AWS singlesignon documentation change
Summary
Added pagination support (cursor & count parameters), increased maximum results per page from 50 to 100, added groups.value filter support, and expanded error constraints regarding filter changes during pagination
Security assessment
The changes primarily focus on API feature enhancements (pagination, increased page size, new filter) rather than addressing security vulnerabilities. The ValidationException update regarding filter parameter changes during pagination appears to be an error handling improvement rather than a security fix. No CVEs, vulnerabilities, or security advisories are referenced.
Diff
diff --git a/singlesignon/latest/developerguide/listusers.md b/singlesignon/latest/developerguide/listusers.md index 2d9f38e4d..4883f55fd 100644 --- a//singlesignon/latest/developerguide/listusers.md +++ b//singlesignon/latest/developerguide/listusers.md @@ -5 +5 @@ -Not supportedConstraintsErrorsExamplesFilter examples +Not supportedQuery ParametersConstraintsErrorsPagination ExamplesExamplesFilter examples @@ -9 +9 @@ Not supportedConstraintsErrorsExamplesFilter examples -This endpoint provides the ability to perform filter queries on an existing list of users through a `GET` request to `/Users` by inserting additional filters. Only a maximum of 50 results can be returned. See the **Constraints** section for more information. +This endpoint provides the ability to perform filter queries on an existing list of users through a `GET` request to `/Users` by inserting additional filters. A maximum of 100 results can be returned per page. See the **Constraints** section for more information. @@ -19,0 +20,21 @@ The IAM Identity Center SCIM implementation does not support the following aspec +## Query Parameters + +ListUsers currently supports the following optional query parameters: + + * `cursor` used to specify the next page for paginated calls + + * Pattern: [-a-zA-Z0-9+=/:_]* + + * Response format: Including the cursor parameter changes the default response format from non-paginated (with totalResults, startIndex, and itemsPerPage fields) to cursor-based paginated results (with itemsPerPage and nextCursor fields) + + * `count` used to specify the maximum number of results per page + + * Valid Range: Minimum value of 1. Maximum value of 100. + + * Default: 100 + + * `filter` used to filter out specific users + + + + @@ -24 +45,3 @@ The IAM Identity Center SCIM implementation has the following constraints for th - * At this time, the `ListUsers` API is only capable of returning up to 50 results. + * The `ListUsers` API is capable of returning up to a maximum of 100 results per page. + + * Supported filter combinations: (`userName`), (`externalId`), (`groups.value`), (`id` and `manager`), (`manager` and `id`). Note that the use of `id` as an individual filter, though valid, should be avoided as a `getUser` endpoint is already available. @@ -26 +49,7 @@ The IAM Identity Center SCIM implementation has the following constraints for th - * Supported filter combinations: (`userName`), (`externalId`), (`id` and `manager`), (`manager` and `id`). Note that the use of `id` as an individual filter, though valid, should be avoided as a `getUser` endpoint is already available. + * Pagination requests must include `cursor` in the query parameters + + * The first request made with cursor must be empty (eg. https://.../Users?cursor) + + * If the response includes a nextCursor field, its value can be used as the cursor value to retrieve the next page of results + + * Paginated calls may return less results than count but as long as nextCursor is present in the response, additional pages are available. @@ -41 +70 @@ Error | Condition | HTTP Status Code -`ValidationException` | Request cannot be parsed, is syntactically incorrect, or