Update individual attributes for a user

Updates individual attributes for a user. To update a user's attributes, you must use the correct syntax for the operation, as defined in the SCIM specification.

For example, to update a user's work email and familyName values, use the following for the request body:

{
"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [
{
"op": "replace",
"path": "emails[type eq \"work\"].value",
"value": "[email protected]"
},
{
"op": "replace",
"path": "name.familyName",
"value": "New-Family-Name"
}
]
}
json

To deprovision a SCIM user, you can use an operation to set the active attribute to false. For example:

{
"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [
{
"op": "replace",
"path": "active",
"value": false
}
]
}
json

Alternatively, you can provide an operation's value object as a list of paths and values to modify. For example:

{
"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [
{
"op": "add",
"value": {
"name.givenName": "New-Given-Name",
"name.familyName": "New-Family-Name",
"externalId": "abcd1234"
}
}
]
}
json
PATCH https://www.canva.com/_scim/v2/Users/{canva_scim_id}
#Authorizationstring
Required

Provides credentials to authenticate the request, in the form of a Bearer token.

For example: Authorization: Bearer {token}

#Content-Typestring
Required

Indicates the media type of the information sent in the request. This must be set to application/scim+json.

For example: Content-Type: application/scim+json

#canva_scim_idstring
Required

The Canva-generated SCIM ID for the user.

#schemasstring[]
Required

The URIs of the SCIM schemas. The value for this can only be urn:ietf:params:scim:api:messages:2.0:PatchOp.

#Operationsobject[]
Required

List of patch operations

Properties of Operations
#opstring
Required

The SCIM patch operation to perform. This can be one of the following:

  • add
  • remove
  • replace
#pathstring
Optional

An attribute path describing the target of the operation. For more information, see the SCIM specification.

#value
Optional

The value to add, remove, or replace.

Examples for using the /_scim/v2/Users/{canva_scim_id} endpoint:

curl --request PATCH 'https://www.canva.com/_scim/v2/Users/{canva_scim_id}' \
--header 'Authorization: Bearer {token}' \
--header 'Content-Type: application/scim+json' \
--data '{
"schemas": [
"urn:ietf:params:scim:api:messages:2.0:PatchOp"
],
"Operations": [
{
"op": "replace",
"path": "name.familyName",
"value": "Liddell"
}
]
}'
sh

If successful, the endpoint returns a 200 response with a JSON body with the following parameters:

#schemasstring[]

The URIs of the SCIM schemas. The value for this can only be urn:ietf:params:scim:schemas:core:2.0:User.

#idstring

The Canva-generated SCIM ID for the user.

#metaobject

Meta properties for the user.

Properties of meta
#resourceTypestring

The SCIM resource type of the object. The value for this can only be User.

#createdstring

The timestamp when the object was created.

#userNamestring

A unique identifier for the user.

#displayNamestring

The name of the user, suitable for display to end-users.

#emailsobject[]

The email address for the user.

Properties of emails
#primaryboolean

Whether the email is the primary address. Only one email address for a user can be the primary one.

#valuestring

The email address.

#typestring

The type of email address for the user. The Canva SCIM API only supports work as the type of the email address.

#activeboolean

Whether the user account is active. Setting this to false deprovisions the user in Canva.

#rolestring

The role of the user. This can be one of the following:

  • Member
  • Teacher
  • Staff
  • Admin
  • Template-designer
  • Aide
  • Administrator
  • School administrator
  • School
  • Tenant
  • Faculty

If an invalid value is provided, the role defaults to Member.

#externalIdstring
Optional

A string that is an identifier for the resource as defined by the provisioning client.

#namename
Optional

The components of the user's name.

Properties of name
#givenNamestring
Optional

The first or 'given' name for the user.

#familyNamestring
Optional

The last or 'family' name for the user.

#localestring
Optional

The user's default location, for example en_AU.

{
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
"id": "UAFdxab1abC",
"externalId": "abcd1234",
"meta": {
"resourceType": "User",
"created": "2023-09-18T06:08:35Z"
},
"userName": "aliddell",
"displayName": "Alice Liddell",
"name": {
"givenName": "Alice",
"familyName": "Liddell"
},
"emails": [
{
"primary": true,
"value": "[email protected]",
"type": "work"
}
],
"active": true,
"locale": "en_US",
"role": "Member"
}
json
#schemasstring[]

The value for this can only be urn:ietf:params:scim:api:messages:2.0:Error.

#detailstring

The value for this can only be No SSO configurations found, please check the settings page.

#statusstring

The HTTP status code of the error.

{
"schemas": [
"urn:ietf:params:scim:api:messages:2.0:Error"
],
"detail": "No SSO configurations found, please check the settings page",
"status": "400"
}
json
#schemasstring[]

The value for this can only be urn:ietf:params:scim:api:messages:2.0:Error.

#detailstring

The value for this can only be Email domain not authorized for SCIM..

#statusstring

The HTTP status code of the error.

{
"schemas": [
"urn:ietf:params:scim:api:messages:2.0:Error"
],
"detail": "Email domain not authorized for SCIM.",
"status": "403"
}
json
#schemasstring[]

The value for this can only be urn:ietf:params:scim:api:messages:2.0:Error.

#detailstring

The value for this can only be No user found for id {canva_scim_id}.

#statusstring

The HTTP status code of the error.

{
"schemas": [
"urn:ietf:params:scim:api:messages:2.0:Error"
],
"detail": "No user found for id {canva_scim_id}",
"status": "404"
}
json
#schemasstring[]

The value for this can only be urn:ietf:params:scim:api:messages:2.0:Error.

#detailstring

This can be one of the following:

  • userName not available
  • Account with email can not be updated. User needs to accept SSO linking
  • Account with email already exists. User must first log in with SAML to confirm account ownership
  • Account with email is soft deleted. The user must first log in to reactivate their account
#statusstring

The HTTP status code of the error.

{
"schemas": [
"urn:ietf:params:scim:api:messages:2.0:Error"
],
"detail": "userName not available",
"status": "409"
}
json