SCIM provisioning

Automatically provision and deprovision users as your directory changes.

What SCIM does

SCIM (System for Cross-domain Identity Management) lets your identity provider push user and group changes to the platform automatically. When you hire someone, they get an account. When someone leaves, their access is revoked. You manage users once — in your IdP — and the platform stays in sync.

Without SCIM, you provision users manually or rely on just-in-time SSO provisioning. SCIM is the better choice if you have more than a handful of users, or if you need users to be placed in specific teams before their first login.

Prerequisites

SSO must be configured first. SCIM supplements SSO — it handles provisioning, SSO handles authentication. See the SSO guide.
Your IdP must support SCIM 2.0. Major providers that do: Okta, Microsoft Entra, JumpCloud, OneLogin.

Enabling SCIM

Go to Organization → SSO → SCIM.
Copy the SCIM endpoint URL — it looks like https://app.openassistant.us/api/scim/v2.
Generate a SCIM bearer token by clicking Generate token. Store this somewhere safe — it won't be shown again.
In your IdP, configure SCIM provisioning with the endpoint URL and bearer token.
Enable SCIM in your IdP and run an initial sync.

The initial sync will create accounts for all users in the assigned group or application in your IdP.

What gets synced

IdP event	What the platform does
User assigned to app	Creates account, sets name and email
User profile updated	Updates name
User unassigned or deprovisioned	Suspends access
Group assigned	Maps to a team (if team sync is configured)
Group membership changed	Adds or removes user from the mapped team

Email addresses are immutable — SCIM cannot change a user's email after the account is created. If an email changes in your IdP, a new account is created and the old one is suspended.

Team sync

If your IdP sends group membership, you can map IdP groups to teams in Organization → SSO → SCIM → Team mapping. Add a row per group:

IdP group name	Team
`engineering`	Engineering
`sales`	Sales

Users added to an IdP group are automatically added to the mapped team. Users removed from the group are removed from the team. Team membership managed via SCIM takes precedence over manual team assignment in the dashboard.

Deprovisioning vs deletion

When a user is deprovisioned via SCIM, their account is suspended — they can no longer log in, but their tasks, conversations, and data are retained. This is intentional: task history often has compliance or handoff value.

To fully remove a user (not just suspend them), call the deprovision endpoint directly by their email:

curl https://app.openassistant.us/api/users/deprovision \
  -X POST \
  -H "Authorization: Bearer ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "teamId": "<teamId>" }'

This won't go through if the user is their organization's only admin, or owns a team with other active members — reassign that first, then retry. Once it succeeds, the user is removed from the team, and if they have no other team memberships left, their account is deleted entirely.

Troubleshooting

Users aren't being created after sync Check that the IdP application is assigned to the correct users or groups, and that the SCIM token in your IdP matches the one shown in Organization → SSO → SCIM.

Users are suspended but shouldn't be The platform suspends any user your IdP marks as inactive or unassigns from the application. Check the assignment rules in your IdP — it's usually a group membership or activation status issue there, not in the dashboard.

Group sync isn't mapping to teams Make sure the group names in Organization → SSO → SCIM → Team mapping match exactly (case-sensitive) the group display names your IdP sends.