SCIM API

Provision and manage user accounts and groups with the Slack SCIM API.

Manage people in a workspace

SCIM is an open standard supported by myriad services. SCIM is used by Single Sign-On (SSO) services and identity providers to manage people across a variety of tools, including Slack. Our SCIM implementation targets version 1.1 of the protocol.

While other APIs are for interacting with a Slack workspace directly, the SCIM API allow teams on the Plus and Enterprise Grid plans to administer the users on a workspace (or in an organization, in the case of Grid).

If you've found yourself wishing for a set of users.admin.* endpoints, SCIM might be right for you. Use the SCIM API to write your own apps and scripts to programmatically manage the members of your workspace.

Slack supports member provisioning via helper apps with supported identity providers.

Accessing the SCIM API

Like other Slack APIs, the SCIM methods are accessed over that old standby protocol, HTTP. It behaves slightly differently than other Slack APIs, as it is a proper REST API and thus expects HTTP verbs to be used in a specific manner.

The base URL for all calls to the SCIM API is https://api.slack.com/scim/v1/. All SCIM methods are branches of this base URL.

Acquire an OAuth token

An OAuth token with the admin scope is required to access the SCIM API.

On Business+, Slack Owners and Admins can generate a token to use the SCIM API. The token-generating account must remain an Admin or Owner in order to make SCIM updates.

On Enterprise Grid, Org Owners and Admins can use SCIM to modify users, however, only Org Owners can install the SCIM app. The token-generating account must remain an Owner or Admin in order to make SCIM updates.

One more note: the token generated can only action on accounts with the same or fewer permissions. For example, if an Admin account generates a SCIM token, they can take action on other Admins or members. They cannot take action on Owners.

To acquire a token:

1. Create a new Slack app
2. Add the admin OAuth scope
3. Install the app

Then use the generated token. If you intend to build a Slack app for other teams to install your app will need to properly handle the OAuth flow to generate the proper token.

Use the token in a SCIM API request

The API token must be included via an Authorization header with a type of Bearer when calling any of the SCIM methods.

Provide a JSON request body for POST, PUT, and PATCH write operations, and set your HTTP Content-type header to application/json.

A SCIM call may take a form like this:

 GET /scim/v1/Users?count=1000 HTTP/1.1
 Host: api.slack.com
 Accept: application/json
 Authorization: Bearer xoxp-...

Using SCIM on an Enterprise Grid organization

On Enterprise Grid, SCIM operations work across the entire organization, not individual workspaces. A SCIM app can provision, de-provision, and update team members in just one place rather than having to do so across every workspace in an organization.

For this reason, the OAuth token used for calling SCIM API methods must be obtained from installing the app on the organization, not just a workspace within the organization. To get a SCIM app working on a grid organization, do the following:

1. The web service powering your app will need to be able to handle a standard OAuth 2 flow.
2. Create a new Slack app.
3. In the app's settings, select OAuth & Permissions from the left navigation. Scroll down to the section titled Scopes and add the admin scope and click the green Save Changes button.
4. In the app's settings, select Manage Distribution from the left navigation. Under the section titled Share Your App with Other Workspaces, make sure all four sections have the green check. Then click the green Activate Public Distribution button.
5. Under the Share Your App with Your Workspace section, copy the Sharable URL and paste it into a browser to initiate the OAuth handshake that will install the app on your organization. You will need to be logged in as an owner of your Enterprise Grid organization to install the app.
6. Check the dropdown in the upper right of the installation screen to make sure you are installing the app on the Enterprise Grid organization, not an individual workspace within the organization. (See image below.)
7. Once your app completes the OAuth flow, you will be granted an OAuth token that can be used for calling all of the SCIM API methods for your organization. This token is the one your app should use to call the SCIM methods.

When installing the SCIM app, be sure to install it on your Grid organization, not a workspace within the organization.

Usergroups on Enterprise Grid work a bit differently as well. Creating SCIM groups will create an IDP group, which may or may not be the correct behavior depending on what you hope to accomplish.

Rate limits

Slack uses rate limits for the SCIM API to help provide a predictable experience.

Although the exact limits for each endpoint, listed below, are different from other Slack API methods, rate limiting for SCIM still uses the same principles as our other APIs. That being said, unlike many of the other Slack API rate limits, the limits below apply to all SCIM apps in an org, not on a per-app basis.

Small bursts above the limit are acceptable. If you receive a an HTTP 429 response from Slack, you've come up against the rate limit - parse the Retry-After header and retry your request after that time.

