Skip to content

Provisioning members with SCIM

Keep membership in sync with your identity provider over SCIM 2.0. When someone is created or deactivated in the directory, Elaichi membership follows — without manual invites for every joiner.

Where to find it: Settings → SSO → SCIM provisioning (and Group role mappings below it)

You need Manage SSO (sso:manage). SCIM and group mappings are Black plan features (same gate as SSO).

What SCIM syncs

Resource Behavior
Users Create and update members from the IdP; deactivation removes organization membership
Groups Groups appear in Elaichi after the IdP provisions them
Group → role mappings Tick Elaichi roles for each SCIM group; members inherit those roles in addition to any roles assigned manually

SCIM does not manage connections, toolboxes, or MCP servers. After deprovisioning, transfer or clean up resources as needed — see Transferring and offboarding.

SCIM base URL and token

  1. Open Settings → SSO and scroll to SCIM provisioning.
  2. Copy the SCIM 2.0 base URL shown for this organization (path ends with /api/scim/v2).
  3. Choose Create SCIM token, name it after the IdP (for example Okta SCIM), and create it.
  4. Copy the bearer token now — it is shown once. Acknowledge storage, then Done.
  5. In your identity provider, create a SCIM application pointed at that base URL, authenticate with the bearer token, and assign users/groups.

The tokens table lists name, created date, and last used. Revoke stops provisioning immediately; create a replacement token and update the IdP.

Warning

Anyone with a SCIM token can provision members and groups in this organization. Store it like a production secret.

Map groups to roles

SCIM group → Elaichi roles 
flowchart LR
  IdP["Identity provider"] -->|"SCIM Users + Groups"| Elaichi["Elaichi"]
  Elaichi --> Groups["SCIM groups"]
  Groups --> Mapping["Group role mappings"]
  Mapping --> Roles["Built-in or custom roles"]
  Roles --> Member["Member effective permissions"]
  1. After the IdP pushes groups, they appear under Group role mappings.
  2. For each group, tick one or more Elaichi roles (built-in or custom).
  3. Clearing all roles removes the mapping for that group.

Members keep manually assigned roles and inherit roles from groups they currently belong to. A group with no roles ticked grants nothing via mapping.

If the groups list is empty, confirm the IdP SCIM app is assigned groups and has successfully synced at least once.

Deactivation

When the IdP deactivates or deletes a user through SCIM, Elaichi removes their membership in this organization. Their account may still exist globally if they belong to other orgs. Connections they owned may still need an offboarding pass.

Good to know

  • SCIM tokens are separate from organization API tokens.
  • New joiners without a group mapping get Member unless SSO/domain defaults say otherwise — see Roles.
  • Pair SCIM with verified domains and SSO so login and membership both follow the directory.