Flow 04 · Lifecycle

The interesting call is the leaver.

SCIM just carries a decision HR and policy already made. Creating the account is easy. Setting active to false, on a clock you can defend, is the part that matters.

Watch for

externalId is how you find the person in HR. The app’s own id is what you PATCH later. Keep both.
Entitlements travel as groups. A role someone typed into the app by hand will drift the next time the job runs.
The bearer token on the SCIM client can create and disable accounts. Treat it like an admin.

Failure modes

A joiner feed and no tested leaver. The account outlives the person.
POSTing on every sync. A 409 usually means you already have them. Look them up instead of making a twin.
One SCIM credential for every connected app, sitting somewhere the pipeline will eventually print.