Organization-wide rate limits

In your organization, Slack applies per-minute rate limits across all SCIM endpoints in certain sets. Each call to any of the endpoints in that set counts toward the same rate limit.

In addition to the above org-wide limits across sets of endpoints, Slack also applies rate limits on individidual endpoints.

Rate limits for Users endpoints

Rate limits for Groups endpoints

Endpoints

The SCIM API is RESTful and the endpoint URLs are different than other Slack API endpoints.

Service Provider Configuration

GET /ServiceProviderConfigs

Returns Slack's configuration details for our SCIM API, including which operations are supported.

Schemas

Slack currently supports schemas for users and groups. Querying the schemas will provide the most up-to-date rendering of the supported SCIM attributes.

GET /Schemas/Users

Returns Slack's configuration details for how users are formatted.

Multi-channel guest user schema

Slack also supports a custom extension, called urn:scim:schemas:extension:slack:guest:1.0, that can be used to designate a user as a multi-channel guest. The details of this schema are also returned as part of the GET /scim/v1/Schemas/Users payload.

GET /Schemas/Groups

Returns Slack's configuration details for how groups are formatted.

Users

Users map to the individuals of your team across a workspace or Grid organization. Each user contains properties called attributes, like userName and title. You can list users, filter by attribute, add new users, update a user's profile information, or remove a user entirely.

User attributes

Attributes are the details associated with a user's account. These are the details that someone would typically set in their profile (for example, by clicking the Edit Profile button in the Slack application).

The following tables map SCIM attributes to the profile fields that Slack uses. Most of these profile fields are exposed directly in a person's profile in the Slack UI. Sometimes, multiple SCIM attributes map to a single Slack profile field. For example, Slack's Display name field will populate from either the displayName or the userName SCIM attribute, depending on which is set. If both are set, it will use displayName.

When you sync some user attributes to Slack via SCIM, these fields become locked in Slack and you can no longer delete them or edit them. However, you may choose to hide them from user profiles.

Attribute values will vary by identity provider. For example, some may use a single field for a user's full name, others may provide sub-attributes such as givenName and familyName, still others may provide both. Either is acceptable, but they should only describe the same name (i.e. sub-attributes should not contain additional or optional information, such as a nickname).

Not every attribute will be displayed in a user's profile. For example, active does not appear as a field but can be used to determine if a user's account is active.

Slack will also create profile fields if the following SCIM attributes are present:

GET /Users

Returns a paginated list of users, ten users per page by default.

When querying larger Slack instances, reduce the count parameter to 1,000 or less, and use the startIndex parameter to paginate through users. Pagination will be required for large lists of users as of August 30, 2019.

It's possible to return a list of specific types of users with the filter parameter.

 GET /scim/v1/Users?startIndex=4&count=500 HTTP/1.1
 Host: api.slack.com
 Accept: application/json
 Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

GET /Users/{id}

Retrieves a single user resource.

The value of the {id} should be the user's corresponding Slack ID, beginning with either U or W.

 GET /scim/v1/Users/U1A23BC4D HTTP/1.1
 Host: api.slack.com
 Accept: application/json
 Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

POST /Users

Creates a user.

Must include the userName attribute and at least one email address. You may provide an email address in the userName field, but it will be automatically converted to a Slack-appropriate username.

The value sub-attribute for photos can either be a publicly accessible URL e.g. "https://photos.example.com/profilephoto.jpg", or a Data URL containing raw image data, e.g. "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA...".

This example request body provides a detailed example of which attributes Slack uses, especially for the multi-valued attributes.

{
    "schemas": [
        "urn:scim:schemas:core:1.0",
        "urn:scim:schemas:extension:enterprise:1.0"
    ],
    "userName": "other_username",
    "nickName": "slack_username",
    "name": {
        "familyName": "Last",
        "givenName": "First",
        "honorificPrefix": "Ms."
    },
    "displayName": "First Last",
    "profileUrl": "https://login.example.com/slack_username",
    "emails": [
        {
            "value": "some@email.com",
            "type": "work",
            "primary": true
        },
        {
            "value": "some_other@email.com",
            "type": "home"
        }
    ],
    "addresses": [
        {
            "streetAddress": "1060 W Addison St",
            "locality": "Chicago",
            "region": "IL",
            "postalCode": "60613",
            "country": "USA",
            "primary": true
        }
    ],
    "phoneNumbers": [
        {
            "value": "555-555-5555",
            "type": "work"
        },
        {
            "value": "555-555-4444",
            "type": "mobile"
        }
    ],
    "photos": [
        {
            "value": "https://photos.example.com/profilephoto.jpg",
            "type": "photo"
        }
    ],
    "roles": [
        {
            "value": "Tech Lead",
            "primary": "true"
        }
    ],
    "userType": "Employee",
    "title": "Tour Guide",
    "preferredLanguage": "en_US",
    "locale": "en_US",
    "timezone": "America/Chicago",
    "active": true,
    "password": "Cub$winCub$win!!",
    "urn:scim:schemas:extension:enterprise:1.0": {
        "employeeNumber": "701984",
        "costCenter": "4130",
        "organization": "Chicago Cubs",
        "division": "Wrigley Field",
        "department": "Tour Operations",
        "manager": {
            "managerId": "U123ABC456"
        }
    }
}

