Skip to main content

Scim

View as Markdown

Manage users, service principals, groups and their permissions in Accounts and Workspaces

Create Account Group GA

POST /api/2.0/accounts/{account_id}/scim/v2/Groups

Creates a group in the <Databricks> account with a unique name, using the supplied group details.

API scopes: scim

Parameters

account_idstringpath

<Databricks> account ID

Request body

displayNamestring

String that represents a human-readable group name

externalIdstring
idstring

<Databricks> group ID

membersarray of object
Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring

Response

displayNamestring

String that represents a human-readable group name

externalIdstring

external_id should be unique for identifying groups

Constraints: <= 64 characters

idstring

<Databricks> group ID

membersarray of object
Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
account_idstring

<Databricks> account ID

Delete Account Group GA

DELETE /api/2.0/accounts/{account_id}/scim/v2/Groups/{id}

Deletes a group from the <Databricks> account.

API scopes: scim

Parameters

idstringpath

Unique ID for a group in the <Databricks> account.

account_idstringpath

<Databricks> account ID

Get Account Group GA

GET /api/2.0/accounts/{account_id}/scim/v2/Groups/{id}

Gets the information for a specific group in the <Databricks> account.

API scopes: scim

Parameters

idstringpath

Unique ID for a group in the <Databricks> account.

account_idstringpath

<Databricks> account ID

Response

displayNamestring

String that represents a human-readable group name

externalIdstring

external_id should be unique for identifying groups

Constraints: <= 64 characters

idstring

<Databricks> group ID

membersarray of object
Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
account_idstring

<Databricks> account ID

List Account Groups GA

GET /api/2.0/accounts/{account_id}/scim/v2/Groups

Gets all details of the groups associated with the <Databricks> account. As of 08/22/2025, this endpoint will no longer return members. Instead, members should be retrieved by iterating through Get group details. Existing accounts that rely on this attribute will not be impacted and will continue receiving member data as before.

API scopes: scim

Parameters

account_idstringpath

<Databricks> account ID

filterstringquery

Query by which the results have to be filtered. Supported operators are equals(eq), contains(co), starts with(sw) and not equals(ne). Additionally, simple expressions can be formed using logical operators - and and or. The SCIM RFC has more details but we currently only support simple expressions.

attributesstringquery

Comma-separated list of attributes to return in response.

excludedAttributesstringquery

Comma-separated list of attributes to exclude in response.

startIndexint64query

Specifies the index of the first result. First item is number 1.

countint64query

Desired number of results per page. Default is 10000.

Constraints: <= 100

sortBystringquery

Attribute to sort the results.

sortOrderstringquery

The order to sort the results.

Values: ORDER_UNSPECIFIED, ASCENDING, DESCENDING

Response

itemsPerPageint32

Total results returned in the response.

Resourcesarray of object

User objects returned in the response.

Show child attributesHide child attributes
displayNamestring

String that represents a human-readable group name

externalIdstring

external_id should be unique for identifying groups

Constraints: <= 64 characters

idstring

<Databricks> group ID

membersarray of object
Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
account_idstring

<Databricks> account ID

startIndexint64

Starting index of all the results that matched the request filters. First item is number 1.

Default: 1

totalResultsint32

Total results that match the request filters.

Patch Account Group GA

PATCH /api/2.0/accounts/{account_id}/scim/v2/Groups/{id}

Partially updates the details of a group.

API scopes: scim

Parameters

idstringpath

Unique ID in the <Databricks> workspace.

account_idstringpath

<Databricks> account ID

Request body

Operationsarray of object
Show child attributesHide child attributes
opstring

Type of patch operation.

Values: PATCH_OP_UNSPECIFIED, ADD, REMOVE, REPLACE

pathstring

Selection of patch operation

valueobject

Value to modify

schemasarray of string

The schema of the patch request. Must be ["urn:ietf:params:scim:api:messages:2.0:PatchOp"].

