How do I provision users with SCIM?
Enterprise organizations can create, update, and deactivate members automatically from their identity provider over SCIM 2.0.
SCIM provisioning is an Enterprise-only capability and is currently in preview. It uses a per-organization SCIM bearer token generated in the portal.
1. What SCIM provisioning is
SCIM lets your directory of record drive Topolab membership over SCIM 2.0: joiners are created, role changes flow through, and leavers are deactivated without manual cleanup. It is compatible with Okta and Microsoft Entra ID, and any compliant SCIM 2.0 provider.
Preview and Enterprise-onlySCIM provisioning is an Enterprise-only capability, documented as a contract while it is in preview.
2. Authentication
SCIM requests use a per-organization bearer token, generated in the portal under security settings. It is distinct from your data API keys and from user JWTs, and authorizes only the SCIM service for that one organization. Configure it as the secret in your identity provider's provisioning connector, alongside the SCIM base URL.
Authorization: Bearer scim_...3. Users and groups
SCIM provisions both Users and Groups. Setting a user to active: false (or deleting them) deprovisions the account. Directory group membership maps to a Topolab organization role, so a group grants the corresponding access.
4. Pair with SSO
SCIM pairs with Enterprise SSO: SSO handles sign-on, while SCIM handles the full user lifecycle from your directory.
Laatst bijgewerkt 25 juli 2026