SCIM Provisioning
Automatically provision and deprovision users from your identity provider using SCIM 2.0.
Skitflow Enterprise supports SCIM 2.0 user provisioning, letting your identity provider (Okta, Microsoft Entra ID, OneLogin, or any SCIM 2.0 compliant directory) automatically create and remove users in your organization instead of managing them by hand.
Requirements
SCIM reuses the same Enterprise entitlement as Single Sign-On, so it needs the same license:
- Cloud — the organization owner's account must be on the Enterprise billing tier
- Self-hosted — an active Enterprise license with the
ssofeature enabled - Organization Owner or Admin role to generate or remove SCIM connections
Generating a SCIM Token
- Navigate to Settings → Authentication → SSO
- In the SCIM Provisioning panel, click Generate token
- Enter a Connection ID — a short slug for this IdP connection (lowercase letters, numbers, and dashes only), e.g.
okta-prod - Copy the bearer token shown in the dialog immediately — it is stored hashed and displayed only once
- Copy the SCIM Base URL shown above the connection list
Configuring Your Identity Provider
Enter these values in your IdP's SCIM app configuration:
| Setting | Value |
|---|---|
| SCIM Base URL | https://<your-instance>/api/auth/scim/v2 |
| Authentication | Bearer token |
| Token | the value generated above |
The IdP authenticates every request with a Bearer token and drives the standard SCIM 2.0 user lifecycle against that base URL:
| Method | Endpoint | Action |
|---|---|---|
POST | /Users | Create a user |
GET | /Users, /Users/:id | List / read a user |
PUT, PATCH | /Users/:id | Update a user |
DELETE | /Users/:id | Remove a user |
Example request to verify a connection is reachable:
curl 'https://<your-instance>/api/auth/scim/v2/Users' \
-H 'Authorization: Bearer <your-scim-token>' \
-H 'Accept: application/scim+json'These calls are made by your IdP's provisioning engine — you don't need to call them manually.
Managing Connections
The SCIM Provisioning panel lists every active connection by its Connection ID. Removing a connection revokes its token immediately; the IdP will no longer be able to provision or deprovision users through it until you generate a new one.
Token generation and connection removal are recorded in the organization's audit log.
Notes
- Each token is scoped to the organization that generated it.
- Connection IDs are unique platform-wide — if a slug like
okta-prodis already taken, choose another. - SCIM-provisioned users join the organization directly; they don't go through the email invitation flow used for manually invited members.