SCIM provisioning

Automatically provision and deprovision users as your directory changes.

What SCIM does

SCIM (System for Cross-domain Identity Management) lets your identity provider push user and group changes to the platform automatically. When you hire someone, they get an account. When someone leaves, their access is revoked. You manage users once — in your IdP — and the platform stays in sync.

Without SCIM, you provision users manually or rely on just-in-time SSO provisioning. SCIM is the better choice if you have more than a handful of users, or if you need users to be placed in specific teams before their first login.

Prerequisites

SSO must be configured first. SCIM supplements SSO — it handles provisioning, SSO handles authentication. See the SSO guide.
The Sync Method in your SSO settings must be SCIM 2.0.
Your IdP must support SCIM 2.0. Major providers that do: Okta, Microsoft Entra, JumpCloud, OneLogin.
For Okta specifically, see Setting up Okta for exact click-by-click steps, including which app template to use.

Enabling SCIM

Go to Organization → SSO. The SCIM Provisioning section shows your Endpoint and Bearer Token.
Copy the Endpoint URL — it looks like https://app.openassistant.us/api/scim/v2.
Click Regenerate Token to create a bearer token. Copy it somewhere safe: it is displayed when you generate it, and afterwards the page only tells you a token exists. Regenerating invalidates the previous token, so update your IdP whenever you do.
In your IdP, configure SCIM provisioning with the endpoint URL and bearer token. Your IdP must send the token as a standard Authorization: Bearer header.
Enable SCIM in your IdP and assign the users or groups you want provisioned.

The Member Sync summary on the same page shows the last sync time and the last sync error, if there was one.

What gets synced

IdP event	What the platform does
User assigned to app	Creates an account in your organization, sets name and email
User profile updated	Updates first and last name
User unassigned or deprovisioned	Deactivates the account
Group pushed	Creates a team with the group's name
Group membership changed	Adds or removes the user from the matching team
Group renamed	Renames the team
Group deleted	Deletes the team

Email addresses are the identity for an account — SCIM does not change a user's email after the account is created. An IdP request to create a user whose email already has an account is rejected as a duplicate.

Your IdP can look users up by userName filter. Bulk operations, sorting and password changes are not supported.

Team sync

If your IdP sends groups, each group becomes a team in Organization → People → Teams. Users added to a group in your IdP are added to that team; users removed from the group are removed from it. There is no separate mapping screen — the team takes the group's name.

If someone already owns a different team that has other active members, their membership in the synced team is skipped until that ownership is sorted out. Users who belong to a different organization are never added.

Deprovisioning vs deletion

When a user is deprovisioned via SCIM, their account is deactivated — they can no longer log in, but their tasks, conversations, and data are retained. This is intentional: task history often has compliance or handoff value.

To fully remove a user (not just deactivate them), call the deprovision endpoint directly by their email:

curl https://app.openassistant.us/api/users/deprovision \
  -X POST \
  -H "Authorization: Bearer ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "teamId": "<teamId>" }'

This won't go through if the user is their organization's only admin, or owns a team with other active members — reassign that first, then retry. Once it succeeds, the user is removed from the team, and if they have no other team memberships left, their account is deleted entirely.

Troubleshooting

Users aren't being created after sync Check that the IdP application is assigned to the correct users or groups, and that the SCIM token in your IdP matches the most recent one generated in Organization → SSO. A missing or malformed Authorization: Bearer header is rejected with an "Authorization header with Bearer token is required" error, and a wrong token is rejected as unauthorized.

Users are deactivated but shouldn't be The platform deactivates any user your IdP marks as inactive, unassigns from the application, or deletes. Check the assignment rules in your IdP — it's usually a group membership or activation status issue there, not in the dashboard.

A group didn't become a team, or a member is missing from it Confirm the group is assigned to the SCIM app in your IdP, and that the person isn't the owner of another team with active members.