SCIM provisioning

SCIM is the push path: your IdP creates, updates, and deactivates Exo users and groups as your directory changes. No schedule, no polling. Exo implements the SCIM 2.0 protocol (RFC 7644), so any compliant provider (Okta, Microsoft Entra, OneLogin, JumpCloud) can drive it with its SCIM connector.

What SCIM gives you

• New hires provisioned into Exo the moment they're assigned the app.
• Profile and group-membership changes mirrored as they happen.
• A deactivated user loses access at once, with no manual cleanup.

SCIM handles directory data only; it doesn't log users in. Pair it with SSO for sign-in. SCIM keeps the roster current, SSO authenticates each session.

Set it up

Under Dashboard → Identity providers (needs idp:write), add a SCIM provider, name it, and optionally record the vendor. Click Rotate token to mint a bearer token, shown once. Paste the base URL and token into your IdP's SCIM connector and enable provisioning there.

Base URL & token

1Base URL    https://exo.example.com/api/v1/scim/v2
2Token       scim_xxxxxxxx…           (Authorization: Bearer, shown once)
3Headers     Content-Type: application/scim+json on POST / PUT / PATCH

Users & groups

Exo serves the standard /Users and /Groups resource endpoints with full create, read, update (PUT), patch, and delete, plus the filtering and pagination IdPs rely on:

1Users     GET · POST · GET/{id} · PUT/{id} · PATCH/{id} · DELETE/{id}
2Groups    GET · POST · GET/{id} · PUT/{id} · PATCH/{id} · DELETE/{id}
3Discovery /ServiceProviderConfig · /ResourceTypes · /Schemas

User records carry userName, externalId, displayName, emails, active, and group references; setting active: false deactivates the user in Exo. Group records carry displayName, externalId, and members.

Groups & roles

Pushed groups land under Dashboard → Groups as IdP-sourced; your IdP owns membership. Groups don't grant roles: provisioned users land as Member and an admin assigns each user's single role from the dashboard. Use groups to scope per-agent access lists instead. See Roles & permissions.

Rotate & revoke

Rotate the token from the provider row whenever you suspect exposure. The old token stops working at once, so update your IdP in the same change window. To stop provisioning entirely, disable or delete the provider; the SCIM endpoint rejects the token immediately.