Reference#

This page presents all the models provided by scim2-models.

scim2_models.AnyResource: TypeVar#: Type bound to any subclass of Resource.

scim2_models.AnyScimObject: TypeVar#: Type bound to any subclass of ScimObject.

class Type(*values)[source]#

country: str | None#: The country name component.

formatted: str | None#: The full mailing address, formatted for display or use with a mailing label.

locality: str | None#: The city or locality component.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

postal_code: str | None#: The zip code or postal code component.

primary: bool | None#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute, e.g., the preferred address.

region: str | None#: The state or region component.

street_address: str | None#

The full street address component, which may include house number, street name, P.O.

box, and multi-line extended street address information.

type: Type | None#: A label indicating the attribute’s function, e.g., ‘work’ or ‘home’.

class scim2_models.Attribute(*, name: Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>, <CaseExact.true: True>] = None, type: Type | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, multivalued: Annotated[bool | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, description: Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Required.false: False>, <CaseExact.true: True>] = None, required: Required, <Mutability.read_only: 'readOnly'>, <Required.false: False>] = Required.false, canonicalvalues: Annotated[list[str] | None, <Mutability.read_only: 'readOnly'>, <CaseExact.true: True>] = None, caseexact: CaseExact, <Mutability.read_only: 'readOnly'>, <Required.false: False>] = CaseExact.false, mutability: Mutability, <Mutability.read_only: 'readOnly'>, <Required.false: False>, <CaseExact.true: True>] = Mutability.read_write, returned: Returned, <Mutability.read_only: 'readOnly'>, <Required.false: False>, <CaseExact.true: True>] = Returned.default, uniqueness: Uniqueness, <Mutability.read_only: 'readOnly'>, <Required.false: False>, <CaseExact.true: True>] = Uniqueness.none, referencetypes: Annotated[list[str] | None, <Mutability.read_only: 'readOnly'>, <Required.false: False>, <CaseExact.true: True>] = None, subattributes: Attribute] | None, <Mutability.read_only: 'readOnly'>] = None)[source]#

class Type(*values)[source]#

canonical_values: true: True>]#: A collection of suggested canonical values that MAY be used (e.g., “work” and “home”).

case_exact: false: False>]#: A Boolean value that specifies whether or not a string attribute is case sensitive.

description: true: True>]#: The attribute’s human-readable description.

get_attribute(attribute_name: str) → Attribute | None[source]#: Find an attribute by its name.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

multi_valued: true: True>]#: A Boolean value indicating the attribute’s plurality.

mutability: true: True>]#: A single keyword indicating the circumstances under which the value of the attribute can be (re)defined.

name: true: True>]#: The attribute’s name.

reference_types: true: True>]#: A multi-valued array of JSON strings that indicate the SCIM resource types that may be referenced.

required: false: False>]#: A Boolean value that specifies whether or not the attribute is required.

returned: true: True>]#: A single keyword that indicates when an attribute and associated values are returned in response to a GET request or in response to a PUT, POST, or PATCH request.

sub_attributes: read_only: 'readOnly'>]#: When an attribute is of type “complex”, “subAttributes” defines a set of sub-attributes.

type: true: True>]#: The attribute’s data type.

uniqueness: true: True>]#: A single keyword value that specifies how the service provider enforces uniqueness of attribute values.

class scim2_models.AuthenticationScheme(*, type: Type | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, name: Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, description: Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, specuri: Reference[external] | None, <Mutability.read_only: 'readOnly'>] = None, documentationuri: Reference[external] | None, <Mutability.read_only: 'readOnly'>] = None, primary: Annotated[bool | None, <Mutability.read_only: 'readOnly'>] = None)[source]#

class Type(*values)[source]#

description: true: True>]#: A description of the authentication scheme.

documentation_uri: read_only: 'readOnly'>]#: An HTTP-addressable URL pointing to the authentication scheme’s usage documentation.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

name: true: True>]#: The common authentication scheme name, e.g., HTTP Basic.

primary: read_only: 'readOnly'>]#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute, e.g., the preferred mailing address or primary email address.

spec_uri: read_only: 'readOnly'>]#: An HTTP-addressable URL pointing to the authentication scheme’s specification.

type: true: True>]#: The authentication scheme.

class scim2_models.BaseModel[source]#

Base Model for everything.

get_attribute_urn(field_name: str) → str[source]#

Build the full URN of the attribute.

See RFC7644 §3.10.

classmethod get_field_annotation(field_name: str, annotation_type: type) → Any[source]#

Return the annotation of type ‘annotation_type’ of the field ‘field_name’.

This method extracts SCIM-specific annotations from a field’s metadata, such as Mutability, Required, or Returned annotations.

Returns:: The annotation instance if found, otherwise the annotation type’s default value

>>> from scim2_models.resources.user import User
>>> from scim2_models.annotations import Mutability, Required

Get the mutability annotation of the ‘id’ field:

>>> mutability = User.get_field_annotation("id", Mutability)
>>> mutability
<Mutability.read_only: 'readOnly'>

Get the required annotation of the ‘user_name’ field:

>>> required = User.get_field_annotation("user_name", Required)
>>> required
<Required.true: True>

If no annotation is found, returns the default value:

>>> missing = User.get_field_annotation("display_name", Required)
>>> missing
<Required.false: False>

classmethod get_field_multiplicity(attribute_name: str) → bool[source]#

Indicate whether a field holds multiple values.

This method determines if a field is defined as a list type, which indicates it can contain multiple values. It handles Optional wrappers correctly.

Returns:: True if the field holds multiple values (is a list), False otherwise

>>> from scim2_models.resources.user import User
>>> User.get_field_multiplicity("user_name")
False
>>> User.get_field_multiplicity("emails")
True

classmethod get_field_root_type(attribute_name: str) → type | None[source]#

Extract the root type from a model field.

This method unwraps complex type annotations to find the underlying type, removing Optional and List wrappers to get to the actual type of the field’s content.

Returns:: The root type of the field, or None if not found

>>> from scim2_models.resources.user import User
>>> from scim2_models.resources.group import Group

Simple type:

>>> User.get_field_root_type("user_name")
<class 'str'>

Optional type unwraps to the underlying type:

>>> User.get_field_root_type("display_name")
<class 'str'>

List type unwraps to the element type:

>>> User.get_field_root_type("emails")
<class 'scim2_models.resources.user.Email'>

Optional[List[T]] unwraps to T:

>>> Group.get_field_root_type("members")
<class 'scim2_models.resources.group.GroupMember'>

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Create a model representation that can be included in SCIM messages by using Pydantic BaseModel.model_dump.

Parameters:

scim_ctx¶ – If a SCIM context is passed, some default values of Pydantic BaseModel.model_dump are tuned to generate valid SCIM messages. Pass None to get the default Pydantic behavior.
attributes¶ – A multi-valued list of strings indicating the names of resource attributes to return in the response, overriding the set of attributes that would be returned by default. Invalid values are ignored.
excluded_attributes¶ – A multi-valued list of strings indicating the names of resource attributes to be removed from the default set of attributes to return. Invalid values are ignored.

Create a JSON model representation that can be included in SCIM messages by using Pydantic BaseModel.model_dump_json.

Parameters:

scim_ctx¶ – If a SCIM context is passed, some default values of Pydantic BaseModel.model_dump are tuned to generate valid SCIM messages. Pass None to get the default Pydantic behavior.
attributes¶ – A multi-valued list of strings indicating the names of resource attributes to return in the response, overriding the set of attributes that would be returned by default. Invalid values are ignored.
excluded_attributes¶ – A multi-valued list of strings indicating the names of resource attributes to be removed from the default set of attributes to return. Invalid values are ignored.

classmethod model_validate(*args: Any, scim_ctx: Context | None = Context.DEFAULT, original: BaseModel | None = None, **kwargs: Any) → Self[source]#

Validate SCIM payloads and generate model representation by using Pydantic model_validate().

Parameters:

scim_ctx¶ – The SCIM Context in which the validation happens.
original¶ –
If this parameter is set during RESOURCE_REPLACEMENT_REQUEST, immutable parameters will be compared against the original model value. An exception is raised if values are different.

