Provision people with SCIM

With SCIM 2.0 your directory can create, update, deactivate, reactivate and delete people in Orbit.

Endpoint and keys

The endpoint is /api/v1/scim/v2/<connectionId>/, with Users, Groups, ServiceProviderConfig, ResourceTypes and Schemas. It accepts application/scim+json bodies of up to 1 MiB, with 600 requests a minute per key. The connection must have a verified domain, and each user’s userName must be an e-mail address in that domain.

A SCIM request authenticates with a bearer key: Authorization: Bearer osc_....

Key setting	Value
Who creates it	An organization owner or admin, in Provisioning for the connection, after re-entering their password
Scopes	any of `users:read`, `users:write`, `groups:read`, `groups:write`
Lifetime	1 to 365 days
Shown	Once, in the creation answer. The list shows only a prefix.
Live at once	At most two

Rotate a key by creating the replacement, switching the directory over, and then revoking the old key. A revoked or expired key answers 401.

Binding a person to the provider

Immediate binding. Send the Orbit extension urn:orbit:params:scim:schemas:extension:identity:2.0:User with the person’s OIDC subject (kind: "oidc_sub", the issuer and the value) on POST /Users. The person is bound, becomes an organization member, and signs in through the normal OIDC route.
Binding by e-mail. Without the extension, as with Microsoft Entra ID, the person stays pending and disabled until the first sign-in. If the provider’s e-mail equals the directory’s userName inside a verified domain, the account is bound to that subject in the same step. Anything else (unknown e-mail, email_verified=false, a subject already owned) is refused like an unknown subject. A bound subject never rebinds. For Entra ID, set “Assignment required = Yes” on the enterprise app.

Access to work

On an organization with exactly one active site, a SCIM-created person is admitted to that site at once as a regular member. A site administrator can change or remove that membership. Organizations with several sites get no automatic grant, and project membership is added as usual.

Deactivate, reactivate and delete

Deactivation (active=false, or DELETE) takes effect at once. The person’s sessions are refused, and a new sign-in is refused. In the products, access ends within seconds, when the revocation worker removes the session.
Reactivation (active=true) allows sign-in again with a new session.
DELETE is permanent. It keeps a tombstone: creating the same userName again answers 409. In your directory, deactivate people rather than deleting them.
Deactivating the only organization owner or the last site administrator is refused with a 409.

SCIM owns every managed account of its connection, including members who enrolled through OIDC enrollment.

Groups

Groups are accepted and stored but not mapped: they have no effect on access yet.