violates schema. This error also occurs if the operation is unsupported. | 400 +`ValidationException` | Request cannot be parsed, is syntactically incorrect, or violates schema. This error also occurs if the operation is unsupported, or if filter parameters are changed between pagination requests. | 400 @@ -46,0 +76,47 @@ Error | Condition | HTTP Status Code +## Pagination Examples + +### Example Request For First Page + +###### Example Request + + + GET https://scim.us-east-1.amazonaws.com/{tenant_id}/scim/v2/Users?cursor + Authorization: Bearer <bearer_token> + +###### Example Response + + + { + "itemsPerPage": 100, + "nextCursor": "VGVzdFVzZXJDdXJzb3I", + "schemas": [ + "urn:ietf:params:scim:api:messages:2.0:ListResponse" + ], + "Resources": [ + ... + ] + } + +### Example Request For Getting the Next Page + +_Note: the example does not include a`nextCursor` field since the current page is the last page of results_ + +###### Example Request + + + GET https://scim.us-east-1.amazonaws.com/{tenant_id}/scim/v2/Users?cursor=VGVzdFVzZXJDdXJzb3I + Authorization: Bearer <bearer_token> + +###### Example Response + + + { + "itemsPerPage": 100, + "schemas": [ + "urn:ietf:params:scim:api:messages:2.0:ListResponse" + ], + "Resources": [ + ... + ] + } + @@ -250,0 +327,2 @@ The following four different filter combinations are supported. + * `groups.value` + @@ -395,0 +474,131 @@ The filters can be applied in the formats as shown. +### groups.value + +#### Example Request Without Pagination + +###### Example Request + + + GET https://scim.us-east-1.amazonaws.com/{tenant_id}/scim/v2/Users?filter=groups.value eq "0458a488-2081-70c8-4b0b-3e4b2b10ddb5" + Authorization: Bearer <bearer_token> + +###### Example Response + + + { + "totalResults": 100, + "itemsPerPage": 100, + "startIndex": 1, + "schemas": [ + "urn:ietf:params:scim:api:messages:2.0:ListResponse" + ], + "Resources": [ + { + "id": "5418a458-c0a1-7066-bdd4-9ea543c0cf6d", + "externalId": "eid_XftxVGp61hDs6Dugey2R", + "meta": { + "resourceType": "User", + "created": "2025-07-30T17:13:10Z", + "lastModified": "2025-07-30T17:13:10Z" + }, + "schemas": [ + "urn:ietf:params:scim:schemas:core:2.0:User", + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" + ], + "userName": "username_XftxVGp61hDs6Dugey2R", + "name": { + "formatted": "formatted_XftxVGp61hDs6Dugey2R", + "familyName": "familyname_XftxVGp61hDs6Dugey2R", + "givenName": "givenname_XftxVGp61hDs6Dugey2R", + "middleName": "middlename_XftxVGp61hDs6Dugey2R", + "honorificPrefix": "Ms.", + "honorificSuffix": "III" + }, + "displayName": "displayname_XftxVGp61hDs6Dugey2R", + "nickName": "nickName_XftxVGp61hDs6Dugey2R", + "title": "Tour Guide", + "userType": "Employee", + "preferredLanguage": "en-US", + "locale": "en-US", + "timezone": "America/Los_Angeles", + "active": true, + "emails": [ + { + "value": "[email protected]", + "type": "work", + "primary": true + } + ], + "addresses": [ + { + "formatted": "100 Universal City Plaza Hollywood, CA 91608 USA", + "streetAddress": "100 Universal City Plaza", + "locality": "Hollywood", + "region": "CA", + "postalCode": "91608", + "country": "USA", + "type": "work", + "primary": true + } + ], + "phoneNumbers": [ + { + "value": "555-555-5555", + "type": "work", + "primary": true + } + ], + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": { + "employeeNumber": "employeeNumber_XftxVGp61hDs6Dugey2R", + "costCenter": "4130", + "organization": "Universal Studios", + "division": "Theme Park", + "department": "Tour Operations" + } + }, + ... + ] + } + +#### Example Request With Pagination + +###### Example Request + + + GET https://scim.us-east-1.amazonaws.com/{tenant_id}/scim/v2/Users?cursor&filter=groups.value eq "0458a488-2081-70c8-4b0b-3e4b2b10ddb5" + Authorization: Bearer <bearer_token> + +###### Example Response + +