Developer tooling · Apache 2.0

scim-compliance-tester

Go CLI that tests a SCIM 2.0 endpoint against the spec — idempotency, PATCH semantics, group membership, deactivation flow.

View on GitHub →Go

About

Open-source CLI tool that exercises a SCIM 2.0 endpoint against the seven failure patterns most commonly found in production SCIM implementations: non-idempotent endpoints, broken PATCH semantics, group-membership desync between User and Group resources, deactivation semantics, incorrect HTTP error codes, missing rate limiting / backpressure, and missing audit trails.

Designed to be runnable in CI against any SCIM 2.0 endpoint. Output is human-readable + JSON. Built to complement the official IdP SCIM validators (Okta SCIM Spec Test, Microsoft Entra Validator).

Features

Tests SCIM 2.0 endpoint against the 7 most common failure patterns
Idempotency check on User create + PATCH
PATCH path-filter semantics validation
Group membership consistency (User.groups ↔ Group.members)
Deactivation semantics
HTTP error code conformance
Rate-limit + backpressure verification
CI-friendly exit codes + JUnit XML output

Install

# Homebrew
brew install askmeidentity/tap/scim-compliance-tester

# Go install
go install github.com/askmeidentity/scim-compliance-tester@latest

# Docker
docker pull ghcr.io/askmeidentity/scim-compliance-tester:latest

Usage

scim-compliance-tester run \
  --endpoint https://api.example.com/scim/v2 \
  --auth-token $SCIM_TOKEN \
  --output json

Related resources