Summary

  • RFC 9865 standardizes a SCIM cursor as an opaque continuation value for the same query, endpoint and bounded sequence of result pages.
  • The specification requires authorization to be checked as each page is traversed: holding a cursor adds no resource right, even if someone else originally received it.

A paginated identity feed can look deceptively settled. The first page names a filter, the response emits a nextCursor, and the next call resumes the list. That is a valuable protocol improvement for a service whose underlying database or API already works with cursors. It is not a transfer of standing. A continuation is about where to resume looking; an authorization decision is about what the actor may see when the service answers now.

RFC 9865 keeps the mechanics precise. The first cursor-paginated request sends an empty or omitted cursor. A later request uses the same service-provider endpoint and the same parameters and values, changing only that cursor to a value returned by the service. The cursor is opaque to the client. nextCursor belongs on every paged response except the last; its absence signals that no further result page remains. An optional previousCursor can support reverse traversal. These are coordination rules for a single query conversation, not a description of a durable collection or a credential exchange.

Even the page size says less than a dashboard might suggest. count is a requested maximum: the provider must not exceed it, but may return fewer resources. A zero count asks for no resources other than totalResults; and a provider unable to estimate totalResults may omit it. A client therefore cannot convert a number on an early page into proof that it has seen all identities, or that the population will remain unchanged. The RFC permits cursor pagination as the only available approach; where index and cursor methods coexist, the provider must choose a default and can advertise the choice through its configuration resource.

The more important restraint is security. RFC 9865 says pagination must remain confined to data that the actor’s current identity is authorized to access. That applies even when the actor has obtained a cursor generated for someone else. Authorization checks must continue while the actor moves through the result set, and cursor possession must not be treated as supplementary access. This is not a decorative warning. It means a pagination implementation must avoid turning a convenient state handle into a bypass around the very policy that decides whether a resource is visible.

Permission changes sharpen the point. When possible, a service provider should invalidate a person’s cursors immediately after permissions change. If it retains them, result-set metadata such as counts must be updated to reflect the new scope. The relevant fact is not that an old cursor exists, or even that it returns a response. The relevant fact is what the service authorizes at the moment of the continuation, and whether the response avoids disclosing why a result is unavailable. RFC 9865 also asks providers to make forged cursors detectable and to avoid error distinctions that reveal sensitive data.

There is a competing operational constraint: a service that stores too much data per cursor can be made to exhaust its own resources. The RFC recommends authentication for large sets, rate limiting, a ceiling on outstanding cursors or page size, and resource-efficient invalidation. None of those controls is evidence that a particular deployment has chosen a suitable limit. The configuration record may omit its defaults, maximum page size or timeout; absence of those published values must not be read as absence of limits.

Heng Lu’s distinction between a common artifact and a local decision is especially useful here. RFC 9865 supplies a small, testable coordination surface: how a client asks to continue and how a server represents the next step. It leaves the material authority where it belongs — in current identity evaluation, local policy, implementation, operations and an application’s later use of the returned data. The cursor is useful precisely because its scope is not quietly enlarged into a right.

Sources