{
  "version": 3,
  "onboardingProfile": {
    "description": "Zero-access profile for first-time Helix SCIM onboarding; business access is assigned separately.",
    "isActive": true,
    "isSystem": false,
    "userType": "Standard"
  },
  "serviceProfile": {
    "description": "Dedicated least-privilege service profile for native SCIM provisioning.",
    "isActive": true,
    "isSystem": false,
    "userType": "Standard",
    "systemPermissions": [
      "ManageUsers"
    ],
    "objectPermissions": [
      {
        "object": "IdentitySyncDeactivationTicket",
        "read": true,
        "create": true,
        "edit": false,
        "delete": false,
        "viewAllRecords": false,
        "modifyAllRecords": false
      },
      {
        "object": "IdentitySyncSetting",
        "read": true,
        "create": false,
        "edit": false,
        "delete": false,
        "viewAllRecords": true,
        "modifyAllRecords": false
      },
      {
        "object": "Profile",
        "read": true,
        "create": false,
        "edit": false,
        "delete": false,
        "viewAllRecords": false,
        "modifyAllRecords": false
      },
      {
        "object": "User",
        "read": true,
        "create": true,
        "edit": true,
        "delete": false,
        "viewAllRecords": false,
        "modifyAllRecords": false
      }
    ],
    "fieldPermissions": [
      {
        "object": "IdentitySyncDeactivationTicket",
        "fields": [
          "Bucket",
          "Name",
          "Slot"
        ],
        "read": true,
        "edit": true
      },
      {
        "object": "IdentitySyncSetting",
        "fields": [
          "BreakerCooldownSeconds",
          "BreakerFailureThreshold",
          "DefaultProfileName",
          "EmailEncodingKey",
          "ExemptPrincipals",
          "LanguageLocaleKey",
          "LocaleSidKey",
          "Name",
          "ServiceProfileName",
          "ServiceUsername",
          "TimeZoneSidKey",
          "TokenTtlHours"
        ],
        "read": true,
        "edit": false
      },
      {
        "object": "Profile",
        "fields": [
          "Id",
          "Name"
        ],
        "read": true,
        "edit": false
      },
      {
        "object": "User",
        "fields": [
          "Id"
        ],
        "read": true,
        "edit": false
      },
      {
        "object": "User",
        "fields": [
          "Alias",
          "Department",
          "Email",
          "EmailEncodingKey",
          "FirstName",
          "IsActive",
          "LanguageLocaleKey",
          "LastName",
          "LocaleSidKey",
          "MobilePhone",
          "Phone",
          "ProfileId",
          "TimeZoneSidKey",
          "Title",
          "UserRoleId",
          "Username"
        ],
        "read": true,
        "edit": true
      }
    ],
    "denyUnlistedFieldsForObjects": [
      "IdentitySyncDeactivationTicket",
      "IdentitySyncSetting",
      "Profile",
      "User"
    ]
  },
  "serviceUser": {
    "lastName": "SCIM Provisioning",
    "alias": "scimprov",
    "isActive": true,
    "userRoleId": null
  },
  "singleton": {
    "name": "default",
    "defaultProfileName": "SCIM Zero Access",
    "serviceProfileName": "SCIM Provisioner",
    "serviceUsername": "scim-provisioning@scim.nexuscrm.invalid",
    "protectedProfileNames": [
      "System Administrator",
      "System Administrator (SF imported)"
    ],
    "breakerFailureThreshold": 5,
    "breakerCooldownSeconds": 300,
    "tokenTtlHours": 8760,
    "timeZoneSidKey": "UTC",
    "localeSidKey": "en_US",
    "emailEncodingKey": "UTF-8",
    "languageLocaleKey": "en_US"
  }
}