SCIM provisioning (Okta, Entra ID, Google Workspace)

Let your customers' identity providers create, update, deactivate and delete your app's users and manage groups as app roles, with SCIM 2.0.

Updated Oct 23, 2026

SCIM 2.0 is how a company's identity provider keeps the apps it uses in step with its directory. Turn it on and an Okta, Microsoft Entra ID, Google Workspace, OneLogin or JumpCloud admin can provision your app: new hires get an account, profile changes follow, and leavers are switched off the moment HR deactivates them.

In the identity provider	In your app
Assign a user to the app	An app user is created (no password: they sign in with your SSO, social providers or a magic link; the email counts as verified).
Change their name or email	The user's profile and sign-in email change.
Deactivate / unassign	`active: false`: sign-in is blocked and every session ends at once.
Delete	The user is removed.
Push a group	The group becomes an app role: “Billing Admins” → `BILLING_ADMINS` in each member's `roles` (row policies and role access read it). Renaming the group renames the role.

A membership change ends that member's sessions, so their next token carries the new roles (the same as changing roles in the console). Blocking hooks don't run for SCIM: it is your customer's own directory.

#Turn it on

Console › Authentication › SCIM provisioning › Turn on SCIM. Copy the token — it is shown once — and the SCIM base URL (https://api.sovaria.in/api/v1/auth/scim/v2/<project id>).
Okta: your app › Provisioning › Integration: SCIM connector base URL, unique identifier field userName, supported actions push new users, profile updates and groups, authentication mode “HTTP Header” with the token.
Microsoft Entra ID: Enterprise application › Provisioning › Automatic: tenant URL = the base URL, secret token = the token; map userPrincipalName or mail to userName.
Google Workspace, OneLogin, JumpCloud: any “SCIM 2.0 / bearer token” connector works the same way.
Rotate the token any time (the old one stops at once); Turn off revokes it. Users and groups already provisioned stay.

sov scim token      # turn on or rotate; prints the token once
sov scim status     # base URL, token prefix, last use, users provisioned, groups
sov scim revoke

#What Sovaria supports

Endpoint	Notes
`GET /ServiceProviderConfig`, `/ResourceTypes`, `/Schemas`	Discovery: PATCH and filtering supported; bulk, sorting, ETags and password changes are not.
`GET /Users`	Filters with `eq` on `userName`, `externalId`, `id`, `emails.value` (also `emails[type eq "work"].value`), `active`, joined with `and`; `startIndex` and `count` (up to 200).
`POST /Users`, `GET/PUT/PATCH/DELETE /Users/{id}`	`userName` must be the sign-in email (or give a primary `emails` value). PATCH takes `add` / `replace` / `remove`, with or without `path` (Okta and Entra ID forms, including `"False"` strings).
`GET /Groups`	Filters on `displayName`, `externalId`, `id`, `members.value`; `excludedAttributes=members` for large groups.
`POST /Groups`, `GET/PUT/PATCH/DELETE /Groups/{id}`	Members by user id; PATCH `add` / `remove` members (also `members[value eq "…"]`) and rename.

curl $BASE/Users?filter=userName%20eq%20%22ada%40acme.com%22 -H "Authorization: Bearer $SCIM_TOKEN"
curl -X PATCH $BASE/Users/8d1e… -H "Authorization: Bearer $SCIM_TOKEN" -H 'Content-Type: application/scim+json' \\
  -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"replace","path":"active","value":false}]}'

Errors use SCIM's own shape: {"schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"], "status": "409", "scimType": "uniqueness", "detail": "…"}. A wrong or revoked token is 401; a plan without SCIM, or SCIM switched off by Sovaria support, is 403.

#Security

Only the token's SHA-256 is stored. It works for one project only, and only on the SCIM endpoints.
Only the project's owners and admins can create, rotate or revoke it; AI assistants never see it.
Every change (user created, updated, deactivated, deleted; group created, changed, deleted; token created, rotated, revoked) is in the project's audit log.

#Plans

	Free	Pro	Ultra	Team	Enterprise
SCIM 2.0 provisioning of app users and groups	—	—	—	✓	✓

#Coming from Firebase or Supabase?

Platform	What this is called there
Firebase	none (Identity Platform has no SCIM)
Supabase	none (Supabase Auth has no SCIM)
Sovaria	SCIM provisioning (Okta, Entra ID, Google Workspace)

Moving an existing app? Migrate from Supabase or Firebase imports users (with their passwords), data, files and rules.