<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Implementing Identity Lifecycle Automation

## Identity Lifecycle APIs

### SCIM 2.0 Protocol

| Operation | Method | Endpoint | Description |
|---|---|---|---|
| Create User | `POST` | `/scim/v2/Users` | Provision user |
| Get User | `GET` | `/scim/v2/Users/{id}` | Read user |
| Update User | `PATCH` | `/scim/v2/Users/{id}` | Modify attributes |
| Delete User | `DELETE` | `/scim/v2/Users/{id}` | Deprovision |
| List Users | `GET` | `/scim/v2/Users?filter=...` | Search users |
| Bulk | `POST` | `/scim/v2/Bulk` | Batch operations |

### Microsoft Graph — Lifecycle Workflows

| Endpoint | Description |
|---|---|
| `GET /identityGovernance/lifecycleWorkflows/workflows` | List workflows |
| `POST /identityGovernance/lifecycleWorkflows/workflows` | Create workflow |
| `POST /identityGovernance/lifecycleWorkflows/workflows/{id}/activate` | Activate workflow |

### Agent Script

```bash
# Provision user
node agent.js provision --user-data new_hire.json --targets entra_id okta

# Deprovision user
node agent.js deprovision --user-id user@example.com

# Run certification
node agent.js certify --scope "privileged_roles" --approvers manager security_team
```
