Skip to content
Identity Studio

SCIM 2.0 provisioning

Joiners, movers and leavers, straight from the directory

Each customer organization gets a SCIM 2.0 endpoint and its own token. Their directory creates people, updates them, maps groups to roles and deactivates leavers, without a ticket to your support team.

Book a demoSee the protocol
GET /scim/v2/ServiceProviderConfigscim_provider.py
{
  "patch": {"supported": true},
  "bulk": {"supported": false},
  "filter": {"supported": true, "maxResults": 200},
  "changePassword": {"supported": false},
  "sort": {"supported": false},
  "etag": {"supported": false},
  "authenticationSchemes": [{
    "type": "oauthbearertoken",
    "description": "Organization-scoped provisioning
      token (shown once at creation)"}]
}
Why it matters

Access should end the moment HR says so

No manual onboarding

People appear with the right role the moment the directory assigns them.

Leavers lose access everywhere

Deactivation ends workspace and app seats, sessions and OAuth grants at that organization.

Groups become roles

The same rules as single sign-on map directory groups to roles.

How it works

A leaver, from directory to locked out

  1. 1DirectoryConnect with a tokenAn organization token (idscim_…) shown once and stored as a hash.
  2. 2DirectoryCreate and update peoplePOST and PATCH /scim/v2/Users; groups through /Groups.
  3. 3Identity StudioMap groups to rolesThrough the rules on the linked SSO connection. The last owner is never demoted.
  4. 4DirectorySet active: falseOr DELETE. The person record is kept; the membership ends.
  5. 5Identity StudioRevoke at that organizationSeats, sessions and OAuth grants there end. Written to the audit trail.
Standards we implement

The SCIM we implement

StandardWhat we supportStatus
RFC 7643 · Core schemaUser (userName, name, displayName, emails, active, externalId) and Group.Live
RFC 7644 · ProtocolGET, POST, PUT, PATCH (add, replace, remove) and DELETE on Users and Groups.Live
Filtering and pagingeq on userName, externalId and active, joined by and; displayName eq for groups. startIndex and count up to 200. attributes and excludedAttributes.Live
DiscoveryServiceProviderConfig, ResourceTypes, Schemas and a documentation page.Live
InteroperabilityOkta lifecycle (provision, offboard, reactivate) passed on a real tenant; Microsoft Entra ID SCIM Validator 22 of 22.Live

Not offered today: Bulk, /Me, sorting, ETags, the Enterprise User extension, outbound SCIM to other systems, a token-rotation endpoint (mint a new token, then revoke the old one).

Configuration

What an organization admin sets

OptionValuesDefault
Token labelA name for the directory using itSCIM token
Linked SSO connectionIts group rules map groups to rolesnone
Rate limit10 to 100,000 requests a minute per token600 / minute
Role mapping rulesClaim groups or roles, value, role, prioritypriority 100
Under the hood

What protects it

From the code
SCIM requestwhat an IdP sends
PATCH /scim/v2/Users/{id}
Authorization: Bearer idscim_…
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {"op": "replace", "value": {"active": false}}
  ]
}
Security notes
  • Tokens are shown once and stored as a hash.
  • Each token has its own rate limit.
  • DELETE deactivates; it never hard-deletes the person.
  • The last active owner cannot be removed (409).
  • Every change is audited, and the write fails if the audit row cannot be written.
Works with

Part of one platform

SAML single sign-on Sign-in from the same IdP.Organizations Where provisioned people land.Roles & permissions What their groups grant.Audit & SIEM export Every change, on the record.
Which plans include it, and the limits that apply, are on the plans page.See plans →

Explore the platform

One platform, every piece of sign-in and access

Let directories run your onboarding

Create a SCIM token for a customer organization and connect Okta or Entra ID.

Book a demoStart free trial