1. Packages
  2. Packages
  3. Zscaler Private Access (ZPA)
  4. API Docs
  5. getSCIMAttributeHeader
Viewing docs for Zscaler Private Access v1.0.4
published on Monday, Jun 29, 2026 by Zscaler
zpa logo
Viewing docs for Zscaler Private Access v1.0.4
published on Monday, Jun 29, 2026 by Zscaler

    Use the zpa_scim_attribute_header data source to get information about a SCIM attribute from an Identity Provider (IdP). This data source can then be referenced in an Access Policy, Timeout policy, Forwarding Policy, Inspection Policy or Inspection Policy.

    NOTE: To ensure consistent search results across data sources, please avoid using multiple spaces or special characters in your search queries.

    Example Usage

    Basic Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as zpa from "@bdzscaler/pulumi-zpa";
    
    // ZPA SCIM Attribute Header Data Source
    const givenName = zpa.getSCIMAttributeHeader({
        name: "name.givenName",
        idpName: "IdP_Name",
    });
    const familyName = zpa.getSCIMAttributeHeader({
        name: "name.familyName",
        idpName: "IdP_Name",
    });
    
    import pulumi
    import pulumi_zpa as zpa
    
    # ZPA SCIM Attribute Header Data Source
    given_name = zpa.get_scim_attribute_header(name="name.givenName",
        idp_name="IdP_Name")
    family_name = zpa.get_scim_attribute_header(name="name.familyName",
        idp_name="IdP_Name")
    
    package main
    
    import (
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    	"github.com/zscaler/pulumi-zpa/sdk/go/zpa"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		// ZPA SCIM Attribute Header Data Source
    		_, err := zpa.GetSCIMAttributeHeader(ctx, &zpa.GetSCIMAttributeHeaderArgs{
    			Name:    pulumi.StringRef("name.givenName"),
    			IdpName: pulumi.StringRef("IdP_Name"),
    		}, nil)
    		if err != nil {
    			return err
    		}
    		_, err = zpa.GetSCIMAttributeHeader(ctx, &zpa.GetSCIMAttributeHeaderArgs{
    			Name:    pulumi.StringRef("name.familyName"),
    			IdpName: pulumi.StringRef("IdP_Name"),
    		}, nil)
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Zpa = zscaler.PulumiPackage.Zpa;
    
    return await Deployment.RunAsync(() => 
    {
        // ZPA SCIM Attribute Header Data Source
        var givenName = Zpa.GetSCIMAttributeHeader.Invoke(new()
        {
            Name = "name.givenName",
            IdpName = "IdP_Name",
        });
    
        var familyName = Zpa.GetSCIMAttributeHeader.Invoke(new()
        {
            Name = "name.familyName",
            IdpName = "IdP_Name",
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.zpa.ZpaFunctions;
    import com.pulumi.zpa.inputs.GetSCIMAttributeHeaderArgs;
    import java.util.ArrayList;
    import java.util.Arrays;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            // ZPA SCIM Attribute Header Data Source
            final var givenName = ZpaFunctions.getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs.builder()
                .name("name.givenName")
                .idpName("IdP_Name")
                .build());
    
            final var familyName = ZpaFunctions.getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs.builder()
                .name("name.familyName")
                .idpName("IdP_Name")
                .build());
    
        }
    }
    
    variables:
      # ZPA SCIM Attribute Header Data Source
      givenName:
        fn::invoke:
          function: zpa:getSCIMAttributeHeader
          arguments:
            name: name.givenName
            idpName: IdP_Name
      familyName:
        fn::invoke:
          function: zpa:getSCIMAttributeHeader
          arguments:
            name: name.familyName
            idpName: IdP_Name
    
    pulumi {
      required_providers {
        zpa = {
          source = "pulumi/zpa"
        }
      }
    }
    
    data "zpa_getscimattributeheader" "givenName" {
      name     = "name.givenName"
      idp_name = "IdP_Name"
    }
    data "zpa_getscimattributeheader" "familyName" {
      name     = "name.familyName"
      idp_name = "IdP_Name"
    }
    
    # ZPA SCIM Attribute Header Data Source
    

    Using SCIM Attributes in Policy Rules

    import * as pulumi from "@pulumi/pulumi";
    import * as zpa from "@bdzscaler/pulumi-zpa";
    
