Group SCIM identities

When a group’s identity provider provisions users over SCIM, GitLab keeps a SCIM identity linking each user to the provider’s ID for them. These actions list a group’s SCIM identities, read one, change the ID it is linked to, and delete it.

Sample questions

• “List the SCIM identities of group acme”
• “Which GitLab user is SCIM identity 7f3a?”
• “Unlink the SCIM identity of a departed employee”

How to call it

• Dynamic, the default surface: call gitlab_execute_action with action set to the action’s ID, such as group_scim.delete, and its parameters in params. gitlab_find_action finds an ID from a description of the task.
• Meta (GITLAB_MCP_TOOL_SURFACE=meta): call gitlab_group_scim with action set to the action’s name, such as delete, and its parameters in params.
• Individual (GITLAB_MCP_TOOL_SURFACE=individual): call the action’s own tool, such as gitlab_delete_group_scim_identity, with its parameters as the arguments.

Availability

How many of these actions an instance serves at each tier, out of a total of 4:

• Free: 0
• Premium: 4
• Ultimate: 4

Read-only actions: 2 of 4, the ones a deployment in read-only mode keeps. A token with read_api and not api is served 2 of the 4.

Actions

The description of each action, and of each of its parameters, is the text the server serves for it on the default surface, quoted as served. The token lines say what GitLab 19.4.1 requires of a token for the requests each action sends; on an instance with Admin Mode turned on, an action only an administrator may run also needs admin_mode. A destructive action runs only once confirmed, unless GITLAB_MCP_YOLO_MODE (or AUTOPILOT) skips that step: the dynamic surface needs confirm: true on gitlab_execute_action, and the other two take a confirm parameter or the client’s prompt (Destructive actions).

Action	Individual
group_scim.delete	gitlab_delete_group_scim_identity
group_scim.get	gitlab_get_group_scim_identity
group_scim.list	gitlab_list_group_scim_identities
group_scim.update	gitlab_update_group_scim_identity

group_scim.delete

Delete a SCIM identity from a top-level group by its SCIM external UID. Returns: a success confirmation naming the deleted SCIM identity and group. See also: group_scim.get, group_scim.list, group_scim.update.

• Meta-tool: gitlab_group_scim, action delete
• Individual tool: gitlab_delete_group_scim_identity
• Tier: Premium
• Classic or OAuth token: api
• Fine-grained token: SCIM Identity: Delete at group (permissions page)
• Behavior: writes, destructive (needs confirmation), idempotent

Parameter	Type	Mandatory	Description
group_id	string/integer	yes	Group ID or URL-encoded path
uid	string	yes	SCIM external UID of the user

group_scim.get

Get one SCIM identity of a top-level group by its SCIM external UID. Returns: the identity’s external_uid, user_id, and active status. See also: group_scim.list, group_scim.update, group_scim.delete.

• Meta-tool: gitlab_group_scim, action get
• Individual tool: gitlab_get_group_scim_identity
• Tier: Premium
• Classic or OAuth token: read_api (or api)
• Fine-grained token: SCIM Identity: Read at group (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
group_id	string/integer	yes	Group ID or URL-encoded path
uid	string	yes	SCIM external UID of the user

group_scim.list

List a top-level group’s SCIM identities provisioned through SAML SSO SCIM. Returns: each identity with external_uid, user_id, and active status. See also: group_scim.get, group_scim.update, group_scim.delete.

• Meta-tool: gitlab_group_scim, action list
• Individual tool: gitlab_list_group_scim_identities
• Tier: Premium
• Classic or OAuth token: read_api (or api)
• Fine-grained token: SCIM Identity: Read at group (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
group_id	string/integer	yes	Group ID or URL-encoded path

group_scim.update

Update the extern_uid of an existing group SCIM identity. Returns: a confirmation that the SCIM identity’s external UID was rewritten. See also: group_scim.get, group_scim.list, group_scim.delete.

• Meta-tool: gitlab_group_scim, action update
• Individual tool: gitlab_update_group_scim_identity
• Tier: Premium
• Classic or OAuth token: api
• Fine-grained token: SCIM Identity: Update at group (permissions page)
• Behavior: writes, idempotent

Parameter	Type	Mandatory	Description
extern_uid	string	yes	New external UID value
group_id	string/integer	yes	Group ID or URL-encoded path
uid	string	yes	SCIM external UID of the user