Deprecated since version 0.6.7: Use replace() on the validated instance instead. Will be removed in 0.8.0.

classmethod model_validate_json(*args: Any, scim_ctx: Context | None = Context.DEFAULT, **kwargs: Any) → Self[source]#

Validate SCIM JSON payloads and generate model representation by using Pydantic model_validate_json().

Malformed JSON payloads raise a ValidationError, like any other SCIM validation failure.

Parameters:: scim_ctx¶ – The SCIM Context in which the validation happens.

classmethod normalize_attribute_names(value: Any, handler: ValidatorFunctionWrapHandler, info: ValidationInfo) → Self[source]#

Normalize payload attribute names.

RFC7643 §2.1 indicate that attribute names should be case-insensitive. Any attribute name is transformed in lowercase so any case is handled the same way.

scim_serializer(handler: SerializerFunctionWrapHandler, info: SerializationInfo) → dict[str, Any][source]#: Serialize the fields according to mutability indications passed in the serialization context.

class scim2_models.Bulk(*, supported: Annotated[bool | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, maxoperations: Annotated[int | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, maxpayloadsize: Annotated[int | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

max_operations: true: True>]#: An integer value specifying the maximum number of operations.

max_payload_size: true: True>]#: An integer value specifying the maximum payload size in bytes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

supported: true: True>]#: A Boolean value specifying whether or not the operation is supported.

class Method(*values)[source]#

bulk_id: str | None#: The transient identifier of a newly created resource, unique within a bulk request and created by the client.

data: Any | None#: The resource data as it would appear for a single SCIM POST, PUT, or PATCH operation.

location: str | None#: The resource endpoint URL.

method: Method | None#: The HTTP method of the current operation.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

path: str | None#: The resource’s relative path to the SCIM service provider’s root.

response: Any | None#: The HTTP response body for the specified request operation.

status: Annotated[int | None, PlainSerializer(func=_int_to_str, return_type=PydanticUndefined, when_used=always)]#: The HTTP response status code for the requested operation.

version: str | None#: The current resource version.

class scim2_models.BulkRequest(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, failonerrors: int | None = None, operations: list[~scim2_models.messages.bulk.BulkOperation] | None = None)[source]#

Bulk request as defined in RFC7644 §3.7.

Todo

The models for Bulk operations are defined, but their behavior is not implemented nor tested yet.

fail_on_errors: int | None#: An integer specifying the number of errors that the service provider will accept before the operation is terminated and an error response is returned.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

operations: list[BulkOperation] | None#: Defines operations within a bulk job.

class scim2_models.BulkResponse(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, operations: list[~scim2_models.messages.bulk.BulkOperation] | None = None)[source]#

Bulk response as defined in RFC7644 §3.7.

Todo

The models for Bulk operations are defined, but their behavior is not implemented nor tested yet.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

operations: list[BulkOperation] | None#: Defines operations within a bulk job.

class scim2_models.CaseExact(*values)[source]#

A Boolean value that specifies whether a string attribute is case-sensitive or not.

false = False#

Values of the attribute are compared without their case.

This is the implicit value of any other attribute, per RFC7643 §2.2. Values are kept as they were submitted either way.

true = True#

Values of the attribute are compared with their case.

binary and reference attributes are case-exact whatever their schema says, per RFC7643 §2.3.6 and §2.3.7. Comparing is up to the service provider; what this library does with the annotation is publish it in to_schema().

class scim2_models.ChangePassword(*, supported: Annotated[bool | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

supported: true: True>]#: A Boolean value specifying whether or not the operation is supported.

class scim2_models.ComplexAttribute[source]#

A complex attribute as defined in RFC7643 §2.3.8.

get_attribute_urn(field_name: str) → str[source]#

Build the full URN of the attribute.

See RFC7644 §3.10.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

class scim2_models.Context(*values)[source]#

Represent the different HTTP contexts detailed in RFC7644 §3.2.

Contexts are intended to be used during model validation and serialization. For instance a client preparing a resource creation POST request can use resource.model_dump(Context.RESOURCE_CREATION_REQUEST) and the server can then validate it with resource.model_validate(Context.RESOURCE_CREATION_REQUEST).

DEFAULT = 1#

The default context.

All fields are accepted during validation, and all fields are serialized during a dump.

RESOURCE_CREATION_REQUEST = 2#

The resource creation request context.

Should be used for clients building a payload for a resource creation request, and servers validating resource creation request payloads.

When used for serialization, it will not dump attributes annotated with read_only.
When used for validation, it will raise a ValidationError:
- when finding attributes annotated with read_only,
- when attributes annotated with Required.true are missing on null.

RESOURCE_CREATION_RESPONSE = 3#

The resource creation response context.

Should be used for servers building a payload for a resource creation response, and clients validating resource creation response payloads.

When used for validation, it will raise a ValidationError when finding attributes annotated with never or when attributes annotated with always are missing or None;
When used for serialization, it will:
- always dump attributes annotated with always;
- never dump attributes annotated with never;
- dump attributes annotated with default unless they are explicitly excluded;
- not dump attributes annotated with request unless they are explicitly included.

RESOURCE_PATCH_REQUEST = 10#

The resource patch request context.

Should be used for clients building a payload for a PATCH request, and servers validating PATCH request payloads.

When used for serialization, it will not dump attributes annotated with read_only, which a PATCH operation cannot target anyway.
When used for validation, a PatchOp will raise a ValidationError:
when an operation targets an attribute annotated with read_only,
when an operation would leave an attribute annotated with Required.true unassigned, which a remove does, and so does a replace carrying a null value or an empty array, per RFC7643 §2.5,
when a remove carries no path, or an add no value.

Attributes annotated with immutable are checked by patch() instead, as it takes the value the resource currently holds. A PATCH being partial, nothing here requires a payload to carry every required attribute.

RESOURCE_PATCH_RESPONSE = 11#

The resource patch response context.

Should be used for servers building a payload for a PATCH response, and clients validating patch response payloads.

When used for validation, it will raise a ValidationError when finding attributes annotated with never or when attributes annotated with always are missing or None;
When used for serialization, it will:
- always dump attributes annotated with always;
- never dump attributes annotated with never;
- dump attributes annotated with default unless they are explicitly excluded;
- not dump attributes annotated with request unless they are explicitly included.

RESOURCE_QUERY_REQUEST = 4#

The resource query request context.

Should be used for clients building a payload for a resource query request, and servers validating resource query request payloads.

When used for serialization, it will not dump attributes annotated with write_only.
When used for validation, it will raise a ValidationError when finding attributes annotated with write_only.

RESOURCE_QUERY_RESPONSE = 5#

The resource query response context.

Should be used for servers building a payload for a resource query response, and clients validating resource query response payloads.

When used for validation, it will raise a ValidationError when finding attributes annotated with never or when attributes annotated with always are missing or None;
When used for serialization, it will:
- always dump attributes annotated with always;
- never dump attributes annotated with never;
- dump attributes annotated with default unless they are explicitly excluded;
- not dump attributes annotated with request unless they are explicitly included.

RESOURCE_REPLACEMENT_REQUEST = 6#

The resource replacement request context.

Should be used for clients building a payload for a resource replacement request, and servers validating resource replacement request payloads.

When used for serialization, it will not dump attributes annotated with read_only.
When used for validation, it will ignore attributes annotated with scim2_models.Mutability.read_only and raise a ValidationError:
- when finding attributes annotated with immutable different than the original parameter passed to model_validate();
- when attributes annotated with Required.true are missing on null.

RESOURCE_REPLACEMENT_RESPONSE = 7#

The resource replacement response context.

Should be used for servers building a payload for a resource replacement response, and clients validating resource query replacement payloads.

When used for validation, it will raise a ValidationError when finding attributes annotated with never or when attributes annotated with always are missing or None;
When used for serialization, it will:
- always dump attributes annotated with always;
- never dump attributes annotated with never;
- dump attributes annotated with default unless they are explicitly excluded;
- not dump attributes annotated with request unless they are explicitly included.

SEARCH_REQUEST = 8#

The search request context.

Should be used for clients building a payload for a search request, and servers validating search request payloads.

When used for serialization, it will not dump attributes annotated with write_only.
When used for validation, it will raise a ValidationError when finding attributes annotated with write_only.

