SCIM provisioning

SCIM (System for Cross-domain Identity Management) lets your identity provider create, update, and deactivate Glueprint users automatically, and map directory groups to Glueprint roles. It’s an Enterprise feature and works alongside SSO sign-in — set up SSO first, then add SCIM for automated provisioning.

Step 1: Generate a SCIM token

1. Go to portal.glueprint.ai and open Settings > Single Sign-On.
2. Find the SCIM tokens card and click Manage.
3. Enter a label (for example Okta production) and click Create.
4. Copy the token now with the Copy button. It’s shown once, starts with scim_, and can’t be retrieved again. After you dismiss it, only the first few characters are shown for identification.

If you lose a token, delete it and create a new one.

Step 2: Connect your IdP

In your IdP’s provisioning settings, point SCIM at Glueprint:

Setting	Value
SCIM base URL	https://api.glueprint.ai/scim/v2
Authentication	HTTP header bearer token
Token	Authorization: Bearer scim_… (the token from Step 1)

Glueprint implements SCIM 2.0 for both Users and Groups.

What gets synced

• Users — created, updated, and deactivated to match your directory. Deactivating a user in your IdP disables their Glueprint access.
• Groups — group membership drives role assignment when you configure a group-to-role mapping (below).

Roles from SCIM

Glueprint assigns a role to each provisioned user:

• A default role applies when no group mapping matches: member, admin, or billing.
• A group-to-role mapping maps each directory group’s display name to one of member, admin, or billing.

The owner role can never be assigned through SCIM (or SSO) — it stays with the human who created the account.

Rotating and revoking tokens

• Rotate: create a new token, update your IdP to use it, then revoke the old one.
• Revoke: in the SCIM tokens sheet, click Revoke next to a token. Revocation takes effect almost immediately, and any further SCIM calls using that token are rejected.

Provider notes

Follow your IdP’s own documentation for the exact provisioning screens:

• Okta — in the Glueprint app, enable provisioning, set the SCIM connector base URL and bearer token, then assign users and push groups.
• Microsoft Entra ID — in the Enterprise application, open Provisioning, set the Tenant URL to the SCIM base URL and the Secret Token to your scim_ token, then test the connection before turning provisioning on.

Related topics

• SSO overview
• Set up SSO step by step
• Email domains & enforcement
• Seats, hosts, and teams for how roles and seats work.