A SCIM 2.0 server for user provisioning from Okta (or any SCIM client), backed by Val Town SQLite.

In Okta's SCIM provisioning settings:

Field	Value
SCIM base URL	https://robyz7--d1499f0064e311f18c2c1607ee4eb77e.web.val.run
Unique identifier	userName
Auth mode	HTTP Header
Authorization header	Bearer <SCIM_TOKEN>

The bearer token is read from the SCIM_TOKEN environment variable.

👉 Set/rotate the token here: https://www.val.town/x/robyz7/test-scim/environment-variables?key=SCIM_TOKEN

Method	Path	Purpose
GET	/ServiceProviderConfig	Capability discovery
GET	/ResourceTypes	Resource type discovery
GET	/Users	List users (supports ?filter=userName eq "...")
GET	/Users/:id	Fetch one user
POST	/Users	Create user (409 if userName exists)
PUT	/Users/:id	Full replace
PATCH	/Users/:id	Partial update (e.g. deactivate via active:false)
DELETE	/Users/:id	Hard delete (204)

Rendering mermaid diagram...

• main.ts — HTTP entrypoint: bearer-token auth middleware + all SCIM routes.
• scim.ts — Converts between DB rows and SCIM JSON; filter parsing; error shapes.
• db.ts — SQLite schema (scim_users) and CRUD helpers.

• Deactivation: Okta sends PATCH with active:false to offboard a user; the row is kept but marked inactive. A separate DELETE removes it entirely.
• The legacy hardcoded john.doe / jane.smith demo users are gone — data is now persisted per real provisioning events.