SEARCH_RESPONSE = 9#

The resource query response context.

Should be used for servers building a payload for a search response, and clients validating resource search payloads.

When used for validation, it will raise a ValidationError when finding attributes annotated with never or when attributes annotated with always are missing or None;
When used for serialization, it will:
- always dump attributes annotated with always;
- never dump attributes annotated with never;
- dump attributes annotated with default unless they are explicitly excluded;
- not dump attributes annotated with request unless they are explicitly included.

class scim2_models.CreationRequestContext[source]#: Shortcut for Annotated[T, SCIMValidator(Context.RESOURCE_CREATION_REQUEST)].

class scim2_models.CreationResponseContext[source]#: Shortcut for Annotated[T, SCIMSerializer(Context.RESOURCE_CREATION_RESPONSE)].

class scim2_models.ETag(*, supported: Annotated[bool | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

supported: true: True>]#: A Boolean value specifying whether or not the operation is supported.

class scim2_models.Email(*, value: EmailStr | None = None, display: str | None = None, type: Type | None = None, primary: bool | None = None)[source]#

class Type(*values)[source]#

display: str | None#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

primary: bool | None#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute, e.g., the preferred mailing address or primary email address.

type: Type | None#: A label indicating the attribute’s function, e.g., ‘work’ or ‘home’.

value: EmailStr | None#: Email addresses for the user.

class scim2_models.EnterpriseUser(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, employeenumber: str | None = None, costcenter: str | None = None, organization: str | None = None, division: str | None = None, department: str | None = None, manager: ~scim2_models.resources.enterprise_user.Manager | None = None)[source]#

cost_center: str | None#: “Identifies the name of a cost center.

department: str | None#: Numeric or alphanumeric identifier assigned to a person, typically based on order of hire or association with an organization.

division: str | None#: Identifies the name of a division.

employee_number: str | None#: Numeric or alphanumeric identifier assigned to a person, typically based on order of hire or association with an organization.

manager: Manager | None#

The User’s manager.

A complex type that optionally allows service providers to represent organizational hierarchy by referencing the ‘id’ attribute of another User.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

organization: str | None#: Identifies the name of an organization.

class scim2_models.Entitlement(*, value: str | None = None, display: str | None = None, type: str | None = None, primary: bool | None = None)[source]#

display: str | None#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

primary: bool | None#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute.

type: str | None#: A label indicating the attribute’s function.

value: str | None#: The value of an entitlement.

class scim2_models.Error(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, status: ~typing.Annotated[int | None, ~pydantic.functional_serializers.PlainSerializer(func=~scim2_models.utils._int_to_str, return_type=PydanticUndefined, when_used=always)] = None, scimtype: str | None = None, detail: str | None = None)[source]#

Representation of SCIM API errors.

RFC 7644 Section 3.12

detail: str | None#: A detailed human-readable message.

classmethod from_validation_error(error: Mapping[str, Any]) → Error[source]#

Convert a single Pydantic error dict to a SCIM Error.

If the error is a SCIM-specific error (raised via SCIMException.as_pydantic_error()), its scim_type and status are preserved. Otherwise, a best-effort mapping is performed.

Parameters:: error¶ – A single error dict from ValidationError.errors().
Returns:: A SCIM Error object.

classmethod from_validation_errors(errors: ValidationError | Sequence[Mapping[str, Any]]) → list[Error][source]#

Convert Pydantic validation errors to a list of SCIM Errors.

Parameters:: errors¶ – A ValidationError or a list of error dicts.
Returns:: A list of SCIM Error objects.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

scim_type: str | None#: A SCIM detail error keyword.

status: Annotated[int | None, PlainSerializer(func=_int_to_str, return_type=PydanticUndefined, when_used=always)]#: The HTTP status code (see Section 6 of [RFC7231]) expressed as a JSON string.

class scim2_models.ExtensibleStringEnum(new_class_name, /, names, *, module=None, qualname=None, type=None, start=1, boundary=None)[source]#

String enum accepting values beyond its canonical ones.

RFC7643 §2.3.1 and §7 define canonicalValues as suggestions that service providers MAY restrict, so unknown values are kept as-is instead of being rejected.

class scim2_models.Extension(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>)[source]#

classmethod from_schema(schema: Schema) → type[Extension][source]#: Build a Extension subclass from the schema definition.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

classmethod to_schema() → Schema[source]#: Build a Schema from the current extension class.

class scim2_models.External[source]#

Marker for external references per RFC7643 §7.

Use with Reference to type external resource URLs (photos, websites):

profile_url: Reference[External] | None = None

class scim2_models.Filter(*, supported: Annotated[bool | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, maxresults: Annotated[int | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

max_results: true: True>]#: An integer value specifying the maximum number of resources returned in a response.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

supported: true: True>]#: A Boolean value specifying whether or not the operation is supported.

class scim2_models.Group(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, id: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Returned.always: 'always'>, <Uniqueness.global_: 'global'>] = None, externalid: ~typing.Annotated[str | None, <Mutability.read_write: 'readWrite'>, <Returned.default: 'default'>, <CaseExact.true: True>] = None, meta: ~typing.Annotated[~scim2_models.resources.resource.Meta | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>] = None, displayname: ~typing.Annotated[str | None, <Required.true: True>] = None, members: list[~scim2_models.resources.group.GroupMember] | None = None)[source]#

Members#: alias of GroupMember

display_name: true: True>]#: A human-readable name for the Group.

members: list[GroupMember] | None#: A list of members of the Group.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class scim2_models.GroupMember(*, value: Annotated[str | None, <Mutability.immutable: 'immutable'>, <CaseExact.true: True>] = None, ref: Reference[User | Group] | None, <Mutability.immutable: 'immutable'>] = None, type: Annotated[str | None, <Mutability.immutable: 'immutable'>] = None, display: Annotated[str | None, <Mutability.read_only: 'readOnly'>] = None)[source]#

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

ref: immutable: 'immutable'>]#: The reference URI of a target resource, if the attribute is a reference.

type: immutable: 'immutable'>]#: A label indicating the attribute’s function, e.g., “work” or “home”.

value: true: True>]#: Identifier of the member of this Group.

class scim2_models.GroupMembership(*, value: Annotated[str | None, <Mutability.read_only: 'readOnly'>, <CaseExact.true: True>] = None, ref: Reference[Group] | None, <Mutability.read_only: 'readOnly'>] = None, display: Annotated[str | None, <Mutability.read_only: 'readOnly'>] = None, type: Annotated[str | None, <Mutability.read_only: 'readOnly'>] = None)[source]#

display: read_only: 'readOnly'>]#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

ref: read_only: 'readOnly'>]#: The reference URI of a target resource, if the attribute is a reference.

type: read_only: 'readOnly'>]#: A label indicating the attribute’s function, e.g., ‘direct’ or ‘indirect’.

value: true: True>]#: The identifier of the User’s group.

class scim2_models.Im(*, value: str | None = None, display: str | None = None, type: Type | None = None, primary: bool | None = None)[source]#

class Type(*values)[source]#

display: str | None#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

primary: bool | None#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute, e.g., the preferred messenger or primary messenger.

type: Type | None#: A label indicating the attribute’s function, e.g., ‘aim’, ‘gtalk’, ‘xmpp’.

value: str | None#: Instant messaging address for the User.

exception scim2_models.InvalidFilterException(*, filter: str | None = None, **kw: Any)[source]#

The specified filter syntax was invalid.

Corresponds to scimType invalidFilter with HTTP status 400.

RFC 7644 Section 3.4.2.2

exception scim2_models.InvalidPathException(*, path: str | None = None, **kw: Any)[source]#

The path attribute was invalid or malformed.

Corresponds to scimType invalidPath with HTTP status 400.

RFC 7644 Section 3.5.2

exception scim2_models.InvalidSyntaxException(*, detail: str | None = None, scim_ctx: Context | None = None, **context: Any)[source]#

The request body message structure was invalid.

Corresponds to scimType invalidSyntax with HTTP status 400.

RFC 7644 Section 3.12

exception scim2_models.InvalidValueException(*, attribute: str | None = None, reason: str | None = None, **kw: Any)[source]#

A required value was missing or the value was not compatible.

