Skip to main content
SCIM 2.0 lets your identity provider keep Share Of Model membership in sync with your directory. When someone joins a mapped group they get access; when they leave your directory they lose it — without an Organization Owner touching the Members list. Share Of Model exposes a SCIM 2.0 server compliant with RFC 7643 and RFC 7644, authenticated with a bearer token you generate yourself.

​
Prerequisites

  • You are an Organization Owner.
  • You can administer provisioning in your identity provider.
  • Single sign-on is configured for your organisation. SCIM provisions members; single sign-on lets them in.

​
Connect your directory

Open Settings, select your organisation, open the Single sign-on tab, then the SCIM provisioning section.
1

Copy the SCIM base URL

The card shows your base URL, with a copy button:
SCIM base URL
2

Create a token

Click the create button, name the token after the integration that will use it, and confirm.
The token is shown once, immediately after creation. Copy it before closing the dialog — it cannot be displayed again. Tokens are prefixed with sk-som-.
3

Configure your identity provider

Paste the base URL and the token in the provisioning settings of your application, then run its test-connection action. See the guides below.
4

Assign users and groups

Assign the users and groups to provision, then start provisioning. The connection card switches from Waiting for first request to Receiving requests and shows the timestamp of the last request received.
A SCIM token authenticates the SCIM server only. It cannot be exchanged for a JWT on the authentication endpoints, and it cannot read or write any other part of the API.
Tokens can be rotated and deleted from the tokens table at any time. Rotation issues a new secret — shown once — and invalidates the previous one, so update your identity provider straight away.

​
Identity provider guides

1

Enable SCIM on the application

In the General tab of your Share Of Model application, enable SCIM provisioning.
2

Configure the SCIM connection

Open the Provisioning tab, paste the SCIM base URL as the connector base URL, choose HTTP header authentication and paste the token.
3

Choose the provisioning actions

Enable Create users, Update user attributes and Deactivate users. Push the groups you want to map to Share Of Model roles.

​
What gets synced

​
Users

Creating a user adds them to your organisation with the default organization role set in the Provisioning card, unless a group mapping applies.

​
Groups

Groups pushed by your identity provider are stored, then resolved through the group mappings you defined in the Sign-in section: each mapping grants an organisation or workspace role to the members of one directory group. A group pushed without a mapping is recorded and has no effect, so you can push your whole directory and map only what matters.

​
Deactivation and deprovisioning

Setting active to false, or unassigning the user in your identity provider, removes them from your organisation: their roles for that organisation are revoked and they are removed from the provisioned groups. The account itself is only deactivated when the user has no active role left in any other organisation — so a consultant shared between two customers keeps their other access.
A SCIM DELETE is treated as a deactivation, never as a hard delete. Share Of Model keeps no orphan accounts, and no analysis history is lost.

​
Supported endpoints

All paths are relative to https://api.shareofmodel.ai/scim/v2, with Authorization: Bearer <token>. Filters are supported on userName, emails, externalId, name.givenName, name.familyName, active and id for users, and on displayName, externalId and id for groups, with the eq, ne, co, sw, ew, gt, ge, lt, le operators combined with and / or.
/Me and /Bulk are not implemented and answer with the SCIM “not implemented” error. Every request is scoped to the organisation that owns the token — a token can never read or write another organisation’s members.

​
Troubleshooting

​
What’s next

Single Sign-On

Configure the identity provider your members sign in with.

User Roles & Workspaces

The roles group mappings can grant.