Manual
Overview Getting Started Core concepts Quick Start Guide Create an account and sign in Projects Create and manage projects Project settings Languages Workflow and translation lock Translation Keys Key names and groups ICU messages and placeholders Translating The translation editor Keyboard shortcuts Machine translation Review & Reports Review workflow Reports Branches & Merging Branch workflows: create, merge, and delete The Branches page Tags Translation Memory How translation memory works Glossary The glossary Import & Export Import and export files File formats Integrations GitHub GitLab Slack, Mattermost and Microsoft Teams Repository and API keys Tags from Git tags Webhooks Teams & Access Roles and permissions Teams Inviting people Project access Account & Organization Account settings Organization settings Billing & Plans Plans and limits
CLI
Overview Installation Set up a project Configuration File formats Use the CLI in CI Commands ct push ct pull ct status ct translate ct check ct merge ct tag ct init ct snippet
API
Overview Introduction Authentication Languages and time zones Rate limiting Errors Endpoints Authentication routes Account Organisation Teams Projects Project languages Project members and teams Project webhooks Project API keys Branches Tags Keys Translations and review CLI and CI Translation memory Glossary GitHub GitLab Repository link Guides Pull translations for your build MCP server for AI agents
Log in Get started free
Organisation

SCIM provisioning

Lets your identity provider add members when they join the company and remove them when they leave, over SCIM 2.0.

3 min read · Updated October 2026

Your identity provider (Okta, Microsoft Entra ID, OneLogin and others) can create, update and deprovision the members of your organisation over SCIM 2.0. Removing someone at the provider removes them here, which is usually what a security review asks for. SCIM is part of the single sign-on feature and is available on the same plans.

Set up #

  1. Verify the email domains your members use, see Single sign-on. SCIM only provisions people on a verified domain.
  2. Create a token. It is shown once.
  3. In your identity provider, add a SCIM 2.0 application with the base URL and the token as a bearer token. Map userName to the email address.
HTTP 
GET /org/scim
POST /org/scim/token
DELETE /org/scim/token

Access: Session token only. Role: Organisation owner or admin.

GET answers 200 with enabled, baseUrl (…/scim/v2), last4, createdAt and available. POST makes a token and answers 200 with the same fields plus token; an earlier token stops working. DELETE revokes it and answers 204. The audit log records org.scim_token_created and org.scim_token_revoked.

What is supported #

All routes are under /scim/v2 and need Authorization: Bearer <token>.

Route
GET /ServiceProviderConfig, GET /ResourceTypesDescribe what is supported.
GET /UsersLists the members. startIndex and count (at most 200) page the list. filter supports userName eq "…", externalId eq "…" and emails.value eq "…".
GET /Users/{id}One member. The id is the account id.
POST /UsersAdds a member. Answers 409 when the person is already a member.
PUT /Users/{id}, PATCH /Users/{id}Updates the name and externalId, and active. Both the Okta and the Entra ID style of PATCH work.
DELETE /Users/{id}Removes the member.
GET /GroupsAlways empty. Groups are not supported.

Things to know:

  • People are added as members, with the role chosen in the single sign-on settings. An existing account with the same email address is added to the organization instead of being duplicated.
  • Email addresses are not changed. userName and emails are read-only here, because the account may belong to other organizations too.
  • Deactivating (active: false) or deleting removes the person from the organization, its teams and its projects. When it was their only organization, their sessions and API keys end too. What they wrote stays. The owner cannot be deprovisioned (403): transfer ownership first.
  • Reactivating (active: true) adds a former member back, on a verified domain.
  • New members count against the plan: when it has no room, the answer is 403.

Errors use the SCIM format (schemas, status, scimType, detail) and the content type application/scim+json. A missing or wrong token gets 401.

Audit log #

Each change records an entry by “identity provider”: scim.user_provisioned, scim.user_updated and scim.user_deprovisioned.