Corresponds to scimType invalidValue with HTTP status 400.

RFC 7644 Section 3.12

exception scim2_models.InvalidVersionException(*, detail: str | None = None, scim_ctx: Context | None = None, **context: Any)[source]#

The specified SCIM protocol version is not supported.

Corresponds to scimType invalidVers with HTTP status 400.

RFC 7644 Section 3.13

class scim2_models.ListResponse(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>)[source]#

classmethod check_results_number(value: Any, handler: ValidatorFunctionWrapHandler, info: ValidationInfo) → Self[source]#

Validate result numbers.

RFC7644 §3.4.2 indicates that:

‘totalResults’ is required
‘resources’ must be set if ‘totalResults’ is non-zero.

items_per_page: int | None#: The number of resources returned in a list response page.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

resources: list[AnyResource] | None#: A multi-valued list of complex objects containing the requested resources.

start_index: int | None#: The 1-based index of the first result in the current set of list results.

total_results: int | None#: The total number of results returned by the list or query operation.

class scim2_models.Manager(*, value: Annotated[str | None, <Required.true: True>, <CaseExact.true: True>] = None, ref: Reference[User] | None, <Required.true: True>] = None, displayname: Annotated[str | None, <Mutability.read_only: 'readOnly'>] = None)[source]#

display_name: read_only: 'readOnly'>]#: The displayName of the User’s manager.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

ref: true: True>]#: The URI of the SCIM resource representing the User’s manager.

value: true: True>]#: The id of the SCIM resource representing the User’s manager.

class scim2_models.Message(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>)[source]#

SCIM protocol messages as defined by RFC7644 §3.1.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

All “meta” sub-attributes are assigned by the service provider (have a “mutability” of “readOnly”), and all of these sub-attributes have a “returned” characteristic of “default”.

This attribute SHALL be ignored when provided by clients. “meta” contains the following sub-attributes:

created: datetime | None#

The “DateTime” that the resource was added to the service provider.

This attribute MUST be a DateTime.

last_modified: datetime | None#

The most recent DateTime that the details of this resource were updated at the service provider.

If this resource has never been modified since its initial creation, the value MUST be the same as the value of “created”.

location: str | None#

The URI of the resource being returned.

This value MUST be the same as the “Content-Location” HTTP response header (see Section 3.1.4.2 of [RFC7231]).

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

resource_type: str | None#

The name of the resource type of the resource.

This attribute has a mutability of “readOnly” and “caseExact” as “true”.

version: str | None#

The version of the resource being returned.

This value must be the same as the entity-tag (ETag) HTTP response header (see Sections 2.1 and 2.3 of [RFC7232]). This attribute has “caseExact” as “true”. Service provider support for this attribute is optional and subject to the service provider’s support for versioning (see Section 3.14 of [RFC7644]). If a service provider provides “version” (entity-tag) for a representation and the generation of that entity-tag does not satisfy all of the characteristics of a strong validator (see Section 2.1 of [RFC7232]), then the origin server MUST mark the “version” (entity- tag) as weak by prefixing its opaque value with “W/” (case sensitive).

class scim2_models.MultiValuedComplexAttribute(*, type: str | None = None, primary: bool | None = None, display: Annotated[str | None, <Mutability.immutable: 'immutable'>] = None, value: Any | None = None, ref: Reference[uri] | None = None)[source]#

display: immutable: 'immutable'>]#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

primary: bool | None#

A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute.

Per RFC 7643 §2.4, the primary attribute value True MUST appear no more than once in a multi-valued attribute list.

ref: Reference[uri] | None#: The reference URI of a target resource, if the attribute is a reference.

type: str | None#: A label indicating the attribute’s function.

value: Any | None#: The value of an entitlement.

class scim2_models.Mutability(*values)[source]#

A single keyword indicating the circumstances under which the value of the attribute can be (re)defined.

immutable = 'immutable'#

The attribute MAY be defined at resource creation (e.g., POST) or at record replacement via a request (e.g., a PUT).

The attribute SHALL NOT be updated, so replace() and patch() raise a MutabilityException when an operation would change the value it already holds. Adding a value where there was none, asserting the current one, and removing an unset one are the operations left. The check happens as the change is applied, since it takes the current value, where a payload can only be read against the schema.

read_only = 'readOnly'#

The attribute SHALL NOT be modified.

It is left out of a creation or a replacement request, and dropped from one that carries it anyway, rather than making the payload invalid. A PATCH operation targeting it is rejected.

read_write = 'readWrite'#

The attribute MAY be updated and read at any time.

This is the implicit value of any attribute, per RFC7643 §2.2, and the only one carrying no constraint.

write_only = 'writeOnly'#

The attribute MAY be updated at any time.

Attribute values SHALL NOT be returned (e.g., because the value is a stored hash). Note: An attribute with a mutability of “writeOnly” usually also has a returned setting of “never”.

Unlike read_only, a query or a search request naming it is rejected rather than cleaned up, as a client cannot be reading a value it is not allowed to read.

exception scim2_models.MutabilityException(*, attribute: str | None = None, mutability: str | None = None, operation: str | None = None, **kw: Any)[source]#

The attempted modification is not compatible with the attribute’s mutability.

Corresponds to scimType mutability with HTTP status 400.

RFC 7644 Section 3.5.2

family_name: str | None#: The family name of the User, or last name in most Western languages (e.g., ‘Jensen’ given the full name ‘Ms. Barbara J Jensen, III’).

formatted: str | None#: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g., ‘Ms. Barbara J Jensen, III’).

given_name: str | None#: The given name of the User, or first name in most Western languages (e.g., ‘Barbara’ given the full name ‘Ms. Barbara J Jensen, III’).

honorific_prefix: str | None#: The honorific prefix(es) of the User, or title in most Western languages (e.g., ‘Ms.’ given the full name ‘Ms. Barbara J Jensen, III’).

honorific_suffix: str | None#: The honorific suffix(es) of the User, or suffix in most Western languages (e.g., ‘III’ given the full name ‘Ms. Barbara J Jensen, III’).

middle_name: str | None#: The middle name(s) of the User (e.g., ‘Jane’ given the full name ‘Ms. Barbara J Jensen, III’).

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

exception scim2_models.NoTargetException(*, path: str | None = None, **kw: Any)[source]#

The specified path did not yield a target that could be operated on.

Corresponds to scimType noTarget with HTTP status 400.

RFC 7644 Section 3.5.2

class scim2_models.Patch(*, supported: Annotated[bool | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

supported: true: True>]#: A Boolean value specifying whether or not the operation is supported.

class scim2_models.PatchOp(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, operations: ~typing.Annotated[list[~scim2_models.messages.patch_op.PatchOperation] | None, ~annotated_types.MinLen(min_length=1), <Required.true: True>] = None)[source]#

Patch Operation as defined in RFC7644 §3.5.2.

Type parameter ResourceT is required and must be a concrete Resource subclass. Usage: PatchOp[User], PatchOp[Group], etc.

Note

Always use with a specific type parameter, e.g., PatchOp[User]
PatchOp[Resource] is not allowed - use a concrete subclass instead
Union types are not supported - use a specific resource type
Using PatchOp without a type parameter raises TypeError

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

operations: true: True>]#: The body of an HTTP PATCH request MUST contain the attribute “Operations”, whose value is an array of one or more PATCH operations.

patch(resource: ResourceT) → bool[source]#

Apply all PATCH operations to the given SCIM resource in sequence.

The resource is modified in-place.

Each operation in the PatchOp is applied in order, modifying the resource in-place according to RFC7644 §3.5.2. Supported operations are “add”, “replace”, and “remove”. If any operation modifies the resource, the method returns True; otherwise, False.

Per RFC 7644 §3.5.2, when an operation sets a value’s primary sub-attribute to True, any other values in the same multi-valued attribute will have their primary set to False automatically.

Parameters:: resource¶ – The SCIM resource to patch. This object is modified in-place.
Returns:: True if the resource was modified by any operation, False otherwise.
Raises:: InvalidValueException – If multiple values are marked as primary in a single operation, or if multiple primary values already exist before the patch.

validate_operations(info: ValidationInfo) → Self[source]#

Validate operations against resource type metadata if available.

