---
title: Configuring permissions for SCIM 2.0 operations
description: Configure permissions so that POST requests with the userAdd scope succeed on a PingDirectoryProxy deployment.
component: pingdirectory
version: 11.1
page_id: pingdirectory:managing_scim:pd_proxy_config_perms_scim_2_ops_proxy
canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/managing_scim/pd_proxy_config_perms_scim_2_ops_proxy.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-08-17T00:00:00Z
page_aliases: ["managing_scim_11_and_20_servlet_extensions:pd_proxy_config_perms_scim_2_ops_proxy.adoc"]
section_ids:
  before-you-begin: Before you begin
  steps: Steps
  choose-from: Choose from:
  example: Example:
  example-2: Example:
  result: Result:
---

# Configuring permissions for SCIM 2.0 operations

Configure permissions so that POST requests with the `userAdd` scope succeed on a PingDirectoryProxy deployment.

## Before you begin

Set up an LDAP mapping System for Cross-domain Identity Management (SCIM) *(tooltip: \<div class="paragraph">
\<p>An application-level, HTTP-based protocol for provisioning and managing user identity information. SCIM supplies a common schema for representing users and groups and provides a REST API.\</p>
\</div>)* 2.0 resource type for the `inetOrgPerson` object class. Learn more in [Configuring an LDAP-mapped SCIM resource type](pd_proxy_config_ldap_mapped_scim_resource_type.html).

To configure permissions:

## Steps

1. Set the SCIM resource type property:

   ### Choose from:

   * If the SCIM resource type being targeted already has a value for the `create-dn-pattern` property, skip to step 2.

   * To set the SCIM resource type property, run the following `dsconfig` command on the PingDirectoryProxy server.

     ```
     dsconfig set-scim-resource-type-prop \
     --type-name Users \
     --set create-dn-pattern:entryUUID=generated,ou=People,dc=example,dc=com
     ```

2. Send the following request to the PingDirectoryProxy server's SCIM `/Users` endpoint.

   ```shell
   curl -k -X POST \
   https://localhost:8443/scim/v2/Users/ \
   -H 'Authorization: Bearer {"active":true}' \
   -H 'Content-type: application/json' \
   --data '{"username":"user.test", "name":{"formatted":"Test",
   "familyName":"User"}, "schemas":["urn:pingidentity:schemas:User:1.0"]}'
   ```

   |   |                                                                   |
   | - | ----------------------------------------------------------------- |
   |   | The HTTP port can vary depending on the deployment configuration. |

   ### Example:

   The response from the server should have a status of `403` and should contain a correlation ID similar to the following.

   ```json
   {
   "schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],
   "status":"403",
   "detail":"Request failed:
   correlationID='faa707b3-5d48-42e6-9e78-2c8dbb1e2cac'"
   }
   ```

   This is the expected response since this SCIM request doesn't have the permission needed to write to an entry. Learn how to access the full server error message in [Troubleshooting the SCIM 2.0 servlet extension](pd_proxy_troubleshoot_scim_2_servelet_ext.html).

3. Add an access control instruction (ACI) to the backend server's `ou=People,dc=example,dc=com` subtree.

   Run the following `ldapmodify` command to create the ACI on the backend PingDirectory server endpoint, not the PingDirectoryProxy endpoint.

   ```shell
   $ ldapmodify
   dn:ou=People,dc=example,dc=com
   changetype:modify
   add:aci
   aci:(version 3.0; acl "ACI for userAdd scope"; allow (add)
   oauthscope="userAdd";)
   ```

   |   |                                                                                                                                                                                                                                                                                                                                                             |
   | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   |   | This ACI grants permission to add entries to the specified subtree as long as the SCIM request contains the `userAdd` scope. The ACI doesn't grant write access to attributes, which means modify operations will fail. Learn more about ACI configurations in [Overview of access control](../managing_access_control/pd_ds_overview_access_control.html). |

4. Send the POST request to the SCIM `/Users` endpoint again, and include the `userAdd` scope in the bearer token.

   ### Example:

   ```shell
   curl -k -X POST \
   https://localhost:8443/scim/v2/Users \
   -H 'Authorization: Bearer {"active":true, "scope":"userAdd"}' \
   -H 'Content-type: application/json' \
   --data '{"username":"user.test", "name":{"formatted":"Test",
   "familyName":"User"}, "schemas":["urn:pingidentity:schemas:User:1.0"]}'
   ```

   ### Result:

   The response from the server contains the created SCIM resource, which also contains values for the name and username attributes similar to the following.

   ```json
   {
   "name":{
   "familyName":"User",
   "formatted":"Test"
   },
   "username":"user.test",
   "id":"6f9a89b8-e766-478c-9667-def049daf6bc",
   "meta":{
   "resourceType":"Users",
   "location":"https://localhost:8443/scim/v2/Users/6f9a89b8-e766-478c-9667-
   def049daf6bc"
   },
   "schemas":["urn:pingidentity:schemas:User:1.0"]
   }
   ```