--- title: Medium | daily.dev description: A step-by-step Python tutorial shows how to automate user access auditing for Oracle EPM Cloud environments by querying the OCI Identity Domain's SCIM API (RFC... canonical: https://daily.dev/posts/medium-vgjnvyid6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Medium | daily.dev og:description: A step-by-step Python tutorial shows how to automate user access auditing for Oracle EPM Cloud environments by querying the OCI Identity Domain's SCIM API (RFC... og:url: https://daily.dev/posts/medium-vgjnvyid6 og:image: https://api.daily.dev/og/posts/VGJnvYid6.png og:image:alt: Medium og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Medium **[Medium](https://daily.dev/sources/medium_js)** · 7 min read · 0 upvotes · 0 comments ## Summary A step-by-step Python tutorial shows how to automate user access auditing for Oracle EPM Cloud environments by querying the OCI Identity Domain's SCIM API (RFC 7644). The script pulls users, applications, and app roles, cross-references role memberships with user details, and exports a formatted Excel access matrix. Applied to a production deployment with 63 EPM environments and 600+ users, the automation generated the full matrix in under 4 minutes, replacing a manual process that previously took days. Includes use cases like SOX compliance, offboarding verification, and role rationalization, plus a production checklist covering credential handling, pagination, and filtering. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I use the OCI Identity Domain SCIM API to list all EPM Cloud application roles for a user? Query the SCIM AppRoles endpoint filtered by app.value equal to the application id, then call the AppRoles/{role_id}/members endpoint for each role to retrieve assigned users. Combine results across all EPM Cloud applications (filtered via displayName co "EPM") to build a full user by application by role matrix, exporting it with openpyxl for audit reporting. _daily.dev surfaces practical SCIM and identity API patterns for teams automating access audits._ ### How do you authenticate to the Oracle OCI Identity Domain SCIM API from Python? Use HTTP Basic Authentication with an Identity Domain administrator account: base64-encode the username and password as user:pass and send it in an Authorization header formatted as Basic . Credentials should be loaded from environment variables rather than hardcoded, and the SCIM API follows the RFC 7644 standard with paginated JSON responses. _Developers scripting cloud identity integrations track authentication patterns like this on daily.dev._ ### How long does it take to generate a full access audit report for a large Oracle EPM Cloud deployment? A Python script using the SCIM API generated a complete user by application by role access matrix for 63 EPM Cloud environments and over 600 users in under 4 minutes, exporting the result as a formatted Excel file. This replaced a manual audit process that previously took days for the security and audit team. _daily.dev helps engineers building automated compliance and audit tooling compare real-world results._ ## Similar posts on daily.dev - [Take User Provisioning to the Next Level with Entitlements](https://daily.dev/posts/take-user-provisioning-to-the-next-level-with-entitlements-s5lfpp0wu) · Okta Dev · 0 upvotes · 0 comments - [Introducing SCIM Provisioning in ClickHouse Cloud](https://daily.dev/posts/introducing-scim-provisioning-in-clickhouse-cloud-v7p5ki86z) · ClickHouse · 0 upvotes · 0 comments - [Governing AI in Oracle ERP Cloud: Turning Copilots into Controlled Identities](https://daily.dev/posts/governing-ai-in-oracle-erp-cloud-turning-copilots-into-controlled-identities-cqxkwlx8v) · Security Boulevard · 0 upvotes · 0 comments - [Automate DevCraft Subscriptions Management for Teams: SCIM](https://daily.dev/posts/automate-devcraft-subscriptions-management-for-teams-scim-tkdaqrniw) · Telerik · 0 upvotes · 0 comments - [Top SCIM Providers for B2B SaaS Apps: Automated User Provisioning Platforms](https://daily.dev/posts/top-scim-providers-for-b2b-saas-apps-automated-user-provisioning-platforms-t30icixjk) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#python](https://daily.dev/tags/python), [#oracle](https://daily.dev/tags/oracle) [View this post on daily.dev](https://daily.dev/posts/medium-vgjnvyid6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Medium","url":"https://daily.dev/posts/medium-vgjnvyid6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/medium-vgjnvyid6"},"datePublished":"2026-08-15T02:57:05.398Z","dateModified":"2026-09-13T19:56:33.049Z","description":"A step-by-step Python tutorial shows how to automate user access auditing for Oracle EPM Cloud environments by querying the OCI Identity Domain's SCIM API (RFC...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6ab0a9a223ee01bc82d647f54feb2d2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6ab0a9a223ee01bc82d647f54feb2d2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/medium-vgjnvyid6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,python,oracle","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Medium"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/medium-vgjnvyid6#faq","mainEntity":[{"@type":"Question","name":"How can I use the OCI Identity Domain SCIM API to list all EPM Cloud application roles for a user?","acceptedAnswer":{"@type":"Answer","text":"Query the SCIM AppRoles endpoint filtered by app.value equal to the application id, then call the AppRoles/{role_id}/members endpoint for each role to retrieve assigned users. Combine results across all EPM Cloud applications (filtered via displayName co \"EPM\") to build a full user by application by role matrix, exporting it with openpyxl for audit reporting. daily.dev surfaces practical SCIM and identity API patterns for teams automating access audits."}},{"@type":"Question","name":"How do you authenticate to the Oracle OCI Identity Domain SCIM API from Python?","acceptedAnswer":{"@type":"Answer","text":"Use HTTP Basic Authentication with an Identity Domain administrator account: base64-encode the username and password as user:pass and send it in an Authorization header formatted as Basic . Credentials should be loaded from environment variables rather than hardcoded, and the SCIM API follows the RFC 7644 standard with paginated JSON responses. Developers scripting cloud identity integrations track authentication patterns like this on daily.dev."}},{"@type":"Question","name":"How long does it take to generate a full access audit report for a large Oracle EPM Cloud deployment?","acceptedAnswer":{"@type":"Answer","text":"A Python script using the SCIM API generated a complete user by application by role access matrix for 63 EPM Cloud environments and over 600 users in under 4 minutes, exporting the result as a formatted Excel file. This replaced a manual audit process that previously took days for the security and audit team. daily.dev helps engineers building automated compliance and audit tooling compare real-world results."}}]} ```