Skip to main content

​
SCIM provisioning

SCIM lets your identity provider (Okta, Microsoft Entra ID, Google Workspace, etc.) create, update, and deactivate end-user records in Cobalt automatically, so the people your agents talk to are known the moment they arrive — no manual setup, no waiting for a first message to resolve them. SCIM is the authoritative, happy-path way to populate identity. When it’s in place, channel identities (Slack, Teams, web) resolve to the right person by email with no rules or review needed.
SCIM provisions end users (the directory of people your agents serve). It is separate from administrator sign-in — admins are governed by SSO and roles. Many customers use both: SSO for admins, SCIM for the wider user directory. Like SSO, SCIM is available on plans that include it — talk to us if you don’t see it in Settings.

​
Set it up

1

Open Settings → SCIM

Requires the Admin or Owner role.
2

Copy the SCIM base URL

Cobalt shows the SCIM 2.0 endpoint to give your IdP — copy it from the console (it ends in /api/v1/scim/v2).
3

Generate a bearer token

Click Generate token. The token is shown once — copy it immediately and paste it into your IdP’s SCIM app. Cobalt stores only a hash; it can’t be shown again. If you lose it, revoke and generate a new one.
4

Configure your IdP's SCIM app

Point your IdP at the base URL with the bearer token, and assign the users (or groups) you want provisioned. Use email as the primary attribute.
Cobalt’s SCIM endpoint supports user provisioning operations (create, update, deactivate). It does not yet implement user listing or filtering (GET /Users), which some IdP setup wizards use for an initial “match existing users” pass — if your IdP offers that step, skip it and let assignment-driven provisioning create the records. Group provisioning is not supported; assign users (directly or via group assignment in the IdP), and the IdP sends individual user operations.

​
What provisioning does

  • Create / update — each provisioned user becomes a canonical person in your tenant, keyed by their verified email. Subsequent Slack/Teams/web identities for that email link to them automatically.
  • De-provision — when your IdP deactivates a user, Cobalt deactivates the corresponding record. Their history is retained; new activity won’t resolve to the deactivated identity.
  • High trust — SCIM-provisioned identities are treated as cryptographically verified, so they’re eligible for the strictest authorization tiers (see trust tiers).

​
Manage tokens

  • Revoke a token from the SCIM page at any time; requests using it stop working immediately.
  • The page also shows whether ingest is enabled and the health of the provisioning queue. If ingest is paused, your IdP’s changes are queued durably and applied when it resumes — you won’t lose events.
Treat the SCIM token like a password. Anyone holding it can provision and de-provision users in your tenant. Rotate it if it may have leaked.