Values: PATCH_SCHEMA_UNSPECIFIED, URN_IETF_PARAMS_SCIM_API_MESSAGES_2_0_PATCH_OP

Update Account Group GA

PUT /api/2.0/accounts/{account_id}/scim/v2/Groups/{id}

Updates the details of a group by replacing the entire group entity.

API scopes: scim

Parameters

idstringpath

<Databricks> group ID

account_idstringpath

<Databricks> account ID

Request body

displayNamestring

String that represents a human-readable group name

externalIdstring
membersarray of object
Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring

Create Account Service Principal GA

POST /api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals

Creates a new service principal in the <Databricks> account.

API scopes: scim

Parameters

account_idstringpath

<Databricks> account ID

Request body

activeboolean

If this user is active

applicationIdstring

UUID relating to the service principal

displayNamestring

String that represents a concatenation of given and family names.

Example: etl-service

externalIdstring
idstring

<Databricks> service principal ID.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring

Response

activeboolean

If this user is active

applicationIdstring

UUID relating to the service principal

displayNamestring

String that represents a concatenation of given and family names.

Example: etl-service

externalIdstring

Constraints: <= 64 characters

idstring

<Databricks> service principal ID.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
account_idstring

<Databricks> account ID

Delete Account Service Principal GA

DELETE /api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals/{id}

Delete a single service principal in the <Databricks> account.

API scopes: scim

Parameters

idstringpath

Unique ID for a service principal in the <Databricks> account.

account_idstringpath

<Databricks> account ID

Get Account Service Principal GA

GET /api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals/{id}

Gets the details for a single service principal define in the <Databricks> account.

API scopes: scim

Parameters

idstringpath

Unique ID for a service principal in the <Databricks> account.

account_idstringpath

<Databricks> account ID

Response

activeboolean

If this user is active

applicationIdstring

UUID relating to the service principal

displayNamestring

String that represents a concatenation of given and family names.

Example: etl-service

externalIdstring

Constraints: <= 64 characters

idstring

<Databricks> service principal ID.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
account_idstring

<Databricks> account ID

List Account Service Principals GA

GET /api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals

Gets the set of service principals associated with a <Databricks> account.

API scopes: scim

Parameters

account_idstringpath

<Databricks> account ID

attributesstringquery

Comma-separated list of attributes to return in response.

countint64query

Desired number of results per page. Default is 10000.

Constraints: <= 100

excludedAttributesstringquery

Comma-separated list of attributes to exclude in response.

filterstringquery

Query by which the results have to be filtered. Supported operators are equals(eq), contains(co), starts with(sw) and not equals(ne). Additionally, simple expressions can be formed using logical operators - and and or. The SCIM RFC has more details but we currently only support simple expressions.

sortBystringquery

Attribute to sort the results.

sortOrderstringquery

The order to sort the results.

Values: ORDER_UNSPECIFIED, ASCENDING, DESCENDING

startIndexint64query

Specifies the index of the first result. First item is number 1.

Response

itemsPerPageint32

Total results returned in the response.

Resourcesarray of object

User objects returned in the response.

Show child attributesHide child attributes
activeboolean

If this user is active

applicationIdstring

UUID relating to the service principal

displayNamestring

String that represents a concatenation of given and family names.

Example: etl-service

externalIdstring

Constraints: <= 64 characters

idstring

<Databricks> service principal ID.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
account_idstring

<Databricks> account ID

startIndexint64

Starting index of all the results that matched the request filters. First item is number 1.

Default: 1

totalResultsint32

Total results that match the request filters.

Patch Account Service Principal GA

PATCH /api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals/{id}

Partially updates the details of a single service principal in the <Databricks> account.

API scopes: scim

Parameters

idstringpath

Unique ID in the <Databricks> workspace.

account_idstringpath

<Databricks> account ID

Request body

Operationsarray of object
Show child attributesHide child attributes
opstring

Type of patch operation.

