published on Monday, Jun 29, 2026 by Zscaler
published on Monday, Jun 29, 2026 by Zscaler
Use the zpa_scim_attribute_header data source to get information about a SCIM attribute from an Identity Provider (IdP). This data source can then be referenced in an Access Policy, Timeout policy, Forwarding Policy, Inspection Policy or Inspection Policy.
NOTE: To ensure consistent search results across data sources, please avoid using multiple spaces or special characters in your search queries.
Example Usage
Basic Usage
import * as pulumi from "@pulumi/pulumi";
import * as zpa from "@bdzscaler/pulumi-zpa";
// ZPA SCIM Attribute Header Data Source
const givenName = zpa.getSCIMAttributeHeader({
name: "name.givenName",
idpName: "IdP_Name",
});
const familyName = zpa.getSCIMAttributeHeader({
name: "name.familyName",
idpName: "IdP_Name",
});
import pulumi
import pulumi_zpa as zpa
# ZPA SCIM Attribute Header Data Source
given_name = zpa.get_scim_attribute_header(name="name.givenName",
idp_name="IdP_Name")
family_name = zpa.get_scim_attribute_header(name="name.familyName",
idp_name="IdP_Name")
package main
import (
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
"github.com/zscaler/pulumi-zpa/sdk/go/zpa"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// ZPA SCIM Attribute Header Data Source
_, err := zpa.GetSCIMAttributeHeader(ctx, &zpa.GetSCIMAttributeHeaderArgs{
Name: pulumi.StringRef("name.givenName"),
IdpName: pulumi.StringRef("IdP_Name"),
}, nil)
if err != nil {
return err
}
_, err = zpa.GetSCIMAttributeHeader(ctx, &zpa.GetSCIMAttributeHeaderArgs{
Name: pulumi.StringRef("name.familyName"),
IdpName: pulumi.StringRef("IdP_Name"),
}, nil)
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Zpa = zscaler.PulumiPackage.Zpa;
return await Deployment.RunAsync(() =>
{
// ZPA SCIM Attribute Header Data Source
var givenName = Zpa.GetSCIMAttributeHeader.Invoke(new()
{
Name = "name.givenName",
IdpName = "IdP_Name",
});
var familyName = Zpa.GetSCIMAttributeHeader.Invoke(new()
{
Name = "name.familyName",
IdpName = "IdP_Name",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.zpa.ZpaFunctions;
import com.pulumi.zpa.inputs.GetSCIMAttributeHeaderArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// ZPA SCIM Attribute Header Data Source
final var givenName = ZpaFunctions.getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs.builder()
.name("name.givenName")
.idpName("IdP_Name")
.build());
final var familyName = ZpaFunctions.getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs.builder()
.name("name.familyName")
.idpName("IdP_Name")
.build());
}
}
variables:
# ZPA SCIM Attribute Header Data Source
givenName:
fn::invoke:
function: zpa:getSCIMAttributeHeader
arguments:
name: name.givenName
idpName: IdP_Name
familyName:
fn::invoke:
function: zpa:getSCIMAttributeHeader
arguments:
name: name.familyName
idpName: IdP_Name
pulumi {
required_providers {
zpa = {
source = "pulumi/zpa"
}
}
}
data "zpa_getscimattributeheader" "givenName" {
name = "name.givenName"
idp_name = "IdP_Name"
}
data "zpa_getscimattributeheader" "familyName" {
name = "name.familyName"
idp_name = "IdP_Name"
}
# ZPA SCIM Attribute Header Data Source
Using SCIM Attributes in Policy Rules
import * as pulumi from "@pulumi/pulumi";
import * as zpa from "@bdzscaler/pulumi-zpa";
// Fetch SCIM attribute header
const displayName = zpa.getSCIMAttributeHeader({
name: "DisplayName",
idpName: "IdP_Name",
});
export const displayNameValues = displayName.then(displayName => displayName.values);
// Use in policy access rule
