date and time the resource was created.
          readOnly: true
          example: '2022-01-01T00:00:00Z'
        lastModified:
          type: string
          description: The date and time the resource was last modified.
          readOnly: true
          example: '2022-01-01T00:00:00Z'
        location:
          type: string
          readOnly: true
          description: The resource location URI.
          example: >-
            /identity/v2beta1/scim/v2/Groups/12345ef4-c6d5-4288-b5f7-71730bd12345
        resourceType:
          type: string
          description: The type of the resource.
          readOnly: true
          enum:
            - Group
          example: Group
      description: resource metadata
    GroupList:
      type: object
      required:
        - Resources
        - schemas
        - totalResults
      properties:
        Resources:
          type: array
          description: A list of user group objects.
          items:
            $ref: '#/components/schemas/SCIMGroup'
        startIndex:
          type: integer
          description: Specifies the pagination start index. Index starts at 1.
        totalResults:
          type: integer
          description: >-
            The total number of results returned by the query including pages
            not shown.
        itemsPerPage:
          type: integer
          description: The number of resources returned in a list response page.
        schemas:
          type: array
          description: >
            Collection of schema URIs that define the structure and valid
            attributes for this resource.

            Each URI represents a schema that determines which properties can be
            included and how they should be formatted.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:api:messages:2.0:ListResponse
          required:
            - urn:ietf:params:scim:api:messages:2.0:ListResponse
    UsersList:
      type: object
      required:
        - Resources
        - schemas
        - totalResults
      properties:
        Resources:
          type: array
          description: A list of user objects.
          items:
            $ref: '#/components/schemas/SCIMUser'
        startIndex:
          type: integer
          description: Specifies the pagination start index. Index starts at 1.
        totalResults:
          type: integer
          description: >-
            The total number of results returned by the query including pages
            not shown.
        itemsPerPage:
          type: integer
          description: The number of resources returned in a list response page.
        schemas:
          type: array
          description: >-
            Collection of schema URIs that define the structure and valid
            attributes for this resource.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:api:messages:2.0:ListResponse
    UserPatch:
      type: object
      required:
        - schemas
        - Operations
      properties:
        schemas:
          type: array
          minItems: 1
          description: >-
            Collection of schema URIs that define the structure and valid
            attributes for this resource. Each URI represents a schema that
            determines which properties can be included and how they should be
            formatted.
          items:
            type: string
            enum:
              - urn:ietf:params:scim:api:messages:2.0:PatchOp
          example:
            - urn:ietf:params:scim:api:messages:2.0:PatchOp
        Operations:
          type: array
          description: >-
            List of operations to be performed on the user. See [RFC 7644,
            Section
            3.5.2](https://www.rfc-editor.org/rfc/rfc7644#section-3.5.2).
          items:
            $ref: '#/components/schemas/UserPatchOp'
    UserPatchOp:
      type: object
      required:
        - op
      properties:
        op:
          type: string
          description: |
            Operations performed by patch.
              - `add` or `Add`—The user object has the specified attribute added to it or updated if it already exists.
              - `remove` or `Remove`—The user object has the specified attribute removed from it.
              - `replace` or `Replace`—The user object has the specified attribute replaced with the new value.
          enum:
            - add
            - Add
            - remove
            - Remove
            - replace
            - Replace
        path:
          type: string
          description: |
            Attribute path describing the target of the operation. 
            This optional attribute must be only one path to a valid target in 
            the user schemas.
          example: emails
        value:
          anyOf:
            - type: string
            - type: boolean
            - type: array
              items:
                $ref: '#/components/schemas/Email'
            - type: object
              additionalProperties: true
            - $ref: '#/components/schemas/Name'
            - type: array
              items:
                type: object
                additionalProperties: true
          description: >-
            The value of the attribute or attributes to be added, removed, or
            replaced.
          example:
            - value: babs@jensen.org
              primary: true
    PosixUserExtension:
      description: >
        The POSIX user extension enables integration with Unix/Linux systems by
        providing 

        system-level user account attributes. POSIX (Portable Operating System
        Interface) 

        is a standard for Unix-like operating systems. 


        If your organization does not use Unix/Linux systems, this extension can
        be omitted. Posix attributes are disabled by default, but can be
        included if they're enabled within the target organization.
      type: object
      required:
        - uid
        - userName
        - gid
      properties:
        uid:
          type: integer
          description: >
            Numeric user identifier used by Unix/Linux systems to identify users
            at the 

            operating system level. This number (typically 1000+) is used for
            file 

            ownership and process permissions. Required for users who need
            access to 

            Unix/Linux systems or file shares.
          readOnly: false
          example: 1001
        userName:
          type: string
          description: >
            Login name for the user on Unix/Linux systems. This is the name used
            for 

            SSH connections, terminal sessions, and system authentication.
            Should be 

            lowercase and contain only alphanumeric characters and underscores.
          readOnly: false
          example: jdoe
        gid:
          type: integer
          description: >
            Primary group identifier for the user on Unix/Linux systems. This
            numeric 

            ID determines the user's default group membership and is used for
            file 

            permissions and access control.
          readOnly: false
          example: 2001
        homeDirectory:
          type: string
          description: >
            Full path to the user's home directory on Unix/Linux systems. This
            is 

            where the user's personal files are stored and where they are
            placed 

            when logging in via SSH or terminal.
          example: /home/jdoe
        shell:
          type: string
          description: >
            Default command shell for the user on Unix/Linux systems. This
            determines 

            the command interpreter used when the user logs in via SSH or
            terminal. 

            Common shells include ``/bin/bash``, ``/bin/sh``, or ``/bin/zsh``.
          example: /bin/bash
