SCIM provisioning

If your company manages accounts in an identity provider, SCIM lets it create and deactivate os.construction users for you, so people get an account when they join and lose access the day they leave.

Set up a connection

Connections are managed over the REST API by a company admin. There is no screen for them yet.

List connections with GET /rest/v1.0/companies/{company_id}/scim_connections (labels and dates, never tokens). Revoke one with DELETE /rest/v1.0/companies/{company_id}/scim_connections/{id}; requests with its token stop working at once.

What’s supported

Operation	Endpoint	Notes
List users	GET /Users	Paged with startIndex and count (up to 100). Filter with userName eq "name@company.com" only.
Get a user	GET /Users/{id}
Create a user	POST /Users	userName must be an email. Optional name (givenName, familyName, formatted), displayName and active.
Update a user	PATCH /Users/{id}	replace operations on active, name.givenName, name.familyName and displayName.
Deprovision	DELETE /Users/{id}	Deactivates the user. Their history stays on every record.

Setting active to false, or deleting the user, ends their sessions and revokes their API tokens straight away.

What a provisioned user gets

A SCIM-created user is an account in your company with no password and no project access:

• Project access: add them to projects and give them a template in each project’s Directory. See Invite your team.
• Signing in: until single sign-on ships, they set a password through password recovery (a Forgot password link on the sign-in page arrives with self-serve signup, Preview).

What’s Planned

• Single sign-on (SAML or OIDC) and sign-in started from the identity provider.
• Groups, and mapping groups to permission templates or projects.
• A Company Admin screen for SCIM connections.