Skip to content
Docs

    Provision users with SCIM

    3 min read · Updated View as Markdown

    SCIM 2.0 lets your identity provider (IdP) create, update and deactivate Tracix accounts for you, so people join and leave Tracix when they join and leave your company. SCIM works alongside single sign-on: the people it provisions sign in through your IdP.

    Before you begin

    • You need the Owner, Admin or MSP admin role.
    • Set up single sign-on first, with your domain verified. Provisioned people sign in with SSO, and SSO links each sign-in to the provisioned account.

    Connect your identity provider

    1. Create a SCIM token

      In the console, open Security. In the Enterprise SSO section, under SCIM provisioning, select Rotate SCIM token. Copy the token from New SCIM token — save it now: it starts with scim_ and is shown only once.

    2. Configure your IdP's SCIM app

      In your IdP's provisioning settings for the Tracix app, enter the base URL and the token:

      SettingValue
      SCIM base URLhttps://cloud.tracix.io/api/auth/scim/v2
      AuthenticationHTTP bearer token: the scim_ token

    3. Map externalId to the user's SSO subject

      Set the SCIM externalId attribute to the same immutable value your SSO sends: the OIDC subject (sub) or the signed SAML NameID. Don't map it to an email address or username. Tracix uses it to match each SSO sign-in to the provisioned account.

    4. Assign people

      Assign people, and groups if you push them, to the Tracix app in your IdP. Your IdP creates their accounts in your organization.

    What SCIM does in Tracix

    Your IdP does thisTracix does this
    Creates a userCreates an account in your organization with the Member role. The email address can't already belong to a Tracix account.
    Updates a userUpdates the account's profile.
    Deactivates a user (active: false)Blocks sign-in, ends the person's sessions and removes their access to every workspace.
    Reactivates a user (active: true)Allows sign-in again. Add the person back to workspaces on their Access tabs.
    Pushes groupsStores the groups and their members. Groups don't grant roles in Tracix.

    At each SSO sign-in, the person's organization role comes from the Default role and Group-to-role mappings in your SSO settings; see Map identity provider groups to roles. Workspace access isn't provisioned through SCIM: grant it on each workspace's Access tab.

    Endpoints

    All paths are relative to the base URL, https://cloud.tracix.io/api/auth/scim/v2, and every request carries Authorization: Bearer <SCIM token>.

    PathUse
    /Users, /Users/{id}Create, read, update and deactivate users
    /Groups, /Groups/{id}Create, read, update and delete groups and their members
    /ServiceProviderConfigWhat the SCIM server supports
    /Schemas, /ResourceTypesThe user and group schemas

    Rotate the token

    Select Rotate SCIM token again to create a new token. The previous token stops working immediately, so paste the new one into your IdP right away.

    Next steps

    Single sign-onGroup mappings and required SSOUsers and rolesOrganization and workspace rolesInvite your teamGrant workspace access
    Report a problem with this page