---
id: "gitlab_scim_token"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["secrets"]
langs: ["common"]
quality: 70
url: "https://registry.apicrafter.io/datatype/gitlab_scim_token"
---

# GitLab SCIM token (`gitlab_scim_token`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Token with which an identity provider provisions and deprovisions GitLab users and group members through the SCIM API. GitLab gives these tokens the prefix glsoat-, which cannot be configured. GitLab does not document the length; the regexp follows the gitleaks rule (20 characters after the prefix).

- Parent datatype: `access_token`
- Personal data (PII): no
- Categories: Secrets and credentials (passwords, keys, tokens) (secrets)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^glsoat-[A-Za-z0-9_-]{20}$
```

## Examples

- `glsoat-` (invalid example) — Prefix without the token

## Supported by tools

- `datadogsds`
- `gitguardian`
- `githubsecretscanning`
- `gitleaks`

## Sources

- doc: <https://docs.gitlab.com/security/tokens/>
- other: <https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml>

## Quality

Score 70/100. Missing: examples, mapping (Wikidata, Schema.org, ...), translation.

JSON: <https://registry.apicrafter.io/api/v1/datatypes/gitlab_scim_token.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/secrets/gitlab_scim_token.yaml>