> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shareofmodel.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM Provisioning

> Create, update and deactivate Share Of Model members automatically from your directory with SCIM 2.0.

SCIM 2.0 lets your identity provider keep Share Of Model membership in sync with your directory. When someone joins a mapped group they get access; when they leave your directory they lose it — without an Organization Owner touching the Members list.

Share Of Model exposes a SCIM 2.0 server compliant with RFC 7643 and RFC 7644, authenticated with a bearer token you generate yourself.

## Prerequisites

* You are an **Organization Owner**.
* You can administer provisioning in your identity provider.
* [Single sign-on](/platform/getting-started/single-sign-on) is configured for your organisation. SCIM provisions members; single sign-on lets them in.

## Connect your directory

Open **Settings**, select your organisation, open the **Single sign-on** tab, then the **SCIM provisioning** section.

<Steps>
  <Step title="Copy the SCIM base URL">
    The card shows your base URL, with a copy button:

    ```text SCIM base URL theme={null}
    https://api.shareofmodel.ai/scim/v2
    ```
  </Step>

  <Step title="Create a token">
    Click the create button, name the token after the integration that will use it, and confirm.

    <Warning>
      The token is shown once, immediately after creation. Copy it before closing the dialog — it cannot be displayed again. Tokens are prefixed with `sk-som-`.
    </Warning>
  </Step>

  <Step title="Configure your identity provider">
    Paste the base URL and the token in the provisioning settings of your application, then run its test-connection action. See the guides below.
  </Step>

  <Step title="Assign users and groups">
    Assign the users and groups to provision, then start provisioning. The connection card switches from **Waiting for first request** to **Receiving requests** and shows the timestamp of the last request received.
  </Step>
</Steps>

A SCIM token authenticates the SCIM server only. It cannot be exchanged for a JWT on the authentication endpoints, and it cannot read or write any other part of the API.

<Note>
  Tokens can be rotated and deleted from the tokens table at any time. Rotation issues a new secret — shown once — and invalidates the previous one, so update your identity provider straight away.
</Note>

## Identity provider guides

<Tabs>
  <Tab title="Okta">
    <Steps>
      <Step title="Enable SCIM on the application">
        In the **General** tab of your Share Of Model application, enable SCIM provisioning.
      </Step>

      <Step title="Configure the SCIM connection">
        Open the **Provisioning** tab, paste the SCIM base URL as the connector base URL, choose **HTTP header** authentication and paste the token.
      </Step>

      <Step title="Choose the provisioning actions">
        Enable **Create users**, **Update user attributes** and **Deactivate users**. Push the groups you want to map to Share Of Model roles.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Microsoft Entra ID">
    <Steps>
      <Step title="Open provisioning">
        In your enterprise application open **Provisioning** and set the mode to **Automatic**.
      </Step>

      <Step title="Enter the admin credentials">
        Paste the SCIM base URL as **Tenant URL** and the token as **Secret Token**, then test the connection.
      </Step>

      <Step title="Assign users and groups">
        Assign the users and groups to provision, then start provisioning.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## What gets synced

### Users

| SCIM attribute                | Share Of Model field                            |
| ----------------------------- | ----------------------------------------------- |
| `userName`, `emails[primary]` | Email — the identifier used at sign-in          |
| `externalId`                  | Directory identifier, stored for reconciliation |
| `name.givenName`              | First name                                      |
| `name.familyName`             | Last name                                       |
| `active`                      | Membership of your organisation                 |

Creating a user adds them to your organisation with the **default organization role** set in the Provisioning card, unless a group mapping applies.

### Groups

Groups pushed by your identity provider are stored, then resolved through the **group mappings** you defined in the Sign-in section: each mapping grants an organisation or workspace role to the members of one directory group.

A group pushed without a mapping is recorded and has no effect, so you can push your whole directory and map only what matters.

## Deactivation and deprovisioning

Setting `active` to `false`, or unassigning the user in your identity provider, removes them from your organisation: their roles for that organisation are revoked and they are removed from the provisioned groups.

The account itself is only deactivated when the user has no active role left in any other organisation — so a consultant shared between two customers keeps their other access.

<Note>
  A SCIM `DELETE` is treated as a deactivation, never as a hard delete. Share Of Model keeps no orphan accounts, and no analysis history is lost.
</Note>

## Supported endpoints

All paths are relative to `https://api.shareofmodel.ai/scim/v2`, with `Authorization: Bearer <token>`.

| Endpoint                                               | Operations                                                          |
| ------------------------------------------------------ | ------------------------------------------------------------------- |
| `/Users`                                               | `GET` (list, filter), `POST`, `GET /{id}`, `PUT`, `PATCH`, `DELETE` |
| `/Users/.search`                                       | `POST`                                                              |
| `/Groups`                                              | `GET` (list, filter), `POST`, `GET /{id}`, `PUT`, `PATCH`, `DELETE` |
| `/Groups/.search`                                      | `POST`                                                              |
| `/ServiceProviderConfig`, `/Schemas`, `/ResourceTypes` | `GET`                                                               |

Filters are supported on `userName`, `emails`, `externalId`, `name.givenName`, `name.familyName`, `active` and `id` for users, and on `displayName`, `externalId` and `id` for groups, with the `eq`, `ne`, `co`, `sw`, `ew`, `gt`, `ge`, `lt`, `le` operators combined with `and` / `or`.

<Note>
  `/Me` and `/Bulk` are not implemented and answer with the SCIM "not implemented" error. Every request is scoped to the organisation that owns the token — a token can never read or write another organisation's members.
</Note>

## Troubleshooting

| Symptom                                                   | Cause                                                               | Fix                                                                             |
| --------------------------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| `401` on every request                                    | Token wrong, rotated or deleted.                                    | Create a new token and update your identity provider.                           |
| `409` on user creation                                    | The organisation reached its user quota.                            | Free a seat or contact your account manager.                                    |
| `400` on a filter                                         | Unsupported attribute or operator.                                  | Restrict the filter to the attributes listed above.                             |
| Users created but cannot sign in                          | Single sign-on not active, or the domain is not configured.         | Check the [Sign-in configuration](/platform/getting-started/single-sign-on).    |
| Groups pushed but no role granted                         | No group mapping for that group, or the names do not match exactly. | Add the mapping in the Provisioning card, using the exact directory group name. |
| Connection card still shows **Waiting for first request** | Provisioning not started, or no user assigned.                      | Assign users and start provisioning in your identity provider.                  |

## What's next

<CardGroup cols={2}>
  <Card title="Single Sign-On" icon="arrow-right-to-bracket" href="/platform/getting-started/single-sign-on">
    Configure the identity provider your members sign in with.
  </Card>

  <Card title="User Roles & Workspaces" icon="users-gear" href="/platform/getting-started/user-roles-and-workspaces-management">
    The roles group mappings can grant.
  </Card>
</CardGroup>