credentialDiscoveryUri
credentialDiscoveryUri points to a document that describes how an agent can bind credentials. The SCIM record itself carries no keys or certificates.
| Defined in | draft-kushwaha-scim-agent-governance-00 |
|---|---|
| Type | reference of type external |
| Required | No |
| Scheme | https recommended |
Meaning
A SCIM reference containing a URI where an agent-specific discovery document can be fetched. The document describes the credential binding methods the agent supports. Its format is out of scope for the draft.
Why not store the details in SCIM
The draft argues that putting method, certificate thumbprint and issuer in the provisioning record is brittle: an agent may support several binding options and they change over time, while a provisioning record is fairly static. A discovery document works like OAuth authorization server metadata. The information can change without SCIM traffic and can be verified separately.
Trust rules
The URI should use https and should be served from an authority associated with the agent's operator. A service must check that the value points to an authority authorized for the agent or its operator before relying on it.
Compared with earlier drafts
The Okta draft stored x509Certificates inside the agent record. The Wahl draft stored OAuth parameters in oAuthClientIdentifiers. This one links to the details instead.
Example
From the draft's own example.
Source: draft-kushwaha-scim-agent-governance-00 (datatracker). Drafts change. Read on 18 October 2026. Independent site, not affiliated with the IETF.
Own the name for this category.
agentscim.com is for sale. If you build identity, security or agent tooling, write to me. Serious offers get a reply within 24 hours.
Make an offer