const scimRule = new zpa.PolicyAccessRule("scim_rule", {
name: "SCIM-based Access Rule",
description: "Allow access based on SCIM DisplayName attribute",
action: "ALLOW",
operator: "AND",
conditions: [{
operator: "OR",
operands: [{
objectType: "SCIM",
idpId: displayName.then(displayName => displayName.idpId),
lhs: displayName.then(displayName => displayName.id),
rhs: "John Smith",
}],
}],
});
import pulumi
import pulumi_zpa as zpa
import zscaler_pulumi_zpa as zpa
# Fetch SCIM attribute header
display_name = zpa.get_scim_attribute_header(name="DisplayName",
idp_name="IdP_Name")
pulumi.export("displayNameValues", display_name.values)
# Use in policy access rule
scim_rule = zpa.PolicyAccessRule("scim_rule",
name="SCIM-based Access Rule",
description="Allow access based on SCIM DisplayName attribute",
action="ALLOW",
operator="AND",
conditions=[{
"operator": "OR",
"operands": [{
"object_type": "SCIM",
"idp_id": display_name.idp_id,
"lhs": display_name.id,
"rhs": "John Smith",
}],
}])
package main
import (
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
"github.com/zscaler/pulumi-zpa/sdk/go/zpa"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Fetch SCIM attribute header
displayName, err := zpa.GetSCIMAttributeHeader(ctx, &zpa.GetSCIMAttributeHeaderArgs{
Name: pulumi.StringRef("DisplayName"),
IdpName: pulumi.StringRef("IdP_Name"),
}, nil)
if err != nil {
return err
}
ctx.Export("displayNameValues", displayName.Values)
// Use in policy access rule
_, err = zpa.NewPolicyAccessRule(ctx, "scim_rule", &zpa.PolicyAccessRuleArgs{
Name: pulumi.String("SCIM-based Access Rule"),
Description: pulumi.String("Allow access based on SCIM DisplayName attribute"),
Action: pulumi.String("ALLOW"),
Operator: pulumi.String("AND"),
Conditions: zpa.PolicyAccessRuleConditionArray{
&zpa.PolicyAccessRuleConditionArgs{
Operator: pulumi.String("OR"),
Operands: zpa.PolicyAccessRuleConditionOperandArray{
&zpa.PolicyAccessRuleConditionOperandArgs{
ObjectType: pulumi.String("SCIM"),
IdpId: pulumi.String(displayName.IdpId),
Lhs: pulumi.String(displayName.Id),
Rhs: pulumi.String("John Smith"),
},
},
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Zpa = zscaler.PulumiPackage.Zpa;
return await Deployment.RunAsync(() =>
{
// Fetch SCIM attribute header
var displayName = Zpa.GetSCIMAttributeHeader.Invoke(new()
{
Name = "DisplayName",
IdpName = "IdP_Name",
});
// Use in policy access rule
var scimRule = new Zpa.PolicyAccessRule("scim_rule", new()
{
Name = "SCIM-based Access Rule",
Description = "Allow access based on SCIM DisplayName attribute",
Action = "ALLOW",
Operator = "AND",
Conditions = new[]
{
new Zpa.Inputs.PolicyAccessRuleConditionArgs
{
Operator = "OR",
Operands = new[]
{
new Zpa.Inputs.PolicyAccessRuleConditionOperandArgs
{
ObjectType = "SCIM",
IdpId = displayName.Apply(getSCIMAttributeHeaderResult => getSCIMAttributeHeaderResult.IdpId),
Lhs = displayName.Apply(getSCIMAttributeHeaderResult => getSCIMAttributeHeaderResult.Id),
Rhs = "John Smith",
},
},
},
},
});
return new Dictionary<string, object?>
{
["displayNameValues"] = displayName.Apply(getSCIMAttributeHeaderResult => getSCIMAttributeHeaderResult.Values),
};
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.zpa.ZpaFunctions;
import com.pulumi.zpa.inputs.GetSCIMAttributeHeaderArgs;
import com.pulumi.zpa.PolicyAccessRule;
import com.pulumi.zpa.PolicyAccessRuleArgs;
import com.pulumi.zpa.inputs.PolicyAccessRuleConditionArgs;
import com.pulumi.zpa.inputs.PolicyAccessRuleConditionOperandArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// Fetch SCIM attribute header
final var displayName = ZpaFunctions.getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs.builder()
.name("DisplayName")
.idpName("IdP_Name")
.build());
ctx.export("displayNameValues", displayName.values());
// Use in policy access rule
var scimRule = new PolicyAccessRule("scimRule", PolicyAccessRuleArgs.builder()
.name("SCIM-based Access Rule")
.description("Allow access based on SCIM DisplayName attribute")
.action("ALLOW")
.operator("AND")
.conditions(PolicyAccessRuleConditionArgs.builder()
.operator("OR")
.operands(PolicyAccessRuleConditionOperandArgs.builder()
.objectType("SCIM")
.idpId(displayName.idpId())
.lhs(displayName.id())
.rhs("John Smith")
.build())
.build())
.build());
}
}
resources:
# Use in policy access rule
scimRule:
type: zpa:PolicyAccessRule
name: scim_rule
properties:
name: SCIM-based Access Rule
description: Allow access based on SCIM DisplayName attribute
action: ALLOW
operator: AND
conditions:
- operator: OR
operands:
- objectType: SCIM
idpId: ${displayName.idpId}
lhs: ${displayName.id}
rhs: John Smith
variables:
# Fetch SCIM attribute header
displayName:
fn::invoke:
function: zpa:getSCIMAttributeHeader
arguments:
name: DisplayName
idpName: IdP_Name
outputs:
# Output available values (optional, useful for debugging)
displayNameValues: ${displayName.values}
pulumi {
required_providers {
zpa = {
source = "pulumi/zpa"
}
}
}
data "zpa_getscimattributeheader" "displayName" {
name = "DisplayName"
idp_name = "IdP_Name"
}
# Use in policy access rule
resource "zpa_policyaccessrule" "scim_rule" {
name = "SCIM-based Access Rule"
description = "Allow access based on SCIM DisplayName attribute"
action = "ALLOW"
operator = "AND"
conditions {
operator = "OR"
operands {
object_type = "SCIM"
idp_id = data.zpa_getscimattributeheader.displayName.idp_id
lhs = data.zpa_getscimattributeheader.displayName.id
rhs = "John Smith"
}
}
}
# Fetch SCIM attribute header
# Output available values (optional, useful for debugging)
output "displayNameValues" {
value = data.zpa_getscimattributeheader.displayName.values
}
Note: When using SCIM attributes in policy rules, the rhs value must exactly match one of the values available in the values attribute. Use the output to see all available values for the SCIM attribute.
Using getSCIMAttributeHeader
Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.
function getSCIMAttributeHeader(args: GetSCIMAttributeHeaderArgs, opts?: InvokeOptions): Promise<GetSCIMAttributeHeaderResult>
function getSCIMAttributeHeaderOutput(args: GetSCIMAttributeHeaderOutputArgs, opts?: InvokeOptions): Output<GetSCIMAttributeHeaderResult>def get_scim_attribute_header(id: Optional[str] = None,
idp_id: Optional[str] = None,
idp_name: Optional[str] = None,
name: Optional[str] = None,
opts: Optional[InvokeOptions] = None) -> GetSCIMAttributeHeaderResult
def get_scim_attribute_header_output(id: pulumi.Input[Optional[str]] = None,
idp_id: pulumi.Input[Optional[str]] = None,
idp_name: pulumi.Input[Optional[str]] = None,
name: pulumi.Input[Optional[str]] = None,
opts: Optional[InvokeOptions] = None) -> Output[GetSCIMAttributeHeaderResult]func GetSCIMAttributeHeader(ctx *Context, args *GetSCIMAttributeHeaderArgs, opts ...InvokeOption) (*GetSCIMAttributeHeaderResult, error)
func GetSCIMAttributeHeaderOutput(ctx *Context, args *GetSCIMAttributeHeaderOutputArgs, opts ...InvokeOption) GetSCIMAttributeHeaderResultOutput> Note: This function is named GetSCIMAttributeHeader in the Go SDK.