    // Fetch SCIM attribute header
    const displayName = zpa.getSCIMAttributeHeader({
        name: "DisplayName",
        idpName: "IdP_Name",
    });
    export const displayNameValues = displayName.then(displayName => displayName.values);
    // Use in policy access rule
    const scimRule = new zpa.PolicyAccessRule("scim_rule", {
        name: "SCIM-based Access Rule",
        description: "Allow access based on SCIM DisplayName attribute",
        action: "ALLOW",
        operator: "AND",
        conditions: [{
            operator: "OR",
            operands: [{
                objectType: "SCIM",
                idpId: displayName.then(displayName => displayName.idpId),
                lhs: displayName.then(displayName => displayName.id),
                rhs: "John Smith",
            }],
        }],
    });
    
    import pulumi
    import pulumi_zpa as zpa
    import zscaler_pulumi_zpa as zpa
    
    # Fetch SCIM attribute header
    display_name = zpa.get_scim_attribute_header(name="DisplayName",
        idp_name="IdP_Name")
    pulumi.export("displayNameValues", display_name.values)
    # Use in policy access rule
    scim_rule = zpa.PolicyAccessRule("scim_rule",
        name="SCIM-based Access Rule",
        description="Allow access based on SCIM DisplayName attribute",
        action="ALLOW",
        operator="AND",
        conditions=[{
            "operator": "OR",
            "operands": [{
                "object_type": "SCIM",
                "idp_id": display_name.idp_id,
                "lhs": display_name.id,
                "rhs": "John Smith",
            }],
        }])
    
    package main
    
    import (
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    	"github.com/zscaler/pulumi-zpa/sdk/go/zpa"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		// Fetch SCIM attribute header
    		displayName, err := zpa.GetSCIMAttributeHeader(ctx, &zpa.GetSCIMAttributeHeaderArgs{
    			Name:    pulumi.StringRef("DisplayName"),
    			IdpName: pulumi.StringRef("IdP_Name"),
    		}, nil)
    		if err != nil {
    			return err
    		}
    		ctx.Export("displayNameValues", displayName.Values)
    		// Use in policy access rule
    		_, err = zpa.NewPolicyAccessRule(ctx, "scim_rule", &zpa.PolicyAccessRuleArgs{
    			Name:        pulumi.String("SCIM-based Access Rule"),
    			Description: pulumi.String("Allow access based on SCIM DisplayName attribute"),
    			Action:      pulumi.String("ALLOW"),
    			Operator:    pulumi.String("AND"),
    			Conditions: zpa.PolicyAccessRuleConditionArray{
    				&zpa.PolicyAccessRuleConditionArgs{
    					Operator: pulumi.String("OR"),
    					Operands: zpa.PolicyAccessRuleConditionOperandArray{
    						&zpa.PolicyAccessRuleConditionOperandArgs{
    							ObjectType: pulumi.String("SCIM"),
    							IdpId:      pulumi.String(displayName.IdpId),
    							Lhs:        pulumi.String(displayName.Id),
    							Rhs:        pulumi.String("John Smith"),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Zpa = zscaler.PulumiPackage.Zpa;
    
    return await Deployment.RunAsync(() => 
    {
        // Fetch SCIM attribute header
        var displayName = Zpa.GetSCIMAttributeHeader.Invoke(new()
        {
            Name = "DisplayName",
            IdpName = "IdP_Name",
        });
    
        // Use in policy access rule
        var scimRule = new Zpa.PolicyAccessRule("scim_rule", new()
        {
            Name = "SCIM-based Access Rule",
            Description = "Allow access based on SCIM DisplayName attribute",
            Action = "ALLOW",
            Operator = "AND",
            Conditions = new[]
            {
                new Zpa.Inputs.PolicyAccessRuleConditionArgs
                {
                    Operator = "OR",
                    Operands = new[]
                    {
                        new Zpa.Inputs.PolicyAccessRuleConditionOperandArgs
                        {
                            ObjectType = "SCIM",
                            IdpId = displayName.Apply(getSCIMAttributeHeaderResult => getSCIMAttributeHeaderResult.IdpId),
                            Lhs = displayName.Apply(getSCIMAttributeHeaderResult => getSCIMAttributeHeaderResult.Id),
                            Rhs = "John Smith",
                        },
                    },
                },
            },
        });
    