Values: PATCH_OP_UNSPECIFIED, ADD, REMOVE, REPLACE

pathstring

Selection of patch operation

valueobject

Value to modify

schemasarray of string

The schema of the patch request. Must be ["urn:ietf:params:scim:api:messages:2.0:PatchOp"].

Values: PATCH_SCHEMA_UNSPECIFIED, URN_IETF_PARAMS_SCIM_API_MESSAGES_2_0_PATCH_OP

Update Account Service Principal GA

PUT /api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals/{id}

Updates the details of a single service principal.

This action replaces the existing service principal with the same name.

API scopes: scim

Parameters

idstringpath

<Databricks> service principal ID.

account_idstringpath

<Databricks> account ID

Request body

activeboolean

If this user is active

applicationIdstring

UUID relating to the service principal

displayNamestring

String that represents a concatenation of given and family names.

Example: etl-service

externalIdstring
rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring

Create Account User GA

POST /api/2.0/accounts/{account_id}/scim/v2/Users

Creates a new user in the <Databricks> account. This new user will also be added to the <Databricks> account.

API scopes: scim

Parameters

account_idstringpath

<Databricks> account ID

Request body

activeboolean

If this user is active

displayNamestring

String that represents a concatenation of given and family names. For example John Smith.

emailsarray of object

All the emails associated with the <Databricks> user.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
externalIdstring

External ID is not currently supported. It is reserved for future use.

idstring

<Databricks> user ID.

nameobject
Show child attributesHide child attributes
familyNamestring

Family name of the <Databricks> user.

givenNamestring

Given name of the <Databricks> user.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
userNamestring

Email address of the <Databricks> user.

Response

activeboolean

If this user is active

displayNamestring

String that represents a concatenation of given and family names. For example John Smith.

emailsarray of object

All the emails associated with the <Databricks> user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
externalIdstring

External ID is not currently supported. It is reserved for future use.

Constraints: <= 64 characters

idstring

<Databricks> user ID.

nameobject
Show child attributesHide child attributes
familyNamestring

Family name of the <Databricks> user.

givenNamestring

Given name of the <Databricks> user.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
userNamestring

Email address of the <Databricks> user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.

account_idstring

<Databricks> account ID

Delete Account User GA

DELETE /api/2.0/accounts/{account_id}/scim/v2/Users/{id}

Deletes a user. Deleting a user from a <Databricks> account also removes objects associated with the user.

API scopes: scim

Parameters

idstringpath

Unique ID for a user in the <Databricks> account.

account_idstringpath

<Databricks> account ID

Get Account User GA

GET /api/2.0/accounts/{account_id}/scim/v2/Users/{id}

Gets information for a specific user in <Databricks> account.

API scopes: scim

Parameters

idstringpath

Unique ID for a user in the <Databricks> account.

account_idstringpath

<Databricks> account ID

attributesstringquery

Comma-separated list of attributes to return in response.

countint32query

Desired number of results per page. Default is 10000.

excludedAttributesstringquery

Comma-separated list of attributes to exclude in response.

filterstringquery

Query by which the results have to be filtered. Supported operators are equals(eq), contains(co), starts with(sw) and not equals(ne). Additionally, simple expressions can be formed using logical operators - and and or. The SCIM RFC has more details but we currently only support simple expressions.

sortBystringquery

Attribute to sort the results. Multi-part paths are supported. For example, userName, name.givenName, and emails.

sortOrderstringquery

The order to sort the results.

Values: GET_SORT_ORDER_UNSPECIFIED, ASCENDING, DESCENDING

startIndexint32query

Specifies the index of the first result. First item is number 1.

Response

activeboolean

If this user is active

displayNamestring

String that represents a concatenation of given and family names. For example John Smith.

emailsarray of object

All the emails associated with the <Databricks> user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
externalIdstring

External ID is not currently supported. It is reserved for future use.