When PatchOp is used with a specific resource type (e.g., PatchOp[User]), this validator will automatically check mutability and required constraints.

class scim2_models.PatchOperation(*, op: Op, path: Path[ResourceT] | None = None, value: Any | None = None)[source]#

class Op(*values)[source]#

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

classmethod normalize_op(v: Any) → Any[source]#

Ignore case for op.

This brings compatibility with Microsoft Entra:

Don’t require a case-sensitive match on structural elements in SCIM, in particular PATCH op operation values, as defined in section 3.5.2. Microsoft Entra ID emits the values of op as Add, Replace, and Remove.

op: Op#: Each PATCH operation object MUST have exactly one “op” member, whose value indicates the operation to perform and MAY be one of “add”, “remove”, or “replace”.

Note

For the sake of compatibility with Microsoft Entra, despite RFC7644 §3.5.2, op is case-insensitive.

path: Path[ResourceT] | None#: The “path” attribute value is a String containing an attribute path describing the target of the operation.

validate_operation_requirements(info: ValidationInfo) → Self[source]#: Validate operation requirements according to RFC 7644.

class scim2_models.PatchRequestContext[source]#: Shortcut for Annotated[T, SCIMValidator(Context.RESOURCE_PATCH_REQUEST)].

class scim2_models.PatchResponseContext[source]#: Shortcut for Annotated[T, SCIMSerializer(Context.RESOURCE_PATCH_RESPONSE)].

class scim2_models.Path(path: str | Path[Any])[source]#

property attr: str#

The attribute portion of the path.

For paths like “urn:…:User:userName”, returns “userName”. For simple paths like “userName”, returns “userName”. For schema-only paths like “urn:…:User”, returns “”.

classmethod check_syntax(path: str) → None[source]#

Check if path syntax is valid according to RFC 7644 simplified rules.

An empty string is valid and represents the resource root.

Parameters:: path¶ – The path to validate
Raises:: ValueError – If the path syntax is invalid

delete(resource: ResourceT, value: Any | None = None, *, strict: bool = True) → bool[source]#

Delete a value at this path from a resource.

If value is None, the entire attribute is set to None. If value is provided and the attribute is multi-valued, only matching values are removed from the list. A path crossing a multi-valued attribute removes the sub-attribute from each of its entries, so emails.type leaves the emails in place and untypes them.

Parameters:

resource¶ – The resource to delete the value from.
value¶ – Optional specific value to remove from a list.
strict¶ – If True, raise exceptions for invalid paths.

Returns:

True if a value was deleted, False if unchanged.

Raises:

InvalidPathException – If strict and the path does not exist or is invalid.

property field_name: str | None#

The Python attribute name (snake_case) for this path.

Requires the Path to be bound to a model type via Path[Model]. Returns None if the path is unbound or invalid.

For “name.familyName” on Path[User], returns “family_name”. For “userName” on Path[User], returns “user_name”.

property field_type: type | None#

The Python type of the field this path points to.

Requires the Path to be bound to a model type via Path[Model]. Returns None if the path is unbound, invalid, or points to a schema-only path.

For “userName” on Path[User], returns str. For “name” on Path[User], returns Name. For “emails” on Path[User], returns Email.

get(resource: ResourceT, *, strict: bool = True) → Any[source]#

Get the value at this path from a resource.

A path crossing a multi-valued attribute designates the sub-attribute of each of its entries, so emails.value answers with one item per email, in their order, None included for an email carrying no value. Writing through such a path reaches those same entries, which is what makes the answer their mirror. An attribute holding no entry at all answers None, as any unassigned attribute does.

Parameters:

resource¶ – The resource to get the value from.
strict¶ – If True, raise exceptions for invalid paths.

Returns:

The value at this path, or None if the value is absent.

Raises:

PathNotFoundException – If strict and the path references a non-existent field.
InvalidPathException – If strict and the path references an unknown extension.

get_annotation(annotation_type: type) → Any[source]#

Get annotation value for this path’s field.

Requires the Path to be bound to a model type via Path[Model]. Returns None if the path is unbound, invalid, or points to a schema-only path.

Parameters:: annotation_type¶ – The annotation class (e.g., Required, Mutability).
Returns:: The annotation value or None.

For “userName” on Path[User] with Required, returns Required.true.

has_prefix(prefix: str | Path[Any]) → bool[source]#

Check if this path has the given prefix.

Examples:

Path("emails.value").has_prefix("emails")  # True
Path("emails").has_prefix("emails")  # False (equal, not prefix)
Path("urn:...:User:name").has_prefix("urn:...:User")  # True

property is_multivalued: bool | None#

Whether this path points to a multi-valued attribute.

Requires the Path to be bound to a model type via Path[Model]. Returns None if the path is unbound, invalid, or points to a schema-only path.

For “emails” on Path[User], returns True. For “userName” on Path[User], returns False.

is_prefix_of(other: str | Path[Any]) → bool[source]#

Check if this path is a prefix of another path.

A path is a prefix if the other path starts with this path followed by a separator (“.” or “:”).

Examples:

Path("emails").is_prefix_of("emails.value")  # True
Path("emails").is_prefix_of("emails")  # False (equal, not prefix)
Path("urn:...:User").is_prefix_of("urn:...:User:name")  # True

classmethod iter_paths(include_subattributes: bool = True, include_extensions: bool = True, required: list[Required] | None = None, mutability: list[Mutability] | None = None, uniqueness: list[Uniqueness] | None = None, returned: list[Returned] | None = None, case_exact: list[CaseExact] | None = None) → Iterator[Path[ResourceT]][source]#

Iterate over all paths for the bound model and its extensions.

Requires the Path to be bound to a model type via Path[Model].

Parameters:

include_subattributes¶ – Whether to include sub-attribute paths.
include_extensions¶ – Whether to include extension attributes.
required¶ – Filter by Required annotation values (e.g., [Required.true]).
mutability¶ – Filter by Mutability annotation values (e.g., [Mutability.read_write]).
uniqueness¶ – Filter by Uniqueness annotation values (e.g., [Uniqueness.server]).
returned¶ – Filter by Returned annotation values (e.g., [Returned.always]).
case_exact¶ – Filter by CaseExact annotation values (e.g., [CaseExact.true]).

Yields:

Path instances for each attribute matching the filters.

property model: type[BaseModel] | None#

The target model type for this path.

Requires the Path to be bound to a model type via Path[Model]. Returns None if the path is unbound or invalid.

For “name.familyName” on Path[User], returns Name. For “userName” on Path[User], returns User.

property parts: tuple[str, ...]#

The attribute path segments split by ‘.’.

For “name.familyName”, returns (“name”, “familyName”). For “userName”, returns (“userName”,). For “”, returns ().

property schema: str | None#

The schema URN portion of the path.

For paths like “urn:…:User:userName”, returns “urn:…:User”. For simple paths like “userName”, returns None.

set(resource: ResourceT, value: Any, *, is_add: bool = False, strict: bool = True) → bool[source]#

Set a value at this path on a resource.

A path crossing a multi-valued attribute writes the sub-attribute of each of its entries, so emails.value gives every email the same value. An unassigned multi-valued attribute has no entry to write to, and is left alone.

Parameters:

resource¶ – The resource to set the value on.
value¶ – The value to set.
is_add¶ – If True and the target is multi-valued, append to the list instead of replacing. Duplicates are not added.
strict¶ – If True, raise exceptions for invalid paths.

Returns:

True if the value was set/added, False if unchanged.

Raises:

InvalidPathException – If strict and the path does not exist or is invalid.

property urn: str | None#

The fully qualified URN for this path.

Requires the Path to be bound to a model type via Path[Model]. Returns None if the path is unbound or invalid.

For “userName” on Path[User], returns “urn:ietf:params:scim:schemas:core:2.0:User:userName”.

exception scim2_models.PathNotFoundException(*, path: str | None = None, field: str | None = None, **kw: Any)[source]#

The path references a non-existent field.