POST /Users (Multi-Channel Guests)

You can create a multi-channel guest user using the urn:scim:schemas:extension:slack:guest:1.0 attribute. Within that attribute:

• The type sub attribute is mandatory.
• The optional expiration sub attribute must be an ISO 8601 date time string.
• The only valid value for the type sub-attribute is "multi" string.

Be sure to include the urn:scim:schemas:extension:slack:guest:1.0 URI in the schemas attribute.

Here are two ways to create a multi-channel guest user:

Option 1

Specifies a multi-channel guest user account that expires on "11/30/2020 23:59:59 UTC".

    "urn:scim:schemas:extension:slack:guest:1.0": {
        "type": "multi",
        "expiration": "2020-11-30T23:59:59Z"
    }

Option 2

Specifies a multi-channel guest user account with no expiration date.

    "urn:scim:schemas:extension:slack:guest:1.0": {
        "type": "multi"
    }

{
    "schemas": [
        "urn:scim:schemas:core:1.0",
        "urn:scim:schemas:extension:enterprise:1.0",
        "urn:scim:schemas:extension:slack:guest:1.0"
    ],
    "userName": "other_username",
    "nickName": "slack_username",
    "name": {
        "familyName": "Last",
        "givenName": "First",
        "honorificPrefix": "Ms."
    },
    "displayName": "First Last",
    "profileUrl": "https://login.example.com/slack_username",
    "emails": [
        {
            "value": "some@email.com",
            "type": "work",
            "primary": true
        },
        {
            "value": "some_other@email.com",
            "type": "home"
        }
    ],
    "addresses": [
        {
            "streetAddress": "1060 W Addison St",
            "locality": "Chicago",
            "region": "IL",
            "postalCode": "60613",
            "country": "USA",
            "primary": true
        }
    ],
    "phoneNumbers": [
        {
            "value": "555-555-5555",
            "type": "work"
        },
        {
            "value": "555-555-4444",
            "type": "mobile"
        }
    ],
    "photos": [
        {
            "value": "https://photos.example.com/profilephoto.jpg",
            "type": "photo"
        }
    ],
    "roles": [
        {
            "value": "Tech Lead",
            "primary": "true"
        }
    ],
    "userType": "Employee",
    "title": "Tour Guide",
    "preferredLanguage": "en_US",
    "locale": "en_US",
    "timezone": "America/Chicago",
    "active": true,
    "password": "Cub$winCub$win!!",
    "urn:scim:schemas:extension:enterprise:1.0": {
        "employeeNumber": "701984",
        "costCenter": "4130",
        "organization": "Chicago Cubs",
        "division": "Wrigley Field",
        "department": "Tour Operations",
        "manager": {
            "managerId": "U123ABC456"
        }
    },
    "urn:scim:schemas:extension:slack:guest:1.0": {
        "type": "multi",
        "expiration": "2020-11-30T23:59:59Z"
    }
}

PATCH /Users/{id}

Updates an existing user resource, overwriting values for specified attributes.

The value of the {id} should be the user's corresponding Slack ID, beginning with either U or W. Attributes that are not provided in the request will remain unchanged. Updating a value to " " will clear and remove the field from the user's profile.

