I'm reading through [http://www.gluu.org/docs/admin-guide/SCIM/](http://www.gluu.org/docs/admin-guide/SCIM/) and [http://www.gluu.org/docs/admin-guide/uma/](http://www.gluu.org/docs/admin-guide/uma/), but I'm having trouble piecing it all together. [http://www.gluu.org/docs/admin-guide/SCIM/#access-management](http://www.gluu.org/docs/admin-guide/SCIM/#access-management) says I need a Bearer Token for SCIM API calls. Makes sense. But then it says: > How do you get one of these bearer tokens? You'll need to read up on the UMA protocol. Basically, the first time you call the SCIM API, oxTrust will return both a 403 error code, and permission ticket. Your UMA client will have to present this permission ticket to the oxAuth UMA Authorization API endpoints (the rpt_endpoint) to obtain a valid token. So I sent a ```GET https://<hostname>/identity/seam/resource/restv1/scim/v1/Users/``` and got back a 403 as expected. But I don't see anything that looks like a permission ticket for UMA: ``` HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 08 Jan 2016 19:51:50 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: JSESSIONID=F0F2D55CD0DDA309BF84AD800785B35E; Path=/identity/; Secure; HttpOnly;HttpOnly {"errors":[{"description":"User isn't authorized","code":403,"uri":""}]}[consolo@thehatch consolo]$ ``` Is there something else I need to be sending along with that request so that it knows to send back a permission ticket? Or is that info outdated, and I need to call a bunch of OpenID or UMA APIs to get a token instead?