This is a specialized form of InvalidPathException.

class scim2_models.PhoneNumber(*, value: str | None = None, display: str | None = None, type: Type | None = None, primary: bool | None = None)[source]#

class Type(*values)[source]#

display: str | None#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

primary: bool | None#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute, e.g., the preferred phone number or primary phone number.

type: Type | None#: A label indicating the attribute’s function, e.g., ‘work’, ‘home’, ‘mobile’.

value: str | None#: Phone number of the User.

class scim2_models.Photo(*, value: Reference[external] | None = None, display: str | None = None, type: Type | None = None, primary: bool | None = None)[source]#

class Type(*values)[source]#

display: str | None#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

primary: bool | None#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute, e.g., the preferred photo or thumbnail.

type: Type | None#: A label indicating the attribute’s function, i.e., ‘photo’ or ‘thumbnail’.

value: Reference[external] | None#: URL of a photo of the User.

class scim2_models.QueryRequestContext[source]#: Shortcut for Annotated[T, SCIMValidator(Context.RESOURCE_QUERY_REQUEST)].

class scim2_models.QueryResponseContext[source]#: Shortcut for Annotated[T, SCIMSerializer(Context.RESOURCE_QUERY_RESPONSE)].

class scim2_models.Reference[source]#

Reference type as defined in RFC7643 §2.3.7.

References can take different type parameters:

External for external resources (photos, websites)
URI for URI identifiers (schema URNs, endpoints)
String forward references for SCIM resource types ("User", "Group")
Resource classes directly if imports allow

Examples:

class Foobar(Resource):
    photo: Reference[External] | None = None
    website: Reference[URI] | None = None
    manager: Reference["User"] | None = None
    members: Reference[Union["User", "Group"]] | None = None

classmethod get_scim_reference_types() → list[str][source]#: Return referenceTypes for SCIM schema generation.

class scim2_models.ReplacementRequestContext[source]#: Shortcut for Annotated[T, SCIMValidator(Context.RESOURCE_REPLACEMENT_REQUEST)].

class scim2_models.ReplacementResponseContext[source]#: Shortcut for Annotated[T, SCIMSerializer(Context.RESOURCE_REPLACEMENT_RESPONSE)].

class scim2_models.Required(*values)[source]#

A Boolean value that specifies whether the attribute is required or not.

Missing required attributes raise a ValidationError on RESOURCE_CREATION_REQUEST and RESOURCE_REPLACEMENT_REQUEST validations.

false = False#

The attribute may be absent.

This is the implicit value of any attribute, per RFC7643 §2.2.

true = True#

The attribute must carry a value in a creation or a replacement request.

A PATCH operation that removes it is rejected too, as RFC7644 §3.5.2.2 has a server answer mutability when a required attribute becomes unassigned.

class scim2_models.Resource(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, id: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Returned.always: 'always'>, <Uniqueness.global_: 'global'>] = None, externalid: ~typing.Annotated[str | None, <Mutability.read_write: 'readWrite'>, <Returned.default: 'default'>, <CaseExact.true: True>] = None, meta: ~typing.Annotated[~scim2_models.resources.resource.Meta | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>] = None)[source]#

external_id: true: True>]#: A String that is an identifier for the resource as defined by the provisioning client.

classmethod from_schema(schema: Schema) → type[Resource[Any]][source]#: Build a scim2_models.Resource subclass from the schema definition.

static get_by_payload(resource_types: Sequence[type[AnyScimObject]], payload: dict[str, Any], **kwargs: Any) → type[AnyScimObject] | type[Extension] | None[source]#: Given a resource type list and a payload, find the matching resource type.

Deprecated since version 0.6.13: Use get_model_by_payload() instead.

static get_by_schema(resource_types: Sequence[type[AnyScimObject]], schema: str, with_extensions: bool = True) → type[AnyScimObject] | type[Extension] | None[source]#: Given a resource type list and a schema, find the matching resource type.

Deprecated since version 0.6.13: Use get_model_by_schema() instead.

classmethod get_extension_model(name_or_schema: str | Schema) → type[Extension] | None[source]#: Return an extension by its name or schema.

classmethod get_extension_models() → dict[str, type[Extension]][source]#: Return extension a dict associating extension models with their schemas.

id: global_: 'global'>]#

A unique identifier for a SCIM resource as defined by the service provider.

id is mandatory is the resource representation, but is forbidden in resource creation or replacement requests.

meta: default: 'default'>]#: A complex attribute containing resource metadata.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

replace(original: Self) → None[source]#

Apply RFC 7644 §3.5.1 replace (PUT) semantics.

readOnly fields are copied from original. immutable fields are preserved from original when absent, or checked for equality when present.

Parameters:: original¶ – The original resource state to compare against.
Raises:: MutabilityException – If an immutable field value differs.

classmethod to_schema() → Schema[source]#: Build a Schema from the current resource class.

class scim2_models.ResourceType(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, id: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>] = None, externalid: ~typing.Annotated[str | None, <Mutability.read_write: 'readWrite'>, <Returned.default: 'default'>, <CaseExact.true: True>] = None, meta: ~typing.Annotated[~scim2_models.resources.resource.Meta | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>] = None, name: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>, <CaseExact.true: True>, <Uniqueness.server: 'server'>] = None, description: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>] = None, endpoint: ~typing.Annotated[~scim2_models.reference.Reference[uri] | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>, <Uniqueness.server: 'server'>] = None, schema: ~typing.Annotated[~scim2_models.reference.Reference[uri] | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, schemaextensions: ~typing.Annotated[list[~scim2_models.resources.resource_type.SchemaExtension] | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

description: read_only: 'readOnly'>]#

The resource type’s human-readable description.

When applicable, service providers MUST specify the description.

endpoint: server: 'server'>]#: The resource type’s HTTP-addressable endpoint relative to the Base URL, e.g., ‘/Users’.

classmethod from_resource(resource_model: type[Resource]) → Self[source]#: Build a naive ResourceType from a resource model.

id: default: 'default'>]#

The resource type’s server unique id.

This is often the same value as the “name” attribute.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

name: server: 'server'>]#

The resource type name.

When applicable, service providers MUST specify the name, e.g., ‘User’.

schema_: true: True>]#: The resource type’s primary/base schema URI.

schema_extensions: true: True>]#: A list of URIs of the resource type’s schema extensions.

class scim2_models.ResponseParameters(*, attributes: list[Path[ResourceT]] | None = None, excludedattributes: list[Path[ResourceT]] | None = None)[source]#

RFC7644 §3.9 attributes and excludedAttributes query parameters.

Parameterising them with the resource type an endpoint serves, as in ResponseParameters[User], resolves each path against that model, so a server can tell which attribute a client asked for.

attributes: list[Path[ResourceT]] | None#: A multi-valued list of strings indicating the names of resource attributes to return in the response, overriding the set of attributes that would be returned by default.

excluded_attributes: list[Path[ResourceT]] | None#: A multi-valued list of strings indicating the names of resource attributes to be removed from the default set of attributes to return.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

classmethod split_comma_separated(value: Any) → Any[source]#

Split comma-separated strings into lists.

RFC7644 §3.9 defines these as comma-separated query parameter values.

class scim2_models.Returned(*values)[source]#

A single keyword that indicates when an attribute and associated values are returned in response to a GET request or in response to a PUT, POST, or PATCH request.

always = 'always'#

The attribute is always returned, regardless of the contents of the “attributes” parameter.

For example, “id” is always returned to identify a SCIM resource. It survives ResponseParameters.excluded_attributes, and a response missing it is invalid.

default = 'default'#

The attribute is returned by default in all SCIM operation responses where attribute values are returned, unless it is explicitly excluded.

This is the implicit value of any attribute, per RFC7643 §2.2. Both ResponseParameters.attributes and ResponseParameters.excluded_attributes bear on it.

never = 'never'#

The attribute is never returned, regardless of the contents of the “attributes” parameter.

It is dropped from every response, and a response carrying it is invalid.

request = 'request'#

The attribute is returned in response to any PUT, POST, or PATCH operations if specified in the “attributes” parameter.

Asking for it takes an exact match: an attribute requested through its parent complex attribute stays out.

class scim2_models.Role(*, value: str | None = None, display: str | None = None, type: str | None = None, primary: bool | None = None)[source]#

display: str | None#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

primary: bool | None#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute.

type: str | None#: A label indicating the attribute’s function.

value: str | None#: The value of a role.

exception scim2_models.SCIMException(*, detail: str | None = None, scim_ctx: Context | None = None, **context: Any)[source]#

Base exception for SCIM protocol errors.