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "active": true
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "userName": "other_username"
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "nickName": "slack_username"
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "displayName": "First Last"
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "title": "Tour Guide"
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "userType": "Employee"
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "preferredLanguage":"en_US"
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "locale": "en_US"
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "timezone": "America/Chicago"
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "emails": [
        {
            "value": "some@email.com",
            "type": "work",
            "primary": true
        },
        {
            "value": "some_other@email.com",
            "type": "home"
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "emails": [
        {
            "value": "some_other@email.com",
            "operation": "delete"
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "emails"
        ]
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "phoneNumbers": [
        {
            "value": "123-333-3333",
            "primary": true
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "phoneNumbers": [
        {
            "value": "123-333-3333",
            "type": "work"
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "phoneNumbers": [
        {
            "value": "222-222-2222",
            "primary": false
        },
        {
            "value": "333-333-3333",
            "primary": true
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "phoneNumbers": [
        {
            "value": "555-555-5555",
            "operation": "delete"
        },
        {
            "value": "555-555-4444",
            "operation": "delete"
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "phoneNumbers"
        ]
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "photos": [
        {
            "value": "https://photos.example.com/profilephoto.jpg",
            "primary": true
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "addresses": [
        {
            "streetAddress": "1060 W Addison St",
            "locality": "Chicago",
            "region": "IL",
            "postalCode": "60613",
            "country": "USA",
            "primary": true
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "addresses": [
        {
            "streetAddress": "1060 W Addison St",
            "locality": "Chicago",
            "region": "IL",
            "postalCode": "60613",
            "country": "USA",
            "operation": "delete"
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "roles": [
        {
            "value": "Tech Lead",
            "primary": true
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "roles": [
        "Tech Lead"
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "roles": [
        {
            "value": "Tech Lead",
            "operation": "delete"
        }
    ]
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "name": {
        "familyName": "Last",
        "givenName": "First",
        "honorificPrefix": "Ms."
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "name": {
        "givenName": "First"
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "name.honorificPrefix"
        ]
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "name"
        ]
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "urn:scim:schemas:extension:enterprise:1.0": {
        "employeeNumber": "701984",
        "costCenter": "4130",
        "organization": "Chicago Cubs",
        "division": "Wrigley Field",
        "department": "Tour Operations",
        "manager": {
            "managerId": "U123ABC456"
        }
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "urn:scim:schemas:extension:enterprise:1.0": {
        "manager": {
            "managerId": "ernie@example.com"
        }
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "urn:scim:schemas:extension:enterprise:1.0.manager.managerId"
        ]
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "urn:scim:schemas:extension:enterprise:1.0"
        ]
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0",
		"urn:scim:schemas:extension:slack:guest:1.0"
    ],
    "urn:scim:schemas:extension:slack:guest:1.0": {
        "type": "multi",
        "expiration": "2020-11-30T23:59:59Z"
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0",
		"urn:scim:schemas:extension:slack:guest:1.0"
    ],
    "urn:scim:schemas:extension:slack:guest:1.0": {
        "type": "multi"
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "urn:scim:schemas:extension:slack:guest:1.0.expiration"
        ]
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "urn:scim:schemas:extension:slack:guest:1.0"
        ]
    }
}

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "meta": {
        "attributes": [
            "roles",
            "name.familyName",
            "urn:scim:schemas:extension:enterprise:1.0.department"
        ]
    }
}

PUT /Users/{id}

Updates an existing user resource, overwriting all values for a user even if an attribute is empty or not provided.

If an attribute that had been set previously is left blank during a PUT operation, the new value will be blank in accordance with the data type of the attribute and the storage provider.

Deactivated users can be re-enabled by setting the active attribute to true. The value of the {id} should be the user's corresponding Slack ID, beginning with either U or W.

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "id": "U123ABC456",
    "active": false,
    "userName": "other_username",
    "nickName": "slack_username",
    "name": {
        "givenName": "First",
        "familyName": "Last"
    },
    "title": "Ms.",
    "emails": [
        {
            "value": "some@email.com",
            "primary": true
        }
    ],
    "photos": [
        {
            "value": "https://some.image/url",
            "type": "photo"
        }
    ]
}

DELETE /Users/{id}

Sets a Slack user to deactivated.

The value of the {id} should be the user's corresponding Slack ID, beginning with either U or W.

 DELETE /scim/v1/Users/42 HTTP/1.1
 Host: api.slack.com
 Accept: application/json
 Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

Groups

Groups are for organizing users in logical divisions across a workspace, such as by team or affinity.

Group attributes

Attributes are the details associated with a group.

GET /Groups

Returns a paginated list of groups, ten groups per page by default.

Use the startIndex and count (max 1000) query parameters to paginate long lists of groups. Pagination will be required as of August 30, 2019.

It's possible to return a list of specific types of groups, using the filter parameter.

 GET /scim/v1/Groups?startIndex=4&count=500 HTTP/1.1
 Host: api.slack.com
 Accept: application/json
 Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

GET /Groups/{id}

Retrieves a single group resource.

 GET /scim/v1/Groups/42 HTTP/1.1
 Host: api.slack.com
 Accept: application/json
 Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

POST /Groups

Creates a new group.

