> ## Documentation Index
> Fetch the complete documentation index at: https://developers.entri.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM User Provisioning

> Provision, update, and remove Entri dashboard users from your identity provider with SCIM 2.0.

## Overview

Entri supports SCIM 2.0 so your identity provider can manage who has access to the Entri dashboard. Once connected, assigning a user to the Entri application in Okta, Microsoft Entra ID, or any other SCIM 2.0 client creates their dashboard account, and unassigning them removes it. SCIM is available on plans that include enterprise SSO.

## What SCIM does

| Action in your identity provider | Result in Entri |
| - | - |
| Assign a user to the Entri application | A dashboard user is created with the **Analyst** role. No invitation email is sent. The user signs in through SSO. |
| Change the user's email address | The dashboard user's email is updated. |
| Unassign or deactivate the user | The dashboard user is deleted. Reassigning the user creates a new account with the Analyst role. |
| Delete the user | The dashboard user is deleted. |

<Warning>
  Roles and permissions are not synced through SCIM. Every provisioned user starts as an Analyst. An Entri admin changes roles in the dashboard after the user is created. Role, group, and custom attributes sent by your identity provider are ignored.
</Warning>

<Note>
  Groups are not supported. Only the User resource is available, so group push has no effect. Deactivating a user removes the account rather than suspending it, and there is no inactive state.
</Note>

## Setup

<Steps>
  <Step title="Copy your SCIM credentials from the Entri dashboard">
    Open the SCIM settings in the Entri dashboard and copy the **SCIM base URL** and the **bearer token**. The token is shown in full, so store it somewhere safe.
  </Step>

  <Step title="Create a SCIM integration in your identity provider">
    Add a SCIM 2.0 provisioning integration for Entri and paste the base URL and token. Authentication is an HTTP bearer token sent in the `Authorization` header.
  </Step>

  <Step title="Map attributes">
    Map the attributes listed below and leave all others unmapped. Enable provisioning for create, update, and deactivate.
  </Step>

  <Step title="Assign users">
    Assign users or groups to the Entri application. Each user appears in the Entri dashboard once your identity provider runs its next sync.
  </Step>
</Steps>

<Warning>
  The bearer token expires **180 days** after it is generated. Generate a new token in the Entri dashboard before it expires and update your identity provider. Requests with an expired token fail with `403`.
</Warning>

## Attribute mapping

Entri reads three attributes from each user.

| SCIM attribute | Required | Entri field |
| - | - | - |
| `userName` | Yes | The user's email address, used to sign in. |
| `emails[type eq "work"].value` | No | The same email address as `userName`. |
| `active` | No | Setting this to `false` deletes the user. |

## Endpoints

The base URL is `https://api.goentri.com/integration/scim/v2`.

| Method | Path | Notes |
| - | - | - |
| `GET` | `/Users` | Supports `filter=userName eq "email"`, `startIndex`, and `count`. Maximum `count` is 100. |
| `POST` | `/Users` | Returns `400` if the email already belongs to a user in your organization. |
| `GET` | `/Users/{id}` | Returns a single user. |
| `PUT` | `/Users/{id}` | Updates `userName` and `active`. |
| `PATCH` | `/Users/{id}` | Supports `replace` and `add` operations on `userName`, `emails`, and `active`. |
| `DELETE` | `/Users/{id}` | Returns `204`. |
| `GET` | `/ServiceProviderConfig` | Describes supported features. Bulk operations, sorting, ETags, and password changes are not supported. |
| `GET` | `/ResourceTypes` | Lists the User resource type. |
| `GET` | `/Schemas` | Returns the User schema. |

## Troubleshooting

| Symptom | Cause |
| - | - |
| Every request returns `403` | The token has expired or was regenerated. Copy the current token from the dashboard into your identity provider. |
| Assignment fails with `User already exists` | The email already belongs to a dashboard user in your organization. Remove the existing user in the dashboard, or unassign and reassign the user in your identity provider. |
| A user was created with the wrong role | Expected. Roles are set in the dashboard, not by SCIM. |
| A deactivated user is missing from the dashboard | Expected. Deactivation deletes the account. |