Replace SCIM Role Mappings

PUT

/v1/organisations/{org_id}/scim/role-mappings

Send

Authorization

Path

Query

Body

Replace the organisation's full group-to-role mapping table.

Authorization: scim:manage. Each role must be a system role or one of this organisation's custom roles (422 unknown_role), never the owner role (422 owner_role_not_assignable), and within the caller's own permissions (403 permission_escalation). A group may appear once (422).

When a user's groups map to several roles, the mapping with the lowest priority wins and ties go to the mapping listed first. Existing SCIM users' roles are not recomputed automatically - call POST /{org_id}/scim/sync afterwards to apply the new mapping (mirrors the "Sync" action in the settings UI).

Path Parameters

Query Parameters

Response Body

curl -X PUT "https://example.com/v1/organisations/497f6eca-6276-4993-bfeb-53cbbbba6f08/scim/role-mappings" \  -H "Content-Type: application/json" \  -d '{    "mappings": [      {        "group_display_name": "string",        "role_id": "ac4e70c8-d5be-48af-93eb-760f58fc91a9"      }    ]  }'

[  {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "group_display_name": "string",    "role": "string",    "role_id": "ac4e70c8-d5be-48af-93eb-760f58fc91a9",    "role_ref": {      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",      "key": "string",      "name": "string",      "is_system": true    },    "priority": 0  }]

{  "detail": [    {      "loc": [        "string"      ],      "msg": "string",      "type": "string"    }  ]}