SCIM provisioning

With SCIM 2.0, removing someone in your identity provider removes their access to Cueston. Set it up in Settings → Security → SCIM provisioning.

Connect your identity provider

1. Set up single sign-on and verify your email domains first. SCIM only creates or attaches accounts at domains your workspace has verified.
2. Choose Generate token. Copy the bearer token (it starts with scim_); you won't see it again.
3. In your identity provider's SCIM 2.0 app, paste the base URL and the token.

In Okta, use these in the app's Provisioning settings (SCIM connector base URL, unique identifier field userName, authentication mode HTTP Header). In Microsoft Entra ID, use the base URL as the Tenant URL and the token as the Secret Token.

Treat the token like a password: it can add and remove members. Rotating it stops the old one right away.

What SCIM does

• Create or activate a user: they join the workspace.
• Deactivate or delete a user: their membership is removed, their API keys in this workspace are revoked and their sessions end. Their other workspaces aren't affected.
• Groups to roles: map identity-provider groups to Cueston roles in Settings. People in mapped groups get the highest mapped role; people in no mapped group get the default role. Without mappings, SCIM only sets the default role when someone joins.
• The workspace owner can't be deactivated, deleted or have their role changed through SCIM.

Endpoints

• Responses are application/scim+json; errors use the SCIM error schema.
• Filters: eq clauses joined with and. Users filter on userName, emails.value, externalId, id and active; groups on displayName. Pages use startIndex and count (up to 200).
• PATCH is supported; bulk operations, sorting, ETags and password changes aren't.
• Each token can make 600 requests a minute.