Constraints: <= 64 characters

idstring

<Databricks> user ID.

nameobject
Show child attributesHide child attributes
familyNamestring

Family name of the <Databricks> user.

givenNamestring

Given name of the <Databricks> user.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
userNamestring

Email address of the <Databricks> user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.

account_idstring

<Databricks> account ID

List Account Users GA

GET /api/2.0/accounts/{account_id}/scim/v2/Users

Gets details for all the users associated with a <Databricks> account.

API scopes: scim

Parameters

account_idstringpath

<Databricks> account ID

attributesstringquery

Comma-separated list of attributes to return in response.

countint64query

Desired number of results per page. Default is 10000.

Constraints: <= 100

excludedAttributesstringquery

Comma-separated list of attributes to exclude in response.

filterstringquery

Query by which the results have to be filtered. Supported operators are equals(eq), contains(co), starts with(sw) and not equals(ne). Additionally, simple expressions can be formed using logical operators - and and or. The SCIM RFC has more details but we currently only support simple expressions.

sortBystringquery

Attribute to sort the results. Multi-part paths are supported. For example, userName, name.givenName, and emails.

sortOrderstringquery

The order to sort the results.

Values: ORDER_UNSPECIFIED, ASCENDING, DESCENDING

startIndexint64query

Specifies the index of the first result. First item is number 1.

Response

itemsPerPageint32

Total results returned in the response.

Resourcesarray of object

User objects returned in the response.

Show child attributesHide child attributes
activeboolean

If this user is active

displayNamestring

String that represents a concatenation of given and family names. For example John Smith.

emailsarray of object

All the emails associated with the <Databricks> user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
externalIdstring

External ID is not currently supported. It is reserved for future use.

Constraints: <= 64 characters

idstring

<Databricks> user ID.

nameobject
Show child attributesHide child attributes
familyNamestring

Family name of the <Databricks> user.

givenNamestring

Given name of the <Databricks> user.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
userNamestring

Email address of the <Databricks> user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.

account_idstring

<Databricks> account ID

startIndexint64

Starting index of all the results that matched the request filters. First item is number 1.

Default: 1

totalResultsint32

Total results that match the request filters.

Default: 10

Patch Account User GA

PATCH /api/2.0/accounts/{account_id}/scim/v2/Users/{id}

Partially updates a user resource by applying the supplied operations on specific user attributes. The userName and emails attributes cannot be updated through this API; any supplied changes to them are ignored (no-op).

API scopes: scim

Parameters

idstringpath

Unique ID in the <Databricks> workspace.

account_idstringpath

<Databricks> account ID

Request body

Operationsarray of object
Show child attributesHide child attributes
opstring

Type of patch operation.

Values: PATCH_OP_UNSPECIFIED, ADD, REMOVE, REPLACE

pathstring

Selection of patch operation

valueobject

Value to modify

schemasarray of string

The schema of the patch request. Must be ["urn:ietf:params:scim:api:messages:2.0:PatchOp"].

Values: PATCH_SCHEMA_UNSPECIFIED, URN_IETF_PARAMS_SCIM_API_MESSAGES_2_0_PATCH_OP

Update Account User GA

PUT /api/2.0/accounts/{account_id}/scim/v2/Users/{id}

Replaces a user's information with the data supplied in request. The userName and emails attributes cannot be updated through this API; any supplied changes to them are ignored (no-op).

API scopes: scim

Parameters

idstringpath

<Databricks> user ID.

account_idstringpath

<Databricks> account ID

Request body

activeboolean

If this user is active

displayNamestring

String that represents a concatenation of given and family names. For example John Smith.

emailsarray of object

All the emails associated with the <Databricks> user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
externalIdstring

External ID is not currently supported. It is reserved for future use.

nameobject
Show child attributesHide child attributes
familyNamestring

Family name of the <Databricks> user.

givenNamestring

Given name of the <Databricks> user.

rolesarray of object

Indicates if the group has the admin role.

Show child attributesHide child attributes
displaystring
primaryboolean
$refstring
typestring
valuestring
userNamestring

Email address of the <Databricks> user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.