> For the complete documentation index, see [llms.txt](https://incident-tracker.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://incident-tracker.gitbook.io/docs/admin-guide/application-information/authentication-settings/account-provisioning/scim/scim-on-premise.md).

# SCIM (on premise)

#### SCIM Provisioning for On-Premise Installations

For customers running Incident Tracker in an **on-premise environment**, SCIM provisioning is supported through a locally deployed API project. This section outlines the installation and configuration requirements.

***

**API Project Setup**

* If not already installed, create a **new IIS project** to handle all API functions.
* Provision a new API URL. The recommended approach is to use the existing Incident Tracker base domain with a new prefix.

**Example:**

* Incident Tracker site: `https://incident-tracker.yourdomain.com`
* API endpoint: `https://api-incident-tracker.yourdomain.com`

> ✅ You can reuse the existing TLS/SSL certificate if possible.

***

**API Endpoints**

The on-premise API provides the same functionality as the cloud version (different base URL only). Reference [Public API documentation](https://incident-tracker.gitbook.io/docs/admin-guide/application-information/public-api) for full details.

Available endpoints include:

* `GET /api/Events/GetlabelChangeHistory/{IIDstart}/{IIDend}/{page}`
* `GET /api/Incident/total`
* `GET /api/Incident/{IID}`
* `GET /api/Incident`
* `POST /api/Incident/search`

**Swagger Documentation:**\
Available at: <https://{APIURL}/swagger/index.html>\
(Refresh the page if it fails to load the first try)

***

**SCIM Endpoints**

SCIM is exposed via the following endpoints:

* `GET /scim/v2/ServiceProviderConfig`
  * Provides SCIM service configuration.
  * Embedded references point to: [SCIM Documentation](https://incident-tracker.gitbook.io/docs/admin-guide/application-information/authentication-settings/account-provisioning/scim)
* `GET /scim/v2/Users`
* `GET /scim/v2/Users/{id}`
* `POST /scim/v2/Users`
* `PATCH /scim/v2/Users/{id}`
* `DELETE /scim/v2/Users/{id}`

***

**System Requirements**

* **Framework:** .NET Core 9 or newer
  * Microsoft .NET 10 (LTS) will be released in November and should be supported through backward compatibility.
* **Storage:** Allocate at least **1 GB** for the API project.
* **Server Deployment:**
  * Recommended: Install both the **web app** and **API** on the same server.
  * If separated, provision a server matching the same specs required for the Incident Tracker web app.
  * Ensure the API server can communicate with:
    * SQL Server hosting the Incident Tracker database
    * Active Directory or external identity provider

⚠️ Configure firewalls, ACLs, and network routes as needed to allow communication between these components.

***

**Azure SCIM Configuration Notes**

When integrating with **Microsoft Entra ID (Azure AD):**

* Use the **on-prem API base URL** as the **SCIM Tenant URL** in Azure.
* Provision a **SCIM Bearer Token** via Incident Tracker Support or your admin team.
* Follow the same attribute mapping and provisioning scope instructions as outlined in the [Cloud SCIM Setup Guide](https://incident-tracker.gitbook.io/docs/admin-guide/application-information/authentication-settings/account-provisioning/scim).
* Ensure the Entra provisioning agent or connector VM has network access to the on-premise API server.

> 💡 For hybrid deployments, consider Azure AD Application Proxy or VPN connectivity if the API is not exposed to the public internet.