SCIM provisioning: automatically sync users and groups

How to automatically create, update, deactivate, and remove Fyxer users, and keep teams in sync with your groups, from your identity provider using SCIM 2.0.

With SCIM, your identity provider (IdP) manages your Fyxer users for you. When someone joins, changes teams, or leaves in your IdP (for example Okta, Microsoft Entra ID, or OneLogin), Fyxer is updated automatically, with no manual inviting or removing.

SCIM is an Enterprise plan feature and is set up with help from the Fyxer team. We recommend setting up single sign-on (SSO) first.

What SCIM does

Provisioning: creates a Fyxer account for each active user assigned to the Fyxer app in your IdP, and emails them a link to log in (via your SSO, if configured).
Updates: keeps each user's name, profile photo, and login email in sync with your IdP.
Deactivation: marking a user inactive in your IdP revokes their Fyxer access. The account is kept, so they can be reactivated later.
Deprovisioning: deleting a user removes them from your organization and frees their seat.
Teams from groups: creates a matching Fyxer team for each IdP group you assign to Fyxer, and keeps both the team's name and its membership in sync.

What Fyxer gives you

To connect SCIM, Fyxer provides two values for your IdP's SCIM/provisioning settings:

Field	Value
SCIM Base URL (SCIM 2.0 endpoint)	Provided by Fyxer during setup (ends in `/scim/v2`)
Bearer token (secret)	Provided by Fyxer during setup

The bearer token authenticates your IdP to Fyxer, so treat it like a password. Store it securely and let us know if it's ever exposed so we can rotate it.

How to set it up

Ask the Fyxer team to enable SCIM for your organization (via your account manager or the chat in the bottom right of your Dashboard). We'll send you your SCIM Base URL and bearer token.
In your IdP's Fyxer application, open the Provisioning (SCIM) settings.
Enter the SCIM Base URL and bearer token.
Enable the actions you want: create users, update users, and deactivate users.
Assign users (and groups) to the Fyxer app to provision them.

The exact menu names vary by provider. In Okta it's the app's "Provisioning" tab; in Microsoft Entra ID it's "Provisioning" with "Tenant URL" (the SCIM Base URL) and "Secret Token" (the bearer token).

Attribute mapping

Most IdPs let you customize how their user and group fields map to SCIM attributes. Fyxer expects the standard SCIM 2.0 core attributes below; any other attribute is accepted but ignored.

User attributes (your IdP → Fyxer)

SCIM attribute	Required	Maps to in Fyxer	Notes
`userName`	Yes	Login email address	Must be the user's email; it's the unique identifier for the account (matched case-insensitively). Changing it in your IdP updates the user's Fyxer login email.
`displayName`, or `name.formatted`, or `name.givenName` + `name.familyName`	No	Display name	Fyxer uses the first of these that's present, in that order (given + family name is used only when both are set). The values you send are stored and returned exactly as sent.
`active`	No	Account status	Omitted counts as active. `false` deactivates the user (access revoked, account kept); `true` reactivates them. Creating a brand-new user with `active: false` is rejected.
`externalId`	Recommended	IdP identity link	Stored and returned so Fyxer and your IdP can reliably match the user.
`photos`	No	Profile photo	The photo marked `primary` is used (otherwise the first one).
`groups`	Read-only	Teams the user belongs to	Returned when reading a user. To change membership, update the group (see below).

Group attributes (your IdP → Fyxer)

SCIM attribute	Required	Maps to in Fyxer	Notes
`displayName`	Yes	Team name	Creates or renames the matching Fyxer team. Team names are unique per organization; a conflicting name is rejected.
`members`	No	Team membership	Kept in sync: members can be added, removed, and replaced. Each member's `value` is the Fyxer user id your IdP received when the user was provisioned. Members join teams with the Member role.
`externalId`	Recommended	IdP identity link	Stored and returned so your IdP can match the group to the team.

Supported capabilities

Authentication: OAuth bearer token (the token Fyxer gives you) is the primary scheme; HTTP Basic is also available.
Resource types: User and Group, plus the standard /Schemas, /ResourceTypes, and /ServiceProviderConfig discovery endpoints.
Filtering: eq filters on userName and emails.value for users, and on displayName for groups (all case-insensitive). Lists are paginated with up to 100 results per page (200 max filtered results).
PATCH is supported for users and groups, and Bulk is supported with up to 1,000 operations (1 MB payload) per request.
Not supported: sorting, password change (sign-in is handled by your IdP/SSO), and ETag versioning.

Deactivating vs deleting a user

Deactivate (set active to false): the user immediately loses access to your organization, but their account and data are kept. Setting active back to true, or re-assigning them to the Fyxer app in your IdP, restores their access in place.
Delete (a SCIM delete): the user is removed from your organization and their seat is freed. If your organization was the only place they used Fyxer, their Fyxer account is deleted entirely. To bring a deleted user back, assign them in your IdP again and they'll be provisioned as a fresh account.

In rare cases a delete is temporarily refused (for example while an account is subject to a data hold). Your IdP will show a sync error and retry.

Things to know

New users get an email. When a user is provisioned, Fyxer emails them a login link (pointing at your SSO if it's configured) so they can get started right away.
Team management moves to your IdP. Once your organization is SCIM-managed, team controls in the Fyxer Dashboard are limited; manage teams and their membership from your IdP.
SSO + SCIM work best together. SSO handles sign-in; SCIM handles who exists. Most enterprises use both.