SCIM provisioning

Availability

Scale plan and above

How an admin connects it

Your identity provider calls our SCIM endpoint with a per-organization bearer token that an admin generates.

Who can set it up: Organization admin.

1. In the admin console, generate a SCIM token. It is shown once.
2. In your identity provider, set the SCIM base URL to our /scim/v2 endpoint and paste the token.
3. Assign people to the app in your identity provider.

Permissions requested

Data we read

Supported today: list, get, create, patch-to-deactivate and delete for Users. Not built: PUT, group management and the ServiceProviderConfig, Schemas and ResourceTypes discovery endpoints. Test with your identity provider before committing.

How the data is used

• Creating a user creates a pending invitation; the person joins on first sign-in. It never creates a signed-in account on its own.
• Setting a user inactive, or deleting it, deprovisions them as a soft delete with a 30-day recovery window, then permanent erasure.

Sync frequency

Real time, as your identity provider sends changes. Requests are rate limited per organization.

Disconnecting and purging data

How: Admin console, regenerate or revoke the SCIM token, and remove the app in your identity provider.

• The old token stops working immediately.

What remains: Provisioned members remain until removed or deprovisioned. See Permissions and access control for deletion behavior.