Joiners, movers and leavers, straight from the directory

Each customer organization gets a SCIM 2.0 endpoint and its own token. Their directory creates people, updates them, maps groups to roles and deactivates leavers, without a ticket to your support team.

Book a demo See the protocol

GET /scim/v2/ServiceProviderConfigscim_provider.py

{
  "patch": {"supported": true},
  "bulk": {"supported": false},
  "filter": {"supported": true, "maxResults": 200},
  "changePassword": {"supported": false},
  "sort": {"supported": false},
  "etag": {"supported": false},
  "authenticationSchemes": [{
    "type": "oauthbearertoken",
    "description": "Organization-scoped provisioning
      token (shown once at creation)"}]
}

Why it matters

Access should end the moment HR says so

No manual onboarding

People appear with the right role the moment the directory assigns them.

Leavers lose access everywhere

Deactivation ends workspace and app seats, sessions and OAuth grants at that organization.

Groups become roles

The same rules as single sign-on map directory groups to roles.

How it works

A leaver, from directory to locked out

1DirectoryConnect with a tokenAn organization token (idscim_…) shown once and stored as a hash.
2DirectoryCreate and update peoplePOST and PATCH /scim/v2/Users; groups through /Groups.
3Identity StudioMap groups to rolesThrough the rules on the linked SSO connection. The last owner is never demoted.
4DirectorySet active: falseOr DELETE. The person record is kept; the membership ends.
5Identity StudioRevoke at that organizationSeats, sessions and OAuth grants there end. Written to the audit trail.

Standards we implement

The SCIM we implement

Standard	What we support	Status
RFC 7643 · Core schema	User (userName, name, displayName, emails, active, externalId) and Group.	Live
RFC 7644 · Protocol	GET, POST, PUT, PATCH (add, replace, remove) and DELETE on Users and Groups.	Live
Filtering and paging	eq on userName, externalId and active, joined by and; displayName eq for groups. startIndex and count up to 200. attributes and excludedAttributes.	Live
Discovery	ServiceProviderConfig, ResourceTypes, Schemas and a documentation page.	Live
Interoperability	Okta lifecycle (provision, offboard, reactivate) passed on a real tenant; Microsoft Entra ID SCIM Validator 22 of 22.	Live

Not offered today: Bulk, /Me, sorting, ETags, the Enterprise User extension, outbound SCIM to other systems, a token-rotation endpoint (mint a new token, then revoke the old one).

Configuration

What an organization admin sets

Option	Values	Default
Token label	A name for the directory using it	SCIM token
Linked SSO connection	Its group rules map groups to roles	none
Rate limit	10 to 100,000 requests a minute per token	600 / minute
Role mapping rules	Claim groups or roles, value, role, priority	priority 100

Under the hood

What protects it

From the code

SCIM requestwhat an IdP sends

PATCH /scim/v2/Users/{id}
Authorization: Bearer idscim_…
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {"op": "replace", "value": {"active": false}}
  ]
}

Security notes

Tokens are shown once and stored as a hash.
Each token has its own rate limit.
DELETE deactivates; it never hard-deletes the person.
The last active owner cannot be removed (409).
Every change is audited, and the write fails if the audit row cannot be written.

Works with

Part of one platform

SAML single sign-on Sign-in from the same IdP.Organizations Where provisioned people land.Roles & permissions What their groups grant.Audit & SIEM export Every change, on the record.

Which plans include it, and the limits that apply, are on the plans page.See plans →

Let directories run your onboarding

Create a SCIM token for a customer organization and connect Okta or Entra ID.

Book a demo Start free trial