1. Introduction and Overview

RFC 9967 defines SCIM Security Events using Security Event Tokens (SETs), enabling asynchronous message exchange between SCIM service providers and Event Receivers. It updates RFC 7643 by adding ServiceProviderConfig attributes and updates RFC 7644 with an optional asynchronous SCIM request capability.

SCIM Events can carry asynchronous request completion, resource replication, and coordinated provisioning notifications. A SET describes a state change at a SCIM service provider; receivers interpret it in their own local context rather than treating it as a command.

BCP 14 keywords apply only when written in all capitals. In JWT/SET contexts, IANA-registered token values remain called claims, while event-payload information is referred to as attributes.