# SCIM provisioning

Let your identity provider create, update and deactivate the people on your SendBeam account through SCIM 2.0.

SCIM (System for Cross-domain Identity Management) is how an identity provider such as Okta, Microsoft Entra ID or Google Workspace keeps the people in an application in step with its own directory. Assign someone the SendBeam app in the provider and they get a seat; remove them and the seat goes, the same day they leave.

## What SCIM does here

- A SCIM user is a person on your **account**. Provisioning gives them a member seat in **every workspace on the account**; a workspace admin can promote them in the app afterwards.
- Deactivating or deleting a user takes every seat on the account away. Their other SendBeam accounts, if any, are untouched. A person who owns a workspace cannot be deprovisioned until ownership is transferred.
- Names are kept in step. The login address is the SCIM `userName` and cannot be changed through SCIM.
- Groups are not offered. Roles are set in the app.

## Setting it up

1. Under **Settings → Account → SCIM provisioning**, a workspace admin generates a token. It is shown once.
2. In the identity provider, add SendBeam as a SCIM application with the base URL `https://sendbeam.io/scim/v2` and the token as the bearer token. Choose the *Users* resource only.
3. Assign the app to the people or groups who should have access. The provider creates each person within minutes and keeps them updated.
4. Generate a new token to rotate; revoke it to stop provisioning. Existing seats stay until the provider or an admin removes them.

Provisioned people sign in through single sign-on, a passkey they add, or a sign-in link to their address; no password is set.

## What each operation means

| Request | Effect |
| --- | --- |
| `GET /Users`, with `filter=userName eq "…"` | Lists the people on the account, one page at a time. |
| `POST /Users` | Creates the login if the address is new, and seats the person in every workspace on the account. |
| `PATCH /Users/{id}` with `active: false` | Removes every seat on the account. With `active: true`, seats them again. |
| `PATCH` or `PUT` with a name | Updates the display name. |
| `DELETE /Users/{id}` | The same as deactivating. |

## Limits

- Pages hold up to 200 users; use `startIndex` and `count` for more.
- Filtering supports equality on `userName` or an email value, which is what providers send to check whether a person already exists.
- Too many wrong tokens from one address pause that address for a quarter of an hour.

---
Source: https://sendbeam.io/docs/admin/scim