SCIM

SCIM lets your identity provider create, update, and deactivate Stackyapper workspace users. Stackyapper exposes a standard SCIM 2.0 endpoint, so any SCIM 2.0-capable IdP can provision it; the portal documents Microsoft Entra ID and Okta specifically. SCIM is available on Business and is configured by a workspace owner.

Configure your identity provider

The SCIM Tenant URL is:

1https://app.stackyapper.dev/api/better-auth/scim/v2

If your workspace uses a custom access domain, SCIM still runs on app.stackyapper.dev; use the Tenant URL the portal shows.

Generate the token
In Stackyapper, open Settings → Identity & access → Provisioning. Under SCIM provisioning, select Generate token, select Confirm change, and copy the Tenant URL and bearer token immediately.
Enter the credentials in your IdP
Enter the Stackyapper Tenant URL as the SCIM base URL and use the generated value as the bearer or Secret Token.
Test the connection
Test the connection in your IdP before enabling provisioning. The test validates the Tenant URL and token against the live SCIM endpoint.
Start small
Start with a small assigned group and confirm the resulting users in Users & groups.

The bearer token is shown only once, when generated. Store it in your identity provider and an approved secret manager; do not put it in tickets, chat, or documentation.

Microsoft Entra ID

In the Entra enterprise application, set provisioning mode to Automatic, then enter the Tenant URL and Secret Token above.

Entra provisioning runs on its own cycle — expect roughly 40 minutes between Entra sync cycles. A newly assigned user may not appear in Stackyapper until the next cycle completes.

Okta

In Okta, add a private SCIM 2.0 integration with HTTP Header authentication. Use the Tenant URL above as the base URL and the generated token as the bearer token.

Supported attributes

Stackyapper’s SCIM endpoint honors these core user attributes:

SCIM attribute	Used for
`userName`	Required. The user's email address and unique identity in the directory; it cannot change after provisioning
`externalId`	Required. The identity provider's stable object reference for matching; it cannot change after provisioning
`displayName`	The user's display name (falls back to `name.formatted`, then the name components, then the email address)
`name.givenName`, `name.middleName`, `name.familyName`	Name components
`emails` (primary)	The user’s email address
`active`	Activates or deactivates the workspace user

If a workspace member already has the same email address, Stackyapper links the provisioned user to that member instead of creating a new user. Profile changes after provisioning are accepted when the identity provider replaces the full user record; partial updates (PATCH) change only active. Directory lookups support exact userName or externalId filters.

Group provisioning is supported through the SCIM Groups endpoint and pushes group membership into Stackyapper groups. Group sync requires the Business plan; every group member must already be an active user in the same SCIM directory, and a group can have up to 1,000 members. Membership updates must replace the full member list, and group lookups support exact displayName filters. Deleting a group in the directory deletes the matching Stackyapper group.

Rotate the token

Rotation invalidates the previous credential, so coordinate both sides:

In Settings → Identity & access → Provisioning, select Rotate token, then Confirm change, and copy the new token.
Replace the bearer or Secret Token in your IdP immediately.
Test the IdP connection and confirm a provisioning cycle completes.

If your IdP reports 401 Unauthorized after a rotation, it is still using the old token — replace the token in the IdP's provisioning configuration and test the connection again. A 403 response with "SCIM requires the Business plan" means the workspace no longer has a plan that includes SCIM.

Deactivation and access

SCIM controls workspace identity lifecycle. It does not grant app or tool access. Use groups and policy for authorization.

Deactivating or deleting a user in the directory removes them from the workspace, removes their app and tool grants and group memberships in that workspace, and ends their Stackyapper sessions. The workspace's last owner cannot be deprovisioned. Reactivating a user restores basic membership only; grant app and tool access again as needed.

Review deactivated users, AI clients, and personal app authorizations as part of offboarding. To remove organization SCIM rather than rotate its token, contact support after confirming how users will be maintained afterward.