SendBeam

SCIM provisioning

Let your identity provider create, update and deactivate the people on your SendBeam account through SCIM 2.0.

View as Markdown

SCIM (System for Cross-domain Identity Management) is how an identity provider such as Okta, Microsoft Entra ID or Google Workspace keeps the people in an application in step with its own directory. Assign someone the SendBeam app in the provider and they get a seat; remove them and the seat goes, the same day they leave.

What SCIM does here

  • A SCIM user is a person on your account. Provisioning gives them a member seat in every workspace on the account; a workspace admin can promote them in the app afterwards.
  • Deactivating or deleting a user takes every seat on the account away. Their other SendBeam accounts, if any, are untouched. A person who owns a workspace cannot be deprovisioned until ownership is transferred.
  • Names are kept in step. The login address is the SCIM userName and cannot be changed through SCIM.
  • Groups are not offered. Roles are set in the app.

Setting it up

  1. Under Settings → Account → SCIM provisioning, a workspace admin generates a token. It is shown once.
  2. In the identity provider, add SendBeam as a SCIM application with the base URL https://sendbeam.io/scim/v2 and the token as the bearer token. Choose the Users resource only.
  3. Assign the app to the people or groups who should have access. The provider creates each person within minutes and keeps them updated.
  4. Generate a new token to rotate; revoke it to stop provisioning. Existing seats stay until the provider or an admin removes them.

Provisioned people sign in through single sign-on, a passkey they add, or a sign-in link to their address; no password is set.

What each operation means

RequestEffect
GET /Users, with filter=userName eq "…"Lists the people on the account, one page at a time.
POST /UsersCreates the login if the address is new, and seats the person in every workspace on the account.
PATCH /Users/{id} with active: falseRemoves every seat on the account. With active: true, seats them again.
PATCH or PUT with a nameUpdates the display name.
DELETE /Users/{id}The same as deactivating.

Limits

  • Pages hold up to 200 users; use startIndex and count for more.
  • Filtering supports equality on userName or an email value, which is what providers send to check whether a person already exists.
  • Too many wrong tokens from one address pause that address for a quarter of an hour.