This article is a technical explanation and implementation example generated using AI. The provided code and procedures are based on primary sources, but the author has not verified them on actual hardware. Behavior may vary depending on the environment and version.
Regarding the addition to GitHub's SCIM (System for Cross-domain Identity Management) user responses of the profileUrl attribute, we safely and practically organize its specifications and background based on official changelogs. We review the prerequisite knowledge and impact on existing integrations for Identity Providers (IdPs) and IT administrators to efficiently identify the mapping between external identities and GitHub accounts.
Overview of Changes in SCIM User Responses
GitHub's SCIM user responses now include the standard profileUrl attribute defined in RFC 7643. This attribute stores the absolute URL of the GitHub account linked to the external identity.
According to primary sources, this change eliminates the need for additional lookups or guesswork previously required when matching SCIM records with their corresponding GitHub accounts. Identity providers and IT teams provisioning access to GitHub via SCIM can now read the profileUrl directly without implementing workarounds to bypass this gap.
Specifications of the Added profileUrl Attribute
profileUrlThe /Users attribute is returned from the SCIM
endpoint. This support is provided consistently in SCIM responses for both organizations and enterprises. On the other hand, if the external identity is not yet linked to a GitHub user, the profileUrl attribute is omitted from the response. Furthermore, this attribute is also documented in the SCIM OpenAPI schema and sample response documents.
flowchart TD
A["SCIM /Users エンドポイント"] --> B{"外部アイデンティティのリンク状態"}
B -->|リンク済み| C["profileUrl 属性が含まれる<br>（GitHubアカウントの絶対URL）"]
B -->|未リンク| D["profileUrl 属性は省略される"]
Impact on Existing Integrations and Compatibility
Primary sources clearly outline the policy regarding the impact on existing integrations.
userNameOther attributes such as
will continue to return the same values as before. Therefore, existing SCIM, GraphQL, and identity management integrations remain unaffected. This change is entirely additive, and no prior action or configuration changes are mandatory for existing integrations. If you want to use the new mapping, you can build your processing logic to read the profileUrl when it is present in the SCIM response.
Related Official Documents and References
Detailed specifications and usage of the REST API related to this update can be checked in the following official documentation:
Enterprise SCIM documentation
Organization SCIM documentation
Notes and Summary on Usage
We summarize the key points and cautions regarding the SCIM profileUrl attribute covered in this article.
Pre-verification Notice: The content of this article is based on research of primary sources and is in a "pre-hardware-verification" state. Actual API responses and IdP behavior may vary depending on the environment.
Reduction of Additional Lookups: Absolute URLs can now be retrieved directly when verifying the link between external identities and GitHub accounts.
Maintenance of Backward Compatibility: This is an additive change that does not affect existing attributes like
userNameor integrations, allowing deployment without breaking existing systems.Behavior When Unlinked: Since the attribute itself is omitted for unlinked accounts, existence checks are required during implementation.
