SCIM user provisioning

Set up SCIM 2.0 to create, update and remove workspace members automatically from your identity provider, with the base URL, token and supported endpoints.

# SCIM user provisioning

> Set up SCIM 2.0 to create, update and remove workspace members automatically from your identity provider, with the base URL, token and supported endpoints.

SCIM 2.0 lets your identity provider add and remove workspace members
(Business plan). The token is created on the SSO settings page, so save
your [SSO](/docs/teams/sso) settings first.

## Connect

1. **Workspace settings → SSO → SCIM provisioning → Generate SCIM token.**
   The token (`scim_…`) is shown once. Generating a new one replaces the
   old, which stops working. This needs the `workspace.manage` permission
   and every permission of the SSO **Role for new members**.
2. In your IdP's provisioning settings:

| Setting | Value |
   |---|---|
   | SCIM base URL | `https://privatusanalytics.com/scim/v2` |
   | Authentication | HTTP header, Bearer token: the `scim_…` token |
   | Unique identifier | `userName` = email address |

3. Enable **create**, **update** and **deactivate** users, and assign the
   people or groups to provision.

## What's supported

Only the `Users` resource exists. Bodies are `application/scim+json`.

| Operation | Endpoint | Effect |
|---|---|---|
| List / filter users | `GET /scim/v2/Users` | Users provisioned into this workspace through SCIM. The only filter is `filter=userName eq "…"`. Page with `startIndex` and `count` (100 by default, 200 at most) |
| Get a user | `GET /scim/v2/Users/{id}` | One provisioned user |
| Create | `POST /scim/v2/Users` | Creates the account and adds it as a member with the SSO role for new members and all sites. Takes `userName` (the email address), `name` (`formatted`, or `givenName` and `familyName`) and `active` |
| Update | `PATCH /scim/v2/Users/{id}` | A SCIM PatchOp with `replace` or `add` operations on `active`, `displayName` or `name.formatted`. `active: false` removes the membership, and `active: true` adds it back |
| Delete | `DELETE /scim/v2/Users/{id}` | Removes the member from the workspace and ends SCIM management of the account |

Limits to know:

- **Existing accounts.** An email address that already has a
  Privatus Analytics account outside this workspace is refused with a 409. Invite
  that person instead. An address that is already a member is linked to
  SCIM and stays a member.
- **Updates are PATCH operations.** A `PUT` that replaces the whole user
  is refused, and other attributes in a PATCH are ignored.
- **Names.** The display name changes only while the account belongs to
  no other workspace.
- **The owner** can't be deactivated or deleted through SCIM.
- **Groups aren't provisioned.** Set roles and site access in
  Privatus Analytics.

Removing a member revokes their API tokens for this workspace. The
person's account itself is kept (they may belong to other workspaces).

SCIM changes to members are recorded in the
[audit log](/docs/teams/audit-log), with **System** as the actor.

View as Markdown

SCIM 2.0 lets your identity provider add and remove workspace members (Business plan). The token is created on the SSO settings page, so save your SSO settings first.

Connect#

Workspace settings → SSO → SCIM provisioning → Generate SCIM token. The token (scim_…) is shown once. Generating a new one replaces the old, which stops working. This needs the workspace.manage permission and every permission of the SSO Role for new members.
In your IdP's provisioning settings:

| Setting | Value | |---|---| | SCIM base URL | https://privatusanalytics.com/scim/v2 | | Authentication | HTTP header, Bearer token: the scim_… token | | Unique identifier | userName = email address |

Enable create, update and deactivate users, and assign the people or groups to provision.

What's supported#

Only the Users resource exists. Bodies are application/scim+json.

Operation	Endpoint	Effect
List / filter users	`GET /scim/v2/Users`	Users provisioned into this workspace through SCIM. The only filter is `filter=userName eq "…"`. Page with `startIndex` and `count` (100 by default, 200 at most)
Get a user	`GET /scim/v2/Users/{id}`	One provisioned user
Create	`POST /scim/v2/Users`	Creates the account and adds it as a member with the SSO role for new members and all sites. Takes `userName` (the email address), `name` (`formatted`, or `givenName` and `familyName`) and `active`
Update	`PATCH /scim/v2/Users/{id}`	A SCIM PatchOp with `replace` or `add` operations on `active`, `displayName` or `name.formatted`. `active: false` removes the membership, and `active: true` adds it back
Delete	`DELETE /scim/v2/Users/{id}`	Removes the member from the workspace and ends SCIM management of the account

Limits to know:

Existing accounts. An email address that already has a Privatus Analytics account outside this workspace is refused with a 409. Invite that person instead. An address that is already a member is linked to SCIM and stays a member.
Updates are PATCH operations. A PUT that replaces the whole user is refused, and other attributes in a PATCH are ignored.
Names. The display name changes only while the account belongs to no other workspace.
The owner can't be deactivated or deleted through SCIM.
Groups aren't provisioned. Set roles and site access in Privatus Analytics.

Removing a member revokes their API tokens for this workspace. The person's account itself is kept (they may belong to other workspaces).

SCIM changes to members are recorded in the audit log, with System as the actor.