SCIM Monitoring

• HTTP request metrics for paths under /scim/v2. These flow through the same observability stack as the rest of the Genesis API.
• SCIM audit rows in the SCIM_AUDIT_LOG table. Every inbound SCIM operation that mutates state writes a row here.

​

Signals to track

• SCIM request count by endpoint and HTTP status class (2xx / 4xx / 5xx).
• SCIM p50, p95, and p99 latency.
• Invalid bearer token count.
• Rate-limit events.
• User create / update / deactivate count.
• Group sync, group patch, and group delete count.
• Membership change count per group sync (helpful for catching mass changes).
• Unexpected active=false spikes.
• Audit write failures (visible in application logs).

​

Suggested alerts

​

Audit queries

​

Recent SCIM operations for a tenant

SELECT operation,
       resource_type,
       resource_id,
       external_id,
       created_at
FROM   SCIM_AUDIT_LOG
WHERE  tenant_id = :tenant_id
ORDER  BY created_at DESC
LIMIT  100;

​

Deprovision events

SELECT resource_id,
       external_id,
       before_json,
       after_json,
       created_at
FROM   SCIM_AUDIT_LOG
WHERE  tenant_id = :tenant_id
  AND  operation IN ('patch_user', 'deactivate_user')
  AND  after_json LIKE '%"active": false%'
ORDER  BY created_at DESC;

​

Group membership changes

SELECT resource_id AS group_id,
       after_json,
       created_at
FROM   SCIM_AUDIT_LOG
WHERE  tenant_id = :tenant_id
  AND  operation IN ('sync_group', 'delete_group')
ORDER  BY created_at DESC;

​

Dashboard guidance

• SCIM traffic by path.
• SCIM error rate by path and status.
• SCIM p95 latency.
• Provisioned active users (count over time).
• Deactivated users per hour.
• Group sync operations and largest membership snapshots per operation.
• Invalid token and rate-limit events.

​

SIEM export guidance

• tenant id
• operation
• resource type
• resource id
• external id
• before JSON
• after JSON
• created timestamp

​

Related pages

• SCIM Admin API
• SCIM Pilot Runbook
• SCIM Security