        return new Dictionary<string, object?>
        {
            ["displayNameValues"] = displayName.Apply(getSCIMAttributeHeaderResult => getSCIMAttributeHeaderResult.Values),
        };
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.zpa.ZpaFunctions;
    import com.pulumi.zpa.inputs.GetSCIMAttributeHeaderArgs;
    import com.pulumi.zpa.PolicyAccessRule;
    import com.pulumi.zpa.PolicyAccessRuleArgs;
    import com.pulumi.zpa.inputs.PolicyAccessRuleConditionArgs;
    import com.pulumi.zpa.inputs.PolicyAccessRuleConditionOperandArgs;
    import java.util.ArrayList;
    import java.util.Arrays;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            // Fetch SCIM attribute header
            final var displayName = ZpaFunctions.getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs.builder()
                .name("DisplayName")
                .idpName("IdP_Name")
                .build());
    
            ctx.export("displayNameValues", displayName.values());
            // Use in policy access rule
            var scimRule = new PolicyAccessRule("scimRule", PolicyAccessRuleArgs.builder()
                .name("SCIM-based Access Rule")
                .description("Allow access based on SCIM DisplayName attribute")
                .action("ALLOW")
                .operator("AND")
                .conditions(PolicyAccessRuleConditionArgs.builder()
                    .operator("OR")
                    .operands(PolicyAccessRuleConditionOperandArgs.builder()
                        .objectType("SCIM")
                        .idpId(displayName.idpId())
                        .lhs(displayName.id())
                        .rhs("John Smith")
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      # Use in policy access rule
      scimRule:
        type: zpa:PolicyAccessRule
        name: scim_rule
        properties:
          name: SCIM-based Access Rule
          description: Allow access based on SCIM DisplayName attribute
          action: ALLOW
          operator: AND
          conditions:
            - operator: OR
              operands:
                - objectType: SCIM
                  idpId: ${displayName.idpId}
                  lhs: ${displayName.id}
                  rhs: John Smith
    variables:
      # Fetch SCIM attribute header
      displayName:
        fn::invoke:
          function: zpa:getSCIMAttributeHeader
          arguments:
            name: DisplayName
            idpName: IdP_Name
    outputs:
      # Output available values (optional, useful for debugging)
      displayNameValues: ${displayName.values}
    
    pulumi {
      required_providers {
        zpa = {
          source = "pulumi/zpa"
        }
      }
    }
    
    data "zpa_getscimattributeheader" "displayName" {
      name     = "DisplayName"
      idp_name = "IdP_Name"
    }
    
    # Use in policy access rule
    resource "zpa_policyaccessrule" "scim_rule" {
      name        = "SCIM-based Access Rule"
      description = "Allow access based on SCIM DisplayName attribute"
      action      = "ALLOW"
      operator    = "AND"
      conditions {
        operator = "OR"
        operands {
          object_type = "SCIM"
          idp_id      = data.zpa_getscimattributeheader.displayName.idp_id
          lhs         = data.zpa_getscimattributeheader.displayName.id
          rhs         = "John Smith"
        }
      }
    }
    # Fetch SCIM attribute header
    # Output available values (optional, useful for debugging)
    output "displayNameValues" {
      value = data.zpa_getscimattributeheader.displayName.values
    }
    

    Note: When using SCIM attributes in policy rules, the rhs value must exactly match one of the values available in the values attribute. Use the output to see all available values for the SCIM attribute.

    Using getSCIMAttributeHeader

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getSCIMAttributeHeader(args: GetSCIMAttributeHeaderArgs, opts?: InvokeOptions): Promise<GetSCIMAttributeHeaderResult>
    function getSCIMAttributeHeaderOutput(args: GetSCIMAttributeHeaderOutputArgs, opts?: InvokeOptions): Output<GetSCIMAttributeHeaderResult>
    def get_scim_attribute_header(id: Optional[str] = None,
                                  idp_id: Optional[str] = None,
                                  idp_name: Optional[str] = None,
                                  name: Optional[str] = None,
                                  opts: Optional[InvokeOptions] = None) -> GetSCIMAttributeHeaderResult
    def get_scim_attribute_header_output(id: pulumi.Input[Optional[str]] = None,
                                  idp_id: pulumi.Input[Optional[str]] = None,
                                  idp_name: pulumi.Input[Optional[str]] = None,
                                  name: pulumi.Input[Optional[str]] = None,
                                  opts: Optional[InvokeOptions] = None) -> Output[GetSCIMAttributeHeaderResult]
    func GetSCIMAttributeHeader(ctx *Context, args *GetSCIMAttributeHeaderArgs, opts ...InvokeOption) (*GetSCIMAttributeHeaderResult, error)
    func GetSCIMAttributeHeaderOutput(ctx *Context, args *GetSCIMAttributeHeaderOutputArgs, opts ...InvokeOption) GetSCIMAttributeHeaderResultOutput

