> ## Documentation Index
> Fetch the complete documentation index at: https://docs.genesiscomputing.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Monitoring

> Operational signals, suggested alerts, audit queries, and SIEM export guidance for inbound SCIM.

Genesis records SCIM activity in two places:

* **HTTP request metrics** for paths under `/scim/v2`. These flow through the
  same observability stack as the rest of the Genesis API.
* **SCIM audit rows** in the `SCIM_AUDIT_LOG` table. Every inbound SCIM
  operation that mutates state writes a row here.

Use both together: HTTP metrics for traffic shape and error rates, and audit
rows for compliance evidence and forensic queries.

## Signals to track

For each tenant that has SCIM enabled:

* SCIM request count by endpoint and HTTP status class (`2xx` / `4xx` / `5xx`).
* SCIM `p50`, `p95`, and `p99` latency.
* Invalid bearer token count.
* Rate-limit events.
* User create / update / deactivate count.
* Group sync, group patch, and group delete count.
* Membership change count per group sync (helpful for catching mass changes).
* Unexpected `active=false` spikes.
* Audit write failures (visible in application logs).

## Suggested alerts

These thresholds are starting points. Tune to your customer's traffic shape.

| Alert | Suggested threshold | Why it matters |
| - | -: | - |
| High SCIM `5xx` rate | More than 2% over 10 minutes | IdP provisioning will retry or stall. |
| High SCIM `4xx` rate | More than 10 requests over 10 minutes | Usually a bad token, bad mapping, or unsupported payload. |
| Rate-limit events | Any sustained events over 5 minutes | The customer IdP may be looping or misconfigured. |
| Deprovision spike | More than 10% of tenant users deactivated in 15 minutes | Prevent accidental account lockout. |
| Large group churn | More than 500 membership changes in a single operation | Pause and review before customer production rollout. |
| Audit write failure | Any occurrence | Compliance evidence may be incomplete. |

## Audit queries

The exact column names depend on your `SCIM_AUDIT_LOG` table; the queries
below are examples for the Genesis-managed schema. Adjust the tenant
identifier and date column to match your environment.

### Recent SCIM operations for a tenant

```sql theme={null}
SELECT operation,
       resource_type,
       resource_id,
       external_id,
       created_at
FROM   SCIM_AUDIT_LOG
WHERE  tenant_id = :tenant_id
ORDER  BY created_at DESC
LIMIT  100;
```

### Deprovision events

```sql theme={null}
SELECT resource_id,
       external_id,
       before_json,
       after_json,
       created_at
FROM   SCIM_AUDIT_LOG
WHERE  tenant_id = :tenant_id
  AND  operation IN ('patch_user', 'deactivate_user')
  AND  after_json LIKE '%"active": false%'
ORDER  BY created_at DESC;
```

### Group membership changes

```sql theme={null}
SELECT resource_id AS group_id,
       after_json,
       created_at
FROM   SCIM_AUDIT_LOG
WHERE  tenant_id = :tenant_id
  AND  operation IN ('sync_group', 'delete_group')
ORDER  BY created_at DESC;
```

Set `:tenant_id` to the tenant identifier returned by the
[SCIM admin config endpoint](/docs/Setup/SCIM-Admin-API#inspect-scim-configuration)
before running these queries on shared deployments.

## Dashboard guidance

For a pilot, existing HTTP request metrics plus the audit-table queries above
are usually sufficient. For ongoing production operations, export the
following as dedicated dashboards:

* SCIM traffic by path.
* SCIM error rate by path and status.
* SCIM `p95` latency.
* Provisioned active users (count over time).
* Deactivated users per hour.
* Group sync operations and largest membership snapshots per operation.
* Invalid token and rate-limit events.

## SIEM export guidance

For customers with regulatory or compliance requirements, export
`SCIM_AUDIT_LOG` rows to your SIEM or data warehouse. The minimum useful
event fields are:

* tenant id
* operation
* resource type
* resource id
* external id
* before JSON
* after JSON
* created timestamp

<Warning>
  Do not export bearer token values. Persisted SCIM tokens are stored as
  hashes and should not appear in audit payloads. If you observe a token
  value in an audit row, treat it as an incident and rotate immediately.
</Warning>

## Related pages

* [SCIM Admin API](/docs/Setup/SCIM-Admin-API)
* [SCIM Pilot Runbook](/docs/Setup/SCIM-Pilot-Runbook)
* [SCIM Security](/docs/Setup/SCIM-Security)