> For the complete documentation index, see [llms.txt](https://help.verkada.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.verkada.com/command/security/identity-providers/user-provisioning-field-requirements-and-formatting-rules.md).

# User Provisioning Field Requirements and Formatting Rules

This article describes the formatting requirements for each field Verkada accepts via SCIM and other integrations for user provisioning. Use it to verify your values are valid before enabling the sync. For step-by-step attribute mapping instructions specific to your identity provider, see:

* [Okta](/command/security/identity-providers/okta.md#user-provisioning)
* [Microsoft Entra ID](/command/security/identity-providers/microsoft-entra-id.md#user-provisioning)
* [Google Workspace](/command/security/identity-providers/google-workspace.md#user-provisioning) — supports a subset of the fields below: email, first and last name, department, department ID, employee ID, employee title, and phone number

***

## Field requirements <a href="#field-requirements" id="field-requirements"></a>

The table below covers every field Verkada accepts. Fields marked **Required** must be present on every user creation request.

<table><thead><tr><th width="169.14453125">Field</th><th width="174.45703125">SCIM Attribute</th><th>Schema</th><th width="114.83984375">Required</th><th>Allowed characters</th></tr></thead><tbody><tr><td>Email address (username)</td><td><code>userName</code></td><td>Core</td><td>Yes</td><td>Valid email address. Maximum 255 characters.</td></tr><tr><td>First name</td><td><code>name.givenName</code></td><td>Core</td><td>Yes</td><td>Supports letters, numbers, spaces, <code>&#x26;</code> <code>'</code> <code>-</code> <code>.</code> <code>,</code> <code>(</code> <code>)</code> <code>/</code> <code>@</code>. Maximum 100 characters.</td></tr><tr><td>Last name</td><td><code>name.familyName</code></td><td>Core</td><td>Yes</td><td>Supports letters, numbers, spaces, <code>&#x26;</code> <code>'</code> <code>-</code> <code>.</code> <code>,</code> <code>(</code> <code>)</code> <code>/</code> <code>@</code>. Maximum 100 characters.</td></tr><tr><td>Middle name</td><td><code>name.middleName</code></td><td>Core</td><td>No</td><td>Maximum 255 characters.</td></tr><tr><td>Work phone*</td><td><code>phoneNumbers</code></td><td>Core</td><td>No</td><td>E.164 format with a country code (e.g., +14155552671) is required for reliable verification. Maximum 32 characters.</td></tr><tr><td>External ID</td><td><code>externalId</code></td><td>Verkada</td><td>No</td><td>Supports letters, numbers, <code>_</code> <code>@</code> <code>-</code> <code>.</code> <code>+</code>. Maximum 128 characters.</td></tr><tr><td>Employee title</td><td><code>title</code></td><td>Core</td><td>No</td><td>Maximum 255 characters.</td></tr><tr><td>Department</td><td><code>department</code></td><td>Enterprise</td><td>No</td><td>Maximum 255 characters.</td></tr><tr><td>Company name</td><td><code>organization</code></td><td>Enterprise</td><td>No</td><td>Maximum 255 characters.</td></tr><tr><td>Employee ID</td><td><code>employeeNumber</code></td><td>Enterprise</td><td>No</td><td>Maximum 255 characters.</td></tr><tr><td>Department ID</td><td><code>costCenter</code></td><td>Enterprise</td><td>No</td><td>Maximum 255 characters.</td></tr><tr><td>Active status</td><td><code>active</code></td><td>Core</td><td>No</td><td>Supports <code>true</code> or <code>false</code></td></tr></tbody></table>

#### Schema types

**Core:** `urn:ietf:params:scim:schemas:core:2.0:User`

**Verkada extension:** `urn:ietf:params:scim:schemas:extension:verkada:core:2.0:User`

**Enterprise extension:** `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`

{% hint style="warning" %}
The phone attribute syntax differs by identity provider.

* Okta: `phoneNumbers.^[type==work].value`
* Entra ID: `phoneNumbers[type eq "work"].value`

Verkada also accepts a phone number marked `primary: true` as the work phone, even if the `type` isn't explicitly set.
{% endhint %}

***

## Access card credentials (Verkada Access extension) <a href="#access-card-credentials-verkada-access-extension" id="access-card-credentials-verkada-access-extension"></a>

If your organization uses Verkada Access, you can provision access card credentials via SCIM using the custom **Verkada access extension:** `urn:ietf:params:scim:schemas:extension:verkada:access:2.0:User`

| Field             | SCIM Attribute     | Schema         | Notes                                                                                                     |
| ----------------- | ------------------ | -------------- | --------------------------------------------------------------------------------------------------------- |
| Card format       | `cardFormat`       | Verkada access | Must match a format supported by your hardware (e.g., `"Standard 26-bit Wiegand"`, `"HID 37-bit"`, etc.)  |
| Card number       | `cardNumber`       | Verkada access | Integer; must fit within the bit range defined by the card format                                         |
| Card number (hex) | `cardNumberHex`    | Verkada access | Hex string; must fit within the bit range defined by the card format                                      |
| Facility code     | `facilityCode`     | Verkada access | Integer; must fit within the bit range defined by the card format; required only for formats that use one |
| Credential status | `credentialStatus` | Verkada access | `active`, `deactivated`, `deleted`                                                                        |

***

## Resolve common user provisioning errors

| Error message                                                                              | Cause                                                                      | Fix                                                                                         |
| ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| *"User with this email domain cannot be managed"*                                          | The user's email domain is not in your identity provider's allowed list.   | Add the domain in Command under Organization Settings > Login & Access.                     |
| *"Invalid argument: name does not conform to valid name constraints"*                      | First or last name contains a disallowed character.                        | Update the name in your directory, or adjust your attribute mapping to strip the character. |
| *"Invalid argument: invalid characters in external ID, Alphanumeric, @, -, +, and . only"* | External ID contains a space or unsupported symbol.                        | Use only letters, numbers, `_` `@` `-` `.` `+`.                                             |
| *"Invalid argument: external ID is too long, max length is 128 characters"*                | External ID exceeds 128 characters.                                        | Shorten the value or use a different attribute.                                             |
| *"Invalid phone number, too long"*                                                         | Phone number string exceeds 32 characters.                                 | Remove formatting characters or shorten the value in your mapping.                          |
| *"Unsupported operations on fields: \[...]. Unmap these in your IdP to fix this error."*   | Your identity provider is syncing a field that Verkada does not support.   | Remove the listed fields from your IdP's attribute mapping.                                 |
| *"User already exists: {email}"*                                                           | A user with this email is already managed by this SCIM provider.           | No action needed.                                                                           |
| *"User cannot be managed {email}"*                                                         | The user is managed by a different SCIM provider in the same organization. | Check whether another SCIM integration is active.                                           |
| *"User with external id {id} already exists"*                                              | Another user in your organization already has this external ID.            | External IDs must be unique per organization. Check for duplicate values in your directory. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.verkada.com/command/security/identity-providers/user-provisioning-field-requirements-and-formatting-rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.