SCIM 2.0 · Club OS
Where directories connect.
One SCIM 2.0 base URL for your identity provider, to provision your organisation's users and groups into Club OS.
https://api.thequantumclub.com/scim/v2Enter it exactly as shown, with no trailing slash: /scim/v2/ and /scim/v2//Users are 404s.
First call
Try it without a token.
Discovery needs no token: this returns the server's SCIM capabilities as application/scim+json. Expect a 200 whose schemas list contains urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig.
Users and Groups need your tenant's bearer token, as in the second call.
curl https://api.thequantumclub.com/scim/v2/ServiceProviderConfigcurl "https://api.thequantumclub.com/scim/v2/Users?count=1" \
-H "Authorization: Bearer $TQC_SCIM_TOKEN"| Path under the base | Methods | Needs |
|---|---|---|
/Users | GET, HEAD, POST | Bearer token |
/Users/{id} | GET, HEAD, PUT, PATCH, DELETE | Bearer token |
/Groups | GET, HEAD, POST | Bearer token |
/Groups/{id} | GET, HEAD, PUT, PATCH, DELETE | Bearer token |
/ServiceProviderConfig | GET, HEAD | None |
/ResourceTypes, /ResourceTypes/User, /ResourceTypes/Group | GET, HEAD | None |
/Schemas | GET, HEAD | None |
/Schemas/urn:ietf:params:scim:schemas:core:2.0:User | GET, HEAD | None |
/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group | GET, HEAD | None |
/Schemas/urn:ietf:params:scim:schemas:extension:enterprise:2.0:User | GET, HEAD | None |
Any other path under the base is a 404; the base itself, opened in a browser, goes to the SCIM docs. Under /scim/v2, every error the edge sends uses the SCIM error schema, with the status as a string.
Authentication
Each token belongs to one tenant.
Every Users and Groups request carries Authorization: Bearer tqc_scim_…. The token decides the tenant; the URL and body never do.
A Quantum Club platform administrator issues each token in Club OS, after a step-up check from the last 5 minutes. To get one, ask your Quantum Club contact. It is shown once and stored only as a hash, so a lost token is replaced, not recovered.
A request without a valid token gets a 401 with WWW-Authenticate: Bearer.
Limits
What a token may send.
- Requests an hour for each token on each URL path: each
/Users/{id}counts on its own. Past that, the answer is a 429 withRetry-Afterin seconds: wait that long, then resend. - 1,200
- Largest request body, in bytes (1 MB). A larger POST, PUT or PATCH gets a SCIM 413 and is not passed on.
- 1,048,576
- Plain
http://never reaches the API: Cloudflare redirects it tohttps://. A token sent over it has crossed the network in the clear, so replace it. - HTTPS
Identity providers
Okta and Microsoft Entra ID.
Okta
In your app integration, open Provisioning, then Configure API Integration, and tick Enable API integration. Enter the base URL and the token, then select Test API Credentials.
Microsoft Entra ID
In the enterprise application, set Provisioning Mode to Automatic. Enter the base URL as the Tenant URL and the token as the Secret Token, then select Test Connection.
As of 5 November 2026, neither connection test has been run against this base URL. Until one has, treat these two lines as the plan, and the docs as the full steps.
As of 5 November 2026, the docs show the older supabase.co address as the base and ask Okta for the Users endpoint. Use the base URL above, not the Users endpoint.
For AI agents
The MCP server.
Agents use a separate host, mcp.thequantumclub.com. Its registry lists 36 tools, and each key reaches only the tools its scopes allow.
Security
Report a vulnerability.
Write to security@thequantumclub.com, privately. The disclosure policy says what to include, and security.txt has the same contact for machines.
The edge logs one line per request: method, route, status, timing, the Cloudflare data centre, the edge's decision and Cloudflare's request id. It never logs your IP address, the path, the query, a body or a token, and it does not pass your IP address on to the SCIM functions.