    > Note: This function is named GetSCIMAttributeHeader in the Go SDK.

    public static class GetSCIMAttributeHeader 
    {
        public static Task<GetSCIMAttributeHeaderResult> InvokeAsync(GetSCIMAttributeHeaderArgs args, InvokeOptions? opts = null)
        public static Output<GetSCIMAttributeHeaderResult> Invoke(GetSCIMAttributeHeaderInvokeArgs args, InvokeOptions? opts = null)
    }
    public static CompletableFuture<GetSCIMAttributeHeaderResult> getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs args, InvokeOptions options)
    public static Output<GetSCIMAttributeHeaderResult> getSCIMAttributeHeader(GetSCIMAttributeHeaderArgs args, InvokeOptions options)
    
    fn::invoke:
      function: zpa:index/getSCIMAttributeHeader:getSCIMAttributeHeader
      arguments:
        # arguments dictionary
    data "zpa_getscimattributeheader" "name" {
        # arguments
    }

    The following arguments are supported:

    Id string
    IdpId string
    IdpName string
    Name string
    Id string
    IdpId string
    IdpName string
    Name string
    id string
    idp_id string
    idp_name string
    name string
    id String
    idpId String
    idpName String
    name String
    id string
    idpId string
    idpName string
    name string
    id str
    idp_id str
    idp_name str
    name str
    id String
    idpId String
    idpName String
    name String

    getSCIMAttributeHeader Result

    The following output properties are available:

    CanonicalValues List<string>
    CaseSensitive bool
    CreationTime string
    DataType string
    Description string
    ModifiedTime string
    Modifiedby string
    Multivalued bool
    Mutability string
    Required bool
    Returned string
    SchemaUri string
    Uniqueness bool
    Values List<string>
    Id string
    IdpId string
    IdpName string
    Name string
    CanonicalValues []string
    CaseSensitive bool
    CreationTime string
    DataType string
    Description string
    ModifiedTime string
    Modifiedby string
    Multivalued bool
    Mutability string
    Required bool
    Returned string
    SchemaUri string
    Uniqueness bool
    Values []string
    Id string
    IdpId string
    IdpName string
    Name string
    canonical_values list(string)
    case_sensitive bool
    creation_time string
    data_type string
    description string
    modified_time string
    modifiedby string
    multivalued bool
    mutability string
    required bool
    returned string
    schema_uri string
    uniqueness bool
    values list(string)
    id string
    idp_id string
    idp_name string
    name string
    canonicalValues List<String>
    caseSensitive Boolean
    creationTime String
    dataType String
    description String
    modifiedTime String
    modifiedby String
    multivalued Boolean
    mutability String
    required Boolean
    returned String
    schemaUri String
    uniqueness Boolean
    values List<String>
    id String
    idpId String
    idpName String
    name String
    canonicalValues string[]
    caseSensitive boolean
    creationTime string
    dataType string
    description string
    modifiedTime string
    modifiedby string
    multivalued boolean
    mutability string
    required boolean
    returned string
    schemaUri string
    uniqueness boolean
    values string[]
    id string
    idpId string
    idpName string
    name string
    canonicalValues List<String>
    caseSensitive Boolean
    creationTime String
    dataType String
    description String
    modifiedTime String
    modifiedby String
    multivalued Boolean
    mutability String
    required Boolean
    returned String
    schemaUri String
    uniqueness Boolean
    values List<String>
    id String
    idpId String
    idpName String
    name String

    Package Details

    Repository
    zpa zscaler/pulumi-zpa
    License
    MIT
    Notes
    This Pulumi package is based on the zpa Terraform Provider.
    zpa logo
    Viewing docs for Zscaler Private Access v1.0.4
    published on Monday, Jun 29, 2026 by Zscaler

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial