Hi Daniel, Per spec, the password attribute has returnability of "never". It means that service implementations should not include it in any response even if requested explicitly. About that "hidden" message, it should not be there and we are removing this starting from 3.1.3. So the answer is no, and more generally no SCIM implementation will give the password back to a client. However, this is an attribute that can be changed at any moment (its mutability is "writeOnly"). Kind regards