Using the SWOOP SCIM to Sync User Data from HR Systems (e.g. Workday)

Purpose and Scope

The SWOOP SCIM integration allows customers to push employee attributes from their system of record (e.g. Workday) into SWOOP so that user profile data used for analytics (such as department, location, role) stays accurate and up to date.

Key points:

• SWOOP receives SCIM data; it does not extract data from HR systems.
• The customer’s HR system is the source of truth.
• Integration is based on the SCIM (System for Cross‑domain Identity Management) standard.

2. Roles and Responsibilities

What SWOOP Provides

•  A tenant‑specific, SCIM‑compatible API endpoint

•  Authentication via SWOOP API tokens

•  A validated SCIM schema agreed per customer

•  Processing and storage of approved user attributes

SWOOP does not:

• Configure Workday or HR systems
• Build or operate SCIM‑sending software
• Act as middleware between systems

What the Customer Provides

• A defined source of truth (e.g. Workday)

• A SCIM “push” capability (direct or via an intermediary)

• Attribute mappings from HR → SWOOP schema

• Scheduling, monitoring, and error handling (which is supported by SWOOP).

3. Implementation steps

When you're ready to set up the SCIM connection, please submit a SWOOP support ticket. 

Open SWOOP > Click Help (in the bottom right) > Request Support 

1. Customer confirms source of truth

Workday (or equivalent) is treated as authoritative for employee attributes such as name, department, location, role, and other HR data.

1. Customer establishes a SCIM push mechanism

The customer uses software capable of sending outbound SCIM requests. Common patterns include:

1     - Workday → intermediary \(e\.g\. Entra ID, SailPoint\) → SWOOP

2     - Custom middleware or scheduled scripts

You can review this list of third-party providers to push the data out.

1. SWOOP provides a SCIM endpoint

1     https://<instancename>.swoopanalytics.com/scim/

Each customer receives a tenant‑specific endpoint.

1. Customer generates a SWOOP API token

The token is created in SWOOP Admin → API Tokens and is used by the customer’s SCIM client for authentication.

Open SWOOP > Click on Admin Settings (in the bottom right) > API Tokens > Follow these steps:

1. Set Expiry (1 Year (max) is recommended)
2. Select Admin
3. In Token Notes add detail like (SCIM Data - Workday)
4. Click Generate

The URL in Step 3 is where you'll send the data. 
The API Token in Step 4 is the "password" to allow you to send it.

4. Schema is agreed and enabled

It's critical that the customer shares the list of attributes they intend to send. SWOOP then uses this to:

1     Configure the schema so only those fields/ attributes are accepted.

2     Enable SCIM for the tenant

• Customer begins sending SCIM updates

Once enabled, the customer’s system pushes user updates to SWOOP on an agreed schedule.

4. What Is the SWOOP SCIM Server?

SCIM (System for Cross‑domain Identity Management) is a standard protocol for exchanging identity data across systems.

The SWOOP SCIM Server exposes a SCIM‑compatible API on each SWOOP tenant, allowing customers to programmatically create or update user attributes in SWOOP.

5. Prerequisites

Before integration can begin, the following are required:

1. SCIM enabled on the SWOOP tenant

Enabled by SWOOP Support after schema agreement.

1. A SWOOP API token

Managed in SWOOP Admin Settings.

1. Customer‑side integration capability

The customer’s system must be able to:

1     - Read users from the HR system

2     - Map attributes to the SWOOP SCIM schema

3     - Send authenticated SCIM requests

6. Authentication

All SCIM requests authenticate using a SWOOP API token passed as a Bearer token:

1     Authorization: Bearer <your API token>

7. Supported SCIM Endpoints

The SWOOP SCIM API exposes the following endpoints:

• /ServiceProviderConfig
• /ResourceTypes
• /Schemas
• /Users

For HR integrations, /Users is the primary endpoint.

Supported Operations on /Users

• GET – Retrieve user information
• PUT – Update a single user