# SCIM API always 401 **URL:** \ **Category:** Jira Cloud\ **Tags:** auth, organization, api-token, scim, cloud-admin\ **Created:** [October 19, 2022, 2:00am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681 "2022-10-19T02:00:25Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![KCWong](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@KCWong](https://community.developer.atlassian.com/u/KCWong)\ **Post date:** [October 19, 2022, 2:00am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681/1 "2022-10-19T02:00:25Z")
I have a site confiugred with SSO and user provisioning using Azure AD. Should the SCIM API be available for this site? I tried following the steps in [https://developer.atlassian.com/cloud/admin/user-provisioning/rest/intro/](https://developer.atlassian.com/cloud/admin/user-provisioning/rest/intro/) to call it with curl, but I always get 401 “unauthorized to access”. My goal is to retrieve the syncrhonized user data like “Department” and “Title” to display in issues, and I think I need to use Automation to call the SCIM API to read those data. ---
**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\ **Post date:** [October 19, 2022, 10:18am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681/2 "2022-10-19T10:18:21Z")
@KCWong, > [@KCWong](#): > > Should the SCIM API be available for this site? The short answer, yes. First, a point of correction. SCIM APIs are not “for this site” they are “for this organization”. The reason this matters is that sites and organizations are different sets of users. A site might have only users from an organization, but that is not strictly true in all cases. Many of our customers have sites with users from outside their own managed organization. If you are always getting `401`, it’s likely a problem with your API key. A common confusion is admin API keys with the common API tokens for accessing the Jira REST API. Those are not the same. The API token you obtain from your user profile will not work. You must obtain a token from the organization admin screen. To generate the admin API key, follow these instructions: > **[Manage an organization with the admin APIs | Atlassian Support](https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/)** > > Programatically manage your organization and users with the admin REST API, and start making requests with an API key. (At time of writing, [the admin API docs about auth](https://developer.atlassian.com/cloud/admin/user-provisioning/rest/intro/#auth) navigate to the org admin pages correctly but don’t navigate to the API key section correctly. Close, but not entirely accurate.) I just generated a new admin API key and it works correctly for me. ---
**Author:** ![KCWong](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@KCWong](https://community.developer.atlassian.com/u/KCWong)\ **Post date:** [October 20, 2022, 12:47am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681/3 "2022-10-20T00:47:04Z")
Yes, I’m generating my API key from: 1. Gear | User Administration 2. Settings | API Keys The screen shows: 1. organization ID 2. API key. I plugged the API key directly into the curl command: curl --request GET –url ‘[https://api.atlassian.com/scim/directory/{directoryId}/Users](https://api.atlassian.com/scim/directory/%7BdirectoryId%7D/Users)’ –header ‘Authorization: Bearer [API Key]’ –header ‘Accept: application/json’ Maybe I’m using the wrong directory ID? This thread says: > **[How do I get the directory ID for use in the Atlassian SCIM Users API?](https://community.atlassian.com/t5/Jira-questions/How-do-I-get-the-directory-ID-for-use-in-the-Atlassian-SCIM/qaq-p/1176972)** > > I would like to use this API https://developer.atlassian.com/cloud/admin/user-provisioning/rest/#about BUT I am blocked because I don't know how to get the Directory ID.   P.S. It would be nice to add a SCIM tag to posts. -- Here is... 1. To go to your organization 2. Directory | User Provisioning But for me my Directory does not have User Provisioning. I only have three items: 1. Users 2. Groups 3. Managed Users Instead I have Authentication Policies and Identity Providers under Security. Where can I find my directory ID? **Edit:** I think I messed up the curl command before. Now I’m using SoapUI and added the headers, it is no longer 401, but 404. If I use organization ID as directory ID, the response is 404 with errors = none found. ---
**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\ **Post date:** [October 20, 2022, 11:25am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681/4 "2022-10-20T11:25:51Z")
@KCWong, > [@KCWong](#): > > If I use organization ID as directory ID, the response is 404 with errors = none found. Yes. I confirm the organization id is not the directory id. > [@KCWong](#): > > But for me my Directory does not have User Provisioning. That sounds like you are not an organizational admin. Maybe you can use the following to diagnose: > **[Give users admin permissions | Atlassian Support](https://support.atlassian.com/user-management/docs/give-users-admin-permissions/)** > > Learn how to assign users admin roles within your organization. ---
**Author:** ![KCWong](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@KCWong](https://community.developer.atlassian.com/u/KCWong)\ **Post date:** [October 21, 2022, 12:22am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681/5 "2022-10-21T00:22:36Z")
Thanks again. I’ll ask if they can make me org admin, or fetch the directory ID for me. ---
**Author:** ![KCWong](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@KCWong](https://community.developer.atlassian.com/u/KCWong)\ **Post date:** [October 24, 2022, 1:36am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681/6 "2022-10-24T01:36:54Z")
My user is marked as org admin: ![image](https://global.discourse-cdn.com/atlassiandeveloper/original/3X/c/b/cbea268e184a6b7a3ae045406caf221ed325879b.png) This is my Directory menu: ![image](https://global.discourse-cdn.com/atlassiandeveloper/original/3X/8/9/8948fb5700f2e883331999847ffd5a27f49f72aa.png) This is my Security menu: ![image](https://global.discourse-cdn.com/atlassiandeveloper/original/3X/c/f/cf3ac16eb50169fd557850e29b1f2a4e620e340e.png) Where do I find the directory ID? ---
**Author:** ![YY1](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/yy1/32/47408_2.png) [@YY1](https://community.developer.atlassian.com/u/YY1)\ **Post date:** [October 18, 2023, 8:10am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681/7 "2023-10-18T08:10:23Z")
I have the same API requirement and still am waiting for the expected answer. @ibuchanan ---
**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\ **Post date:** [October 18, 2023, 11:15am UTC](https://community.developer.atlassian.com/t/scim-api-always-401/62681/8 "2023-10-18T11:15:48Z")
@YY1 and @KCWong, It helps to start new questions with a new topic. I think the following thread has an answer for directory ids: > [@Using the get groups API, where can I get the Directory ID?](https://community.developer.atlassian.com/t/using-the-get-groups-api-where-can-i-get-the-directory-id/73697): > > The API reference here [Groups](https://developer.atlassian.com/cloud/admin/user-provisioning/rest/api-group-groups/#api-scim-directory-directoryid-groups-get), requires a Directory ID but I dont see any information on where to get this ID from. Can someone help me find this ID? I pulled what looks like an ID from my manage groups page and I get a 403 forbidden error, so I think this is the wrong ID.