SCIM provisioning
With SCIM your identity provider pushes changes to Waxell: assign someone to the app and they get an account; unassign or deactivate them and their access is revoked.
Turn it on
- Settings → Identity → edit your provider → SCIM provisioning.
- Click Generate token. Copy it now: it's shown once. Rotate token issues a new one and the old one stops working immediately.
- Give your IdP:
| Setting | Value |
|---|---|
| SCIM base URL | https://<workspace>.waxell.dev/api/scim/v2/ |
| Authentication | HTTP header Authorization: Bearer <token> |
| Unique identifier | userName (the user's email) |
A token belongs to one provider in one workspace, and works only on that workspace's URL.
Okta
In your Waxell app integration: General → Provisioning → SCIM, then on the Provisioning tab:
- SCIM connector base URL: the base URL above
- Unique identifier field for users:
userName - Authentication Mode: HTTP Header → paste the token
- Test Connector Configuration → Save
- To App: enable Create Users, Update User Attributes and Deactivate Users
- Push Groups to create Waxell teams from Okta groups
Microsoft Entra
In the Waxell enterprise application: Provisioning → Get started → Automatic.
- Tenant URL: the base URL above
- Secret Token: the token
- Test Connection → Save, then Start provisioning
What each operation does
| SCIM request | In Waxell |
|---|---|
POST /Users | Creates the user (if needed) and adds them to the workspace as a member |
PUT / PATCH /Users/{email} | Updates name and active |
PATCH with active: false, or DELETE /Users/{email} | Deprovisions: see Offboarding |
GET /Users?filter=userName eq "jane@acme.com" | Looks up one user |
POST /Groups | Creates a team in this workspace |
PATCH /Groups/{id} (add/remove members) | Adds or removes team members |
PUT /Groups/{id} | Renames the team and replaces its members |
DELETE /Groups/{id} | Deletes the team |
User IDs are the user's email address. Group IDs are the team slug.
Endpoints
| Path | Methods |
|---|---|
/api/scim/v2/ServiceProviderConfig | GET |
/api/scim/v2/Users | GET, POST |
/api/scim/v2/Users/{email} | GET, PUT, PATCH, DELETE |
/api/scim/v2/Groups | GET, POST |
/api/scim/v2/Groups/{id} | GET, PUT, PATCH, DELETE |
SCIM only ever sees the workspace whose URL it's called on, and only that workspace's teams.