Skip to content

SCIM provisioning

Generate a SCIM token and connect your IdP so users and groups are created, updated, and deactivated in Glueprint automatically.

Available on
  • Web Portal

SCIM (System for Cross-domain Identity Management) lets your identity provider create, update, and deactivate Glueprint users automatically, and map directory groups to Glueprint roles. It’s an Enterprise feature and works alongside SSO sign-in — set up SSO first, then add SCIM for automated provisioning.

Step 1: Generate a SCIM token

  1. Go to portal.glueprint.ai and open Settings > Single Sign-On.
  2. Find the SCIM tokens card and click Manage.
  3. Enter a label (for example Okta production) and click Create.
  4. Copy the token now with the Copy button. It’s shown once, starts with scim_, and can’t be retrieved again. After you dismiss it, only the first few characters are shown for identification.

If you lose a token, delete it and create a new one.

Step 2: Connect your IdP

In your IdP’s provisioning settings, point SCIM at Glueprint:

SettingValue
SCIM base URLhttps://api.glueprint.ai/scim/v2
AuthenticationHTTP header bearer token
TokenAuthorization: Bearer scim_… (the token from Step 1)

Glueprint implements SCIM 2.0 for both Users and Groups.

What gets synced

  • Users — created, updated, and deactivated to match your directory. Deactivating a user in your IdP disables their Glueprint access.
  • Groups — group membership drives role assignment when you configure a group-to-role mapping (below).

Roles from SCIM

Glueprint assigns a role to each provisioned user:

  • A default role applies when no group mapping matches: member, admin, or billing.
  • A group-to-role mapping maps each directory group’s display name to one of member, admin, or billing.

The owner role can never be assigned through SCIM (or SSO) — it stays with the human who created the account.

Rotating and revoking tokens

  • Rotate: create a new token, update your IdP to use it, then revoke the old one.
  • Revoke: in the SCIM tokens sheet, click Revoke next to a token. Revocation takes effect almost immediately, and any further SCIM calls using that token are rejected.

Provider notes

Follow your IdP’s own documentation for the exact provisioning screens:

  • Okta — in the Glueprint app, enable provisioning, set the SCIM connector base URL and bearer token, then assign users and push groups.
  • Microsoft Entra ID — in the Enterprise application, open Provisioning, set the Tenant URL to the SCIM base URL and the Secret Token to your scim_ token, then test the connection before turning provisioning on.
PreviousEmail domains & enforcement
NextPlans