Must include the displayName attribute (as defined in the schema specification). Users (regular and/or multi-channel guest users) can be added to the group during creation by supplying the Slack user ID values in the members array attribute.

Although 15,000 users can be added per call, we recommend a batch size of no more than 5,000 users.

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "displayName": "Group Name",
    "members": [
        {
            "value": "U111AAA111"
        },
        {
            "value": "U222BBB222"
        }
    ]
}

PATCH /Groups/{id}

Updates an existing group resource, allowing individual (or groups of) users (regular and/or multi-channel guest users) to be added or removed from the group with a single operation.

Setting the operation attribute of a member object to delete will remove members from a group; add is the default operation for PATCH. More details on editing a resource with PATCH.

Although 15,000 users can be modified per call, we recommend a batch size of no more than 5,000 users.

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "members": [
        {
            "value": "U111AAA111"
        },
        {
            "value": "U222BBB222",
            "operation": "delete"
        },
        {
            "value": "U333CCC333"
        }
    ]
}

PUT /Groups/{id}

Updates an existing group resource, overwriting all values for a group even if an attribute is empty or not provided.

PUT will replace all members of a group with those members provided via the members attribute. If an attribute that had been set previously is left blank during a PUT operation, the new value will be blank in accordance with the data type of the attribute and the storage provider.

Although 15,000 users can be modified per call, we recommend a batch size of no more than 5,000 users.

{
    "schemas": [
        "urn:scim:schemas:core:1.0"
    ],
    "displayName": "New Group Name",
    "members": [
        {
            "value": "U111AAA111"
        }
    ]
}

DELETE /Groups/{id}

Permanently removes a group (members are not deleted, only the group).

 DELETE /scim/v1/Groups/42 HTTP/1.1
 Host: api.slack.com
 Accept: application/json
 Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

Filter

For methods that return a list --- GET /Users and GET /Groups --- it's possible to filter the list by the username, email, restricted, and ultra_restricted attributes, and return only the values matching that filter. The following rules apply:

• The filter parameter must contain one valid boolean operator
• Each expression must contain an attribute name followed by an attribute operator, (also supports an optional value)
• Multiple expressions may be combined using two logical operators.
• Expressions can be grouped together using "( )"
• Expressions must be evaluated using standard order of operations
• String literals must be valid JSON strings

The following is a list of valid operators:

Attribute name and attribute operator are case insensitive. For example, the following two expressions will evaluate to the same logical value:

filter=userName Eq "Carly"
filter=username eq "carly"

Filters may be applied to the username and email user attributes, with the addition of two membership filters:

The following would return a list of all multi-channel guests of a workspace:

 GET /scim/v1/Users?filter=restricted eq '1' HTTP/1.1
 Host: api.slack.com
 Accept: application/json
 Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

Errors

Occasionally, interacting with our APIs will result in an error instead of the result you're expecting. Slack will make every attempt to respond with a descriptive error message that will help you figure out what went wrong and how to fix it.

Concurrency

The SCIM API only allows one update to a user or group at a time (by locking the user or group while the update is in progress). Locking prevents overlapping requests, which can cause unpredictable results.

As a consequence, if you attempt to send multiple non-GET requests to the same user or group, and that user or group is still being updated from a previous request, you'll see a 429 HTTP response code. The 429 code will be returned with a retry-after header—wait for the time specified in that header to resend the request.

SCIM provisioning limitations

• Users can not be permanently deleted from Slack, they can only be deactivated.
• Attempts to provision a user with a duplicate email address (even if the existing user has been previously deactivated in Slack) will fail. The existing user email address must be updated manually in Slack to free up the email to be re-provisioned.
• When creating a new user, if anything in custom profile is invalid, all profile fields will be dropped
• Single-Channel Guests can not be fully provisioned via SCIM. You will first need to provision them as a full user, then restrict them via the Slack admin page.
• Group mention handles (@group) can not be set via the SCIM provisioning API.
• Subteams that are automatically generated by Slack, such as Team Admins, can not be updated via the SCIM API.
• The SCIM API is rate limited. If your requests are being limited, an HTTP: 429 error will be returned.
• Slack does not store type for addresses. The type field will be used to determine which address is the "primary address" if the request does not specify one, however the type is not stored.
• Username values and channel name values must be unique and share the same namespace. For example, you can't have a username for @general if you also have a #general channel in the Slack workspace.
• There is a limit of 50 custom profile fields, which includes fields set via the SCIM API. If your request would cause more than 50 fields to exist, the call will fail with a unable_to_create_team_profile_fields error.