public static class GetSCIMAttributeHeader
{
public static Task<GetSCIMAttributeHeaderResult> InvokeAsync(GetSCIMAttributeHeaderArgs args, InvokeOptions? opts = null)
public static Output<GetSCIMAttributeHeaderResult> Invoke(GetSCIMAttributeHeaderInvokeArgs args, InvokeOptions? opts = null)
}public static CompletableFuture<GetSCIMAttributeHeaderResult> getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs args, InvokeOptions options)
public static Output<GetSCIMAttributeHeaderResult> getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs args, InvokeOptions options)
fn::invoke:
function: zpa:index/getSCIMAttributeHeader:getSCIMAttributeHeader
arguments:
# arguments dictionarydata "zpa_getscimattributeheader" "name" {
# arguments
}The following arguments are supported:
getSCIMAttributeHeader Result
The following output properties are available:
- Canonical
Values List<string> - Case
Sensitive bool - Creation
Time string - Data
Type string - Description string
- Modified
Time string - Modifiedby string
- Multivalued bool
- Mutability string
- Required bool
- Returned string
- Schema
Uri string - Uniqueness bool
- Values List<string>
- Id string
- Idp
Id string - Idp
Name string - Name string
- Canonical
Values []string - Case
Sensitive bool - Creation
Time string - Data
Type string - Description string
- Modified
Time string - Modifiedby string
- Multivalued bool
- Mutability string
- Required bool
- Returned string
- Schema
Uri string - Uniqueness bool
- Values []string
- Id string
- Idp
Id string - Idp
Name string - Name string
- canonical_
values list(string) - case_
sensitive bool - creation_
time string - data_
type string - description string
- modified_
time string - modifiedby string
- multivalued bool
- mutability string
- required bool
- returned string
- schema_
uri string - uniqueness bool
- values list(string)
- id string
- idp_
id string - idp_
name string - name string
- canonical
Values List<String> - case
Sensitive Boolean - creation
Time String - data
Type String - description String
- modified
Time String - modifiedby String
- multivalued Boolean
- mutability String
- required Boolean
- returned String
- schema
Uri String - uniqueness Boolean
- values List<String>
- id String
- idp
Id String - idp
Name String - name String
- canonical
Values string[] - case
Sensitive boolean - creation
Time string - data
Type string - description string
- modified
Time string - modifiedby string
- multivalued boolean
- mutability string
- required boolean
- returned string
- schema
Uri string - uniqueness boolean
- values string[]
- id string
- idp
Id string - idp
Name string - name string
- canonical_
values Sequence[str] - case_
sensitive bool - creation_
time str - data_
type str - description str
- modified_
time str - modifiedby str
- multivalued bool
- mutability str
- required bool
- returned str
- schema_
uri str - uniqueness bool
- values Sequence[str]
- id str
- idp_
id str - idp_
name str - name str
- canonical
Values List<String> - case
Sensitive Boolean - creation
Time String - data
Type String - description String
- modified
Time String - modifiedby String
- multivalued Boolean
- mutability String
- required Boolean
- returned String
- schema
Uri String - uniqueness Boolean
- values List<String>
- id String
- idp
Id String - idp
Name String - name String
Package Details
- Repository
- zpa zscaler/pulumi-zpa
- License
- MIT
- Notes
- This Pulumi package is based on the
zpaTerraform Provider.
published on Monday, Jun 29, 2026 by Zscaler