Choosing a Filter Format

Scribe speaks four filter languages: FleX, JSON, SCIM, and LDAP. Each one reaches the same query engine and produces identical results. The only real difference is syntax — FleX and JSON add attribute groups and set membership that the others can only express with verbose OR chains.

Scribe auto-detects the format, so you can mix formats freely across requests. All formats support temporal references like now-1h, today, and last 7 days for timestamp filtering. For a side-by-side operator comparison, see Quick comparison. For full syntax with examples and edge cases, see the Filters reference.

FleX reads like plain English. It’s the most natural format for config files, interactive queries, and curl one-liners.

cn is John
department is Engineering and active is true
cn|mail starts with john

FleX supports attribute groups (cn|mail = john searches both fields with one condition) and set membership (status in (active, pending)). Whitespace around operators is optional but helps readability.

Use FleX when typing queries by hand or embedding filters in config files.

Reference: FleX syntax — operators — combinators — values — set membership

JSON filters are easy to construct programmatically. No escaping headaches, no string concatenation bugs, and your language already has a JSON serializer.

{"cn": "John"}
{"department": "Engineering", "active": "true"}
{"cn|mail": {"sw": "john"}}

JSON also supports attribute groups and set membership ({"status": {"includes": ["active", "pending"]}}). Nested objects map directly to operators (sw, co, ne, pr).

Use JSON when building filters in application code or constructing queries dynamically.

Reference: JSON syntax — operators — logical operators — value coercion

If your existing tooling speaks SCIM, the filter syntax will feel familiar:

cn eq "John"
department eq "Engineering" and active eq "true"

SCIM is the fallback format — Scribe tries it last when auto-detecting.

Use SCIM when integrating with SCIM-aware systems or when your team already knows the syntax from other SCIM deployments.

Reference: SCIM syntax — operators — FleX compatibility

Standard LDAP filter syntax, per RFC 4515:

(cn=John*)
(&(department=Engineering)(active=TRUE))

LDAP filters are auto-detected when the string starts with ( and ends with ).

Use LDAP when migrating existing queries, working with LDAP clients that construct filters, or interacting through the LDAP channel where clients emit this format natively.

Reference: LDAP syntax — operators — extensible match — migrating to FleX

FleX and JSON support attribute groups — search multiple fields with a single condition:

cn|mail|uid = john          # FleX
{"cn|mail|uid": "john"}    # JSON

Without attribute groups, you’d need an explicit OR:

cn = john or mail = john or uid = john     # FleX
(|(cn=john)(mail=john)(uid=john))          # LDAP