Each subclass corresponds to a scimType defined in RFC 7644 Table 9.

Parameters:

detail – The error detail message.
scim_ctx – The SCIM context in which the exception occurred.

as_pydantic_error() → PydanticCustomError[source]#: Convert to PydanticCustomError for use in Pydantic validators.

property detail: str#: The error detail message.

classmethod from_error(error: Error, scim_ctx: Context | None = None) → SCIMException[source]#

Create an exception from a SCIM Error object.

Parameters:

error¶ – The SCIM Error object to convert.
scim_ctx¶ – The SCIM context in which the exception occurred.

Returns:

The appropriate SCIMException subclass instance.

to_error() → Error[source]#: Convert this exception to a SCIM Error response object.

class scim2_models.SCIMSerializer(ctx: Context)[source]#

Annotated marker that injects a SCIM context during Pydantic serialization.

When used in a typing.Annotated type hint on a return type, the response object is serialized through model_dump_json() with the given ctx, applying returnability and mutability rules.

Parameters:: ctx¶ – The SCIM context to use during serialization.

class scim2_models.SCIMValidator(ctx: Context)[source]#

Annotated marker that injects a SCIM context during Pydantic validation.

When used in a typing.Annotated type hint, the incoming data is validated through model_validate() with the given ctx, activating all SCIM-specific validators (mutability, required fields, etc.).

Parameters:: ctx¶ – The SCIM context to use during validation.

class scim2_models.Schema(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, id: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, externalid: ~typing.Annotated[str | None, <Mutability.read_write: 'readWrite'>, <Returned.default: 'default'>, <CaseExact.true: True>] = None, meta: ~typing.Annotated[~scim2_models.resources.resource.Meta | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>] = None, name: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>, <Required.true: True>] = None, description: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>] = None, attributes: ~typing.Annotated[list[~scim2_models.resources.schema.Attribute] | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

attributes: true: True>]#: A complex type that defines service provider attributes and their qualities via the following set of sub-attributes.

description: default: 'default'>]#: The schema’s human-readable description.

get_attribute(attribute_name: str) → Attribute | None[source]#: Find an attribute by its name.

id: true: True>]#: The unique URI of the schema.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

name: true: True>]#: The schema’s human-readable name.

classmethod urn_id(value: str) → str[source]#: Ensure that schema ids are URI, as defined in RFC7643 §7.

class scim2_models.SchemaExtension(*, schema: Reference[uri] | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, required: Annotated[bool | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

required: true: True>]#

A Boolean value that specifies whether or not the schema extension is required for the resource type.

If true, a resource of this type MUST include this schema extension and also include any attributes declared as required in this schema extension. If false, a resource of this type MAY omit this schema extension.

schema_: true: True>]#: The URI of a schema extension.

class scim2_models.ScimObject(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>)[source]#

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

schemas: true: True>]#

The “schemas” attribute is a REQUIRED attribute and is an array of Strings containing URIs that are used to indicate the namespaces of the SCIM schemas that define the attributes present in the current JSON structure.

It only holds what a peer asserted, and is empty when a payload omitted it: SCIM dumps build it from the model definition.

class scim2_models.SearchRequest(*, attributes: list[~scim2_models.path.Path[~scim2_models.path.ResourceT]] | None = None, excludedattributes: list[~scim2_models.path.Path[~scim2_models.path.ResourceT]] | None = None, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, filter: str | None = None, sortby: ~scim2_models.path.Path[~scim2_models.path.ResourceT] | None = None, sortorder: ~scim2_models.messages.search_request.SearchRequest.SortOrder | None = None, startindex: int | None = None, count: int | None = None)[source]#

SearchRequest object defined at RFC7644 §3.4.3.

Parameterising the request with the resource type an endpoint serves, as in SearchRequest[User], resolves sort_by and the attributes of ResponseParameters against that model.

class SortOrder(*values)[source]#

count: int | None#: An integer indicating the desired maximum number of query results per page.

classmethod count_floor(value: int | None) → int | None[source]#

According to RFC7644 §3.4.2, count values less than 0 are interpreted as 0.

A negative value SHALL be interpreted as 0.

filter: str | None#: The filter string used to request a subset of resources.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

sort_by: Path[ResourceT] | None#: A string indicating the attribute whose value SHALL be used to order the returned responses.

sort_order: SortOrder | None#: A string indicating the order in which the “sortBy” parameter is applied.

start_index: int | None#: An integer indicating the 1-based index of the first query result.

property start_index_0: int | None#: The 0 indexed start index.

classmethod start_index_floor(value: int | None) → int | None[source]#

According to RFC7644 §3.4.2, start_index values less than 1 are interpreted as 1.

A value less than 1 SHALL be interpreted as 1.

property stop_index_0: int | None#: The 0 indexed stop index.

class scim2_models.SearchRequestContext[source]#: Shortcut for Annotated[T, SCIMValidator(Context.SEARCH_REQUEST)].

class scim2_models.SearchResponseContext[source]#: Shortcut for Annotated[T, SCIMSerializer(Context.SEARCH_RESPONSE)].

exception scim2_models.SensitiveException(*, detail: str | None = None, scim_ctx: Context | None = None, **context: Any)[source]#

The request cannot be completed due to sensitive information in the URI.

Corresponds to scimType sensitive with HTTP status 400.

RFC 7644 Section 7.5.2

class scim2_models.ServiceProviderConfig(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, id: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>, <Uniqueness.global_: 'global'>] = None, externalid: ~typing.Annotated[str | None, <Mutability.read_write: 'readWrite'>, <Returned.default: 'default'>, <CaseExact.true: True>] = None, meta: ~typing.Annotated[~scim2_models.resources.resource.Meta | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>] = None, documentationuri: ~typing.Annotated[~scim2_models.reference.Reference[external] | None, <Mutability.read_only: 'readOnly'>] = None, patch: ~typing.Annotated[~scim2_models.resources.service_provider_config.Patch | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, bulk: ~typing.Annotated[~scim2_models.resources.service_provider_config.Bulk | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, filter: ~typing.Annotated[~scim2_models.resources.service_provider_config.Filter | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, changepassword: ~typing.Annotated[~scim2_models.resources.service_provider_config.ChangePassword | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, sort: ~typing.Annotated[~scim2_models.resources.service_provider_config.Sort | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, etag: ~typing.Annotated[~scim2_models.resources.service_provider_config.ETag | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None, authenticationschemes: ~typing.Annotated[list[~scim2_models.resources.service_provider_config.AuthenticationScheme] | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

authentication_schemes: true: True>]#: A complex type that specifies supported authentication scheme properties.

bulk: true: True>]#: A complex type that specifies bulk configuration options.

change_password: true: True>]#: A complex type that specifies configuration options related to changing a password.

documentation_uri: read_only: 'readOnly'>]#: An HTTP-addressable URL pointing to the service provider’s human- consumable help documentation.

etag: true: True>]#: A complex type that specifies ETag configuration options.

filter: true: True>]#: A complex type that specifies FILTER options.

id: global_: 'global'>]#: A unique identifier for a SCIM resource as defined by the service provider.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

patch: true: True>]#: A complex type that specifies PATCH configuration options.

sort: true: True>]#: A complex type that specifies sort result options.

class scim2_models.Sort(*, supported: Annotated[bool | None, <Mutability.read_only: 'readOnly'>, <Required.true: True>] = None)[source]#

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

supported: true: True>]#: A Boolean value specifying whether or not the operation is supported.

exception scim2_models.TooManyException(*, detail: str | None = None, scim_ctx: Context | None = None, **context: Any)[source]#

The specified filter yields too many results.

Corresponds to scimType tooMany with HTTP status 400.

RFC 7644 Section 3.4.2.2

class scim2_models.URI[source]#

Marker for URI references per RFC7643 §7.

Use with Reference to type URI identifiers (schema URNs, endpoints):

endpoint: Reference[URI] | None = None

class scim2_models.URN(urn: str)[source]#

URN string type with validation.

classmethod check_syntax(path: str) → None[source]#

Validate URN-based path format.

