> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning

> Auto-provision and de-provision users from your identity provider.

# SCIM provisioning

SCIM lets your identity provider (Okta, Microsoft Entra ID, Google Workspace,
etc.) create, update, and deactivate **end-user** records in Cobalt automatically,
so the people your agents talk to are known the moment they arrive — no manual
setup, no waiting for a first message to resolve them.

SCIM is the **authoritative, happy-path** way to populate identity. When it's in
place, channel identities (Slack, Teams, web) resolve to the right person by email
with no rules or review needed.

<Note>
  SCIM provisions **end users** (the directory of people your agents serve). It is
  separate from administrator sign-in — admins are governed by
  [SSO](/identity/sso) and [roles](/identity/roles-and-team). Many customers use
  both: SSO for admins, SCIM for the wider user directory. Like SSO, SCIM is
  available on plans that include it — talk to us if you don't see it in
  Settings.
</Note>

## Set it up

<Steps>
  <Step title="Open Settings → SCIM">
    Requires the **Admin** or **Owner** role.
  </Step>

  <Step title="Copy the SCIM base URL">
    Cobalt shows the SCIM 2.0 endpoint to give your IdP — copy it from the
    console (it ends in `/api/v1/scim/v2`).
  </Step>

  <Step title="Generate a bearer token">
    Click **Generate token**. The token is shown **once** — copy it immediately
    and paste it into your IdP's SCIM app. Cobalt stores only a hash; it can't be
    shown again. If you lose it, revoke and generate a new one.
  </Step>

  <Step title="Configure your IdP's SCIM app">
    Point your IdP at the base URL with the bearer token, and assign the users (or
    groups) you want provisioned. Use **email** as the primary attribute.
  </Step>
</Steps>

<Note>
  Cobalt's SCIM endpoint supports **user provisioning operations** (create,
  update, deactivate). It does not yet implement user **listing or filtering**
  (`GET /Users`), which some IdP setup wizards use for an initial
  "match existing users" pass — if your IdP offers that step, skip it and let
  assignment-driven provisioning create the records. Group provisioning is not
  supported; assign users (directly or via group assignment in the IdP), and the
  IdP sends individual user operations.
</Note>

## What provisioning does

* **Create / update** — each provisioned user becomes a canonical person in your
  tenant, keyed by their verified email. Subsequent Slack/Teams/web identities for
  that email link to them automatically.
* **De-provision** — when your IdP deactivates a user, Cobalt deactivates the
  corresponding record. Their history is retained; new activity won't resolve to
  the deactivated identity.
* **High trust** — SCIM-provisioned identities are treated as cryptographically
  verified, so they're eligible for the strictest authorization tiers (see
  [trust tiers](/identity/end-user-identity#trust-tiers)).

## Manage tokens

* **Revoke** a token from the SCIM page at any time; requests using it stop
  working immediately.
* The page also shows whether **ingest is enabled** and the health of the
  provisioning queue. If ingest is paused, your IdP's changes are queued durably
  and applied when it resumes — you won't lose events.

<Warning>
  Treat the SCIM token like a password. Anyone holding it can provision and
  de-provision users in your tenant. Rotate it if it may have leaked.
</Warning>

## Related

* How provisioned users tie into channels: [End-user identity](/identity/end-user-identity).
* Administrator sign-in and groups: [Enterprise SSO](/identity/sso).