> ## Documentation Index
> Fetch the complete documentation index at: https://docs.portkey.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> SCIM integration with Portkey.

# SCIM Integration Guide

Portkey supports **SCIM (System for Cross-domain Identity Management)** to automate user provisioning and deprovisioning.
This guide will walk you through integrating SCIM with your identity provider to manage users and workspaces seamlessly.

***

## Table of Contents

* [What is SCIM?](#what-is-scim)
* [SCIM Base URL](#scim-base-url)
* [Authentication](#authentication)
* [Supported Operations](#supported-operations)
* [Required Configuration](#required-configuration)
* [Identity Provider Setup](#identity-provider-setup)
* [Troubleshooting](#troubleshooting)

***

## What is SCIM?

SCIM is an open standard that allows organizations to automate the management of user identities and groups across applications. By integrating with SCIM, you can:

* Automatically provision and update user accounts.
* Deprovision users when they leave your organization.
* Sync user attributes and workspace memberships.

<Note>
  SCIM will only provision users whose email belongs to a **valid and verified domain** configured for your organization in the Portkey dashboard (`Admin Settings > Authentication Settings > Allowed Domains`). Users with unverified or unconfigured domains will not be provisioned.
</Note>

## SCIM Base URL

To integrate SCIM with our platform, get the SCIM Base URL from Portkey Control Plane.

`Admin Settings > Authentication Settings > SCIM Provisioning > SCIM URL`

## Authentication

We use **Bearer Token Authentication** for SCIM requests.

You need to generate an **API token** from Portkey Control Plane (\`\`Admin Settings > Authentication Settings > SCIM Provisioning\`) and use it as a bearer token in the SCIM requests.

You need to include the following header in the SCIM requests:

```
Authorization: Bearer <your-api-token>
```

## Supported Operations

Our SCIM implementation supports the following operations:

| Operation                        | Supported |
| -------------------------------- | --------- |
| User Provisioning                | ✅         |
| User Deprovisioning              | ✅         |
| User Updates                     | ✅         |
| Group (Workspace) Provisioning   | ✅         |
| Group (Workspace) Updates        | ✅         |
| Group (Workspace) Deprovisioning | ✅         |

## Required Configuration

Before integrating SCIM, ensure you have the following details:

* **SCIM Base URL**: Provided above.
* **Bearer Token**: Generate this token from our platform’s **API Settings** section.

You will need to provide these details in your identity provider's SCIM configuration section.

## Identity Provider Setup

Follow your identity provider's documentation to set up SCIM integration. Below are the key fields you’ll need to configure:

| Field         | Value              |
| ------------- | ------------------ |
| SCIM Base URL | `<SCIM Base URL>`  |
| Bearer Token  | `<your-api-token>` |

Currently, we support SCIM provisioning for the following identity providers:

* [Azure AD](./azure-ad)
* [Okta](./okta)

## Troubleshooting

### Common Issues

* **Invalid Token**: Ensure the bearer token is correctly generated and included in the request header.
* **403 Forbidden**: Check if the provided SCIM Base URL and token are correct.
* **User Not Provisioned**: Ensure the user attributes meet our platform's requirements.

***

For further assistance, please contact our support team at [support@portkey.ai](mailto:support@portkey.ai).

***

<Card title="Portkey is now PRISMA AIRS AI Gateway. See it in action." href="https://www.paloaltonetworks.in/ai-security/ai-gateway?utm_source=portkey&utm_medium=referral&utm_campaign=prisma_airs&utm_content=docs_nav#contact" icon="arrow-up-right-from-square">
  Contact Us
</Card>


## Related topics

- [Overview](/docs/guides/integrations.md)