Parameters:: path¶ – The URN path to validate
Raises:: ValueError – If the URN format is invalid

class scim2_models.Uniqueness(*values)[source]#

A single keyword value that specifies how the service provider enforces uniqueness of attribute values.

Unlike the other attribute characteristics, this one carries no validation: checking it takes the values a store already holds, which a model cannot know. It is a declaration, published by to_schema() and read back by from_schema(), that a service provider honours and whose violation it reports with UniquenessException.

global_ = 'global'#

The value SHOULD be globally unique (e.g., an email address, a GUID, or other value).

No two resources on any server SHOULD possess the same value. This is what Resource.id carries, an identifier a client may store alongside resources coming from several servers.

none = 'none'#

The values are not intended to be unique in any way.

This is the implicit value of any attribute, per RFC7643 §2.2.

server = 'server'#

The value SHOULD be unique within the context of the current SCIM endpoint (or tenancy) and MAY be globally unique (e.g., a “username”, email address, or other server-generated key or counter).

No two resources on the same server SHOULD possess the same value. This is what User.user_name carries.

exception scim2_models.UniquenessException(*, attribute: str | None = None, value: Any | None = None, **kw: Any)[source]#

One or more attribute values are already in use or reserved.

Corresponds to scimType uniqueness with HTTP status 409.

RFC 7644 Section 3.3.1

class scim2_models.User(*, schemas: ~typing.Annotated[list[str], <Required.true: True>] = <factory>, id: ~typing.Annotated[str | None, <Mutability.read_only: 'readOnly'>, <Returned.always: 'always'>, <Uniqueness.global_: 'global'>] = None, externalid: ~typing.Annotated[str | None, <Mutability.read_write: 'readWrite'>, <Returned.default: 'default'>, <CaseExact.true: True>] = None, meta: ~typing.Annotated[~scim2_models.resources.resource.Meta | None, <Mutability.read_only: 'readOnly'>, <Returned.default: 'default'>] = None, username: ~typing.Annotated[str | None, <Uniqueness.server: 'server'>, <Required.true: True>] = None, name: ~scim2_models.resources.user.Name | None = None, displayname: str | None = None, nickname: str | None = None, profileurl: ~scim2_models.reference.Reference[external] | None = None, title: str | None = None, usertype: str | None = None, preferredlanguage: str | None = None, locale: str | None = None, timezone: str | None = None, active: bool | None = None, password: ~typing.Annotated[str | None, <Mutability.write_only: 'writeOnly'>, <Returned.never: 'never'>] = None, emails: list[~scim2_models.resources.user.Email] | None = None, phonenumbers: list[~scim2_models.resources.user.PhoneNumber] | None = None, ims: list[~scim2_models.resources.user.Im] | None = None, photos: list[~scim2_models.resources.user.Photo] | None = None, addresses: list[~scim2_models.resources.user.Address] | None = None, groups: ~typing.Annotated[list[~scim2_models.resources.user.GroupMembership] | None, <Mutability.read_only: 'readOnly'>] = None, entitlements: list[~scim2_models.resources.user.Entitlement] | None = None, roles: list[~scim2_models.resources.user.Role] | None = None, x509certificates: list[~scim2_models.resources.user.X509Certificate] | None = None)[source]#

Addresses#: alias of Address

Emails#: alias of Email

Entitlements#: alias of Entitlement

Groups#: alias of GroupMembership

Ims#: alias of Im

family_name: str | None#: The family name of the User, or last name in most Western languages (e.g., ‘Jensen’ given the full name ‘Ms. Barbara J Jensen, III’).

formatted: str | None#: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display (e.g., ‘Ms. Barbara J Jensen, III’).

given_name: str | None#: The given name of the User, or first name in most Western languages (e.g., ‘Barbara’ given the full name ‘Ms. Barbara J Jensen, III’).

honorific_prefix: str | None#: The honorific prefix(es) of the User, or title in most Western languages (e.g., ‘Ms.’ given the full name ‘Ms. Barbara J Jensen, III’).

honorific_suffix: str | None#: The honorific suffix(es) of the User, or suffix in most Western languages (e.g., ‘III’ given the full name ‘Ms. Barbara J Jensen, III’).

middle_name: str | None#: The middle name(s) of the User (e.g., ‘Jane’ given the full name ‘Ms. Barbara J Jensen, III’).

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

PhoneNumbers#: alias of PhoneNumber

Photos#: alias of Photo

Roles#: alias of Role

X509Certificates#: alias of X509Certificate

active: bool | None#: A Boolean value indicating the User’s administrative status.

addresses: list[Address] | None#: A physical mailing address for this User.

display_name: str | None#: The name of the User, suitable for display to end-users.

emails: list[Email] | None#: Email addresses for the user.

entitlements: list[Entitlement] | None#: A list of entitlements for the User that represent a thing the User has.

groups: read_only: 'readOnly'>]#: A list of groups to which the user belongs, either through direct membership, through nested groups, or dynamically calculated.

ims: list[Im] | None#: Instant messaging addresses for the User.

locale: str | None#: Used to indicate the User’s default location for purposes of localizing items such as currency, date time format, or numerical representations.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

name: Name | None#: The components of the user’s real name.

nick_name: str | None#: The casual way to address the user in real life, e.g., ‘Bob’ or ‘Bobby’ instead of ‘Robert’.

password: never: 'never'>]#: The User’s cleartext password.

phone_numbers: list[PhoneNumber] | None#: Phone numbers for the User.

photos: list[Photo] | None#: URLs of photos of the User.

preferred_language: str | None#

Indicates the User’s preferred written or spoken language.

Generally used for selecting a localized user interface; e.g., ‘en_US’ specifies the language English and country US.

profile_url: Reference[external] | None#: A fully qualified URL pointing to a page representing the User’s online profile.

roles: list[Role] | None#: A list of roles for the User that collectively represent who the User is, e.g., ‘Student’, ‘Faculty’.

timezone: str | None#: The User’s time zone in the ‘Olson’ time zone database format, e.g., ‘America/Los_Angeles’.

title: str | None#: The user’s title, such as “Vice President”.

user_name: true: True>]#: Unique identifier for the User, typically used by the user to directly authenticate to the service provider.

user_type: str | None#

Used to identify the relationship between the organization and the user.

Typical values used might be ‘Contractor’, ‘Employee’, ‘Intern’, ‘Temp’, ‘External’, and ‘Unknown’, but any value may be used.

x509_certificates: list[X509Certificate] | None#: A list of certificates issued to the User.

class scim2_models.X509Certificate(*, value: Annotated[bytes, EncodedBytes(encoder=Base64Encoder)] | None = None, display: str | None = None, type: str | None = None, primary: bool | None = None)[source]#

display: str | None#: A human-readable name, primarily used for display purposes.

model_config = {'alias_generator': AliasGenerator(alias=None, validation_alias=<functools._lru_cache_wrapper object>, serialization_alias=<function _to_camel>), 'extra': 'forbid', 'populate_by_name': True, 'use_attribute_docstrings': True, 'validate_assignment': True, 'validate_by_alias': True, 'validate_by_name': True}#: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context: Any, /) → None#

This function is meant to behave like a BaseModel method to initialize private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Args:: self: The BaseModel instance. context: The context.

primary: bool | None#: A Boolean value indicating the ‘primary’ or preferred attribute value for this attribute.

type: str | None#: A label indicating the attribute’s function.

value: Annotated[bytes, EncodedBytes(encoder=Base64Encoder)] | None#: The value of an X.509 certificate.

scim2_models.get_model_by_payload(models: Sequence[type[AnyScimObject]], payload: dict[str, Any], **kwargs: Any) → type[AnyScimObject] | type[Extension] | None[source]#

Given a model list and a payload, find the matching model.

Parameters:

models¶ – The models to look into.
payload¶ – The payload which schemas are used to look for a model.
kwargs¶ – Additional parameters passed to get_model_by_schema().

scim2_models.get_model_by_schema(models: Sequence[type[AnyScimObject]], schema: str, with_extensions: bool = True) → type[AnyScimObject] | type[Extension] | None[source]#

Given a model list and a schema, find the matching model.

Parameters:

models¶ – The models to look into.
schema¶ – The schema of the model to look for.
with_extensions¶ – Whether to look into the model extensions.