SCIM provisioning

Provision, update, and deprovision users and groups automatically from your identity provider over SCIM 2.0 (RFC 7643/7644). Topolab exposes a standard SCIM 2.0 service so your directory of record drives Topolab membership: joiners are created, role changes flow through, and leavers are deactivated without manual cleanup.

Preview, SCIM provisioning is documented here as a contract and is not yet live in production. The base URL below shows the intended service root; treat the endpoints as the specification, not a callable production URL today.

This is an Enterprise-only capability.

Base URL

/v1/scim/v2

The service exposes the standard SCIM 2.0 resources under this root:

GET    /v1/scim/v2/ServiceProviderConfig

GET    /v1/scim/v2/Users
POST   /v1/scim/v2/Users
GET    /v1/scim/v2/Users/:id
PATCH  /v1/scim/v2/Users/:id
DELETE /v1/scim/v2/Users/:id

GET    /v1/scim/v2/Groups
POST   /v1/scim/v2/Groups
GET    /v1/scim/v2/Groups/:id
PATCH  /v1/scim/v2/Groups/:id
DELETE /v1/scim/v2/Groups/:id

ServiceProviderConfig advertises the features this SCIM service supports; most provisioning connectors read it automatically during setup.

Authentication

SCIM requests use a per-organization bearer token, generated in the portal under security settings. It is distinct from your data API keys (X-API-Key) and from user JWTs, it authorizes only the SCIM service for that one organization.

Authorization: Bearer scim_...
Content-Type: application/scim+json

SCIM requests and responses use the application/scim+json media type (RFC 7644). Configure the token as the secret in your identity provider's provisioning connector, alongside the base URL above.

Users and Groups

• Users, create, update, and deactivate accounts in your organization. SCIM active: false (or a DELETE) deprovisions the user.
• Groups, represent directory groups; group membership maps to a Topolab organization role, so a directory group grants the corresponding access.

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "jane.doe@acme.example",
  "name": { "givenName": "Jane", "familyName": "Doe" },
  "emails": [{ "value": "jane.doe@acme.example", "primary": true }],
  "active": true
}

Identity provider compatibility

The service is standard SCIM 2.0 and is compatible with Okta and Microsoft Entra ID (and any compliant SCIM 2.0 provider). Point the provider's provisioning app at the base URL with the per-org bearer token, then assign users and groups in the provider to provision them into Topolab.

SCIM pairs with Enterprise SSO: SSO handles sign-on, SCIM handles the full user lifecycle.

Errors

SCIM responses follow the SCIM error schema (urn:ietf:params:scim:api:messages:2.0:Error).

Status	Meaning
401	Missing or invalid SCIM bearer token.
403	The token's organization is not on Enterprise.
404	Unknown user or group.
409	A user with the same userName already exists.

Next

• Enterprise SSO, sign-on to pair with SCIM lifecycle management.
• Organization, the organization the SCIM token provisions into.