User Provisioning Field Requirements and Formatting Rules
This article describes the formatting requirements for each field Verkada accepts via SCIM and other integrations for user provisioning. Use it to verify your values are valid before enabling the sync. For step-by-step attribute mapping instructions specific to your identity provider, see:
Google Workspace — supports a subset of the fields below: email, first and last name, department, department ID, employee ID, employee title, and phone number
Field requirements
The table below covers every field Verkada accepts. Fields marked Required must be present on every user creation request.
Email address (username)
userName
Core
Yes
Valid email address. Maximum 255 characters.
First name
name.givenName
Core
Yes
Supports letters, numbers, spaces, & ' - . , ( ) /. Maximum 100 characters.
Last name
name.familyName
Core
Yes
Supports letters, numbers, spaces, & ' - . , ( ) /. Maximum 100 characters.
Middle name
name.middleName
Core
No
Maximum 255 characters.
Work phone*
phoneNumbers
Core
No
E.164 format with a country code (e.g., +14155552671) is required for reliable verification. Maximum 32 characters.
External ID
externalId
Verkada
No
Supports letters, numbers, _ @ - . +. Maximum 128 characters.
Employee title
title
Core
No
Maximum 255 characters.
Department
department
Enterprise
No
Maximum 255 characters.
Company name
organization
Enterprise
No
Maximum 255 characters.
Employee ID
employeeNumber
Enterprise
No
Maximum 255 characters.
Department ID
costCenter
Enterprise
No
Maximum 255 characters.
Active status
active
Core
No
Supports true or false
Schema types
Core: urn:ietf:params:scim:schemas:core:2.0:User
Verkada extension: urn:ietf:params:scim:schemas:extension:verkada:core:2.0:User
Enterprise extension: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
The phone attribute syntax differs by identity provider.
Okta:
phoneNumbers.^[type==work].valueEntra ID:
phoneNumbers[type eq "work"].value
Verkada also accepts a phone number marked primary: true as the work phone, even if the type isn't explicitly set.
Access card credentials (Verkada Access extension)
If your organization uses Verkada Access, you can provision access card credentials via SCIM using the custom Verkada access extension: urn:ietf:params:scim:schemas:extension:verkada:access:2.0:User
Card format
cardFormat
Verkada access
Must match a format supported by your hardware (e.g., "Standard 26-bit Wiegand", "HID 37-bit", etc.)
Card number
cardNumber
Verkada access
Integer; must fit within the bit range defined by the card format
Card number (hex)
cardNumberHex
Verkada access
Hex string; must fit within the bit range defined by the card format
Facility code
facilityCode
Verkada access
Integer; must fit within the bit range defined by the card format; required only for formats that use one
Credential status
credentialStatus
Verkada access
active, deactivated, deleted
Resolve common user provisioning errors
"User with this email domain cannot be managed"
The user's email domain is not in your identity provider's allowed list.
Add the domain in Command under Organization Settings > Login & Access.
"Invalid argument: name does not conform to valid name constraints"
First or last name contains a disallowed character.
Update the name in your directory, or adjust your attribute mapping to strip the character.
"Invalid argument: invalid characters in external ID, Alphanumeric, @, -, +, and . only"
External ID contains a space or unsupported symbol.
Use only letters, numbers, _ @ - . +.
"Invalid argument: external ID is too long, max length is 128 characters"
External ID exceeds 128 characters.
Shorten the value or use a different attribute.
"Invalid phone number, too long"
Phone number string exceeds 32 characters.
Remove formatting characters or shorten the value in your mapping.
"Unsupported operations on fields: [...]. Unmap these in your IdP to fix this error."
Your identity provider is syncing a field that Verkada does not support.
Remove the listed fields from your IdP's attribute mapping.
"User already exists: {email}"
A user with this email is already managed by this SCIM provider.
No action needed.
"User cannot be managed {email}"
The user is managed by a different SCIM provider in the same organization.
Check whether another SCIM integration is active.
"User with external id {id} already exists"
Another user in your organization already has this external ID.
External IDs must be unique per organization. Check for duplicate values in your directory.
Last updated
Was this helpful?