Skip to main content
SCIM user provisioning is available for users on the Enterprise plan. Please contact sales to enable this feature for your workspace.

​
Overview

SCIM (System for Cross-domain Identity Management, RFC 7644) is the standard protocol that identity providers use to manage users in third-party apps. Once SCIM is connected, your IdP becomes the source of truth for who has access to your Softr app — when you add, update, deactivate, or remove a user in your IdP, the change is pushed to Softr automatically. SCIM is the natural complement to SSO: SSO authenticates a user when they sign in, while SCIM provisions the user record itself ahead of time and keeps it in sync. The two are typically used together for centralized identity management.

​
Supported identity providers

Softr’s SCIM implementation follows the SCIM 2.0 standard, so it works with any SCIM-capable IdP, including:
  • Okta
  • Microsoft Entra ID (Azure AD)
  • OneLogin
  • JumpCloud
  • Google Workspace
  • … and any other IdP that supports SCIM 2.0.

​
What SCIM does in Softr

Action in your IdPResult in Softr
Assign a user to the Softr appA user is created in your Softr app. If auto-invite is enabled in the app’s User Settings, the invitation email is sent automatically.
Update a user’s name or emailThe corresponding Softr user record is updated.
Deactivate a user (set active: false)The user is deactivated in Softr and can no longer sign in.
Reactivate a user (set active: true)The user is reactivated.
Unassign a user / delete from your IdPThe user is removed from your Softr app.

​
Prerequisites

Before configuring SCIM, make sure you have:
  • An Enterprise plan with SCIM enabled by Softr — contact sales if you haven’t requested it yet.
  • A published Softr app.
  • A Softr API key — see API Setup and Endpoints for how to generate one.
  • The Application ID of the Softr app you want to provision into.

​
Connection details

Your IdP will ask for two values when you set up the SCIM integration: a base URL (sometimes called Tenant URL) and a Bearer token.
FieldValue
SCIM Base URL / Tenant URLhttps://studio-api.softr.io/scim/v2/applications/{applicationId}/Users
AuthenticationHTTP Bearer token — header Authorization: Bearer YOUR_SOFTR_API_KEY
Content typeapplication/scim+json
Replace {applicationId} with the ID of your Softr application and YOUR_SOFTR_API_KEY with the API key you generated.

​
Supported endpoints

MethodPathPurposeRate limit
GET/UsersList or filter users in the app. Supports pagination via startIndex and count.300 / min
GET/Users/{id}Retrieve a single user by ID.300 / min
POST/UsersProvision a new user.100 / min
PUT/Users/{id}Replace all attributes of an existing user (used by Microsoft Entra ID).100 / min
PATCH/Users/{id}Apply partial updates to a user (used by Okta and most IdPs).60 / min
DELETE/Users/{id}Remove a user from the app.30 / min
Pagination defaults: count defaults to 100 and is capped at 500 per request.

​
Supported attributes

SCIM attributeNotes
userNameRequired on create. Used as the user’s email. If absent, Softr falls back to the primary entry in emails.
name.givenName, name.familyName, name.formattedCombined into the user’s full name.
displayNameTakes precedence over name.* when resolving the full name.
emails[].valueThe primary email is used as userName if userName isn’t supplied.
activetrue activates the user; false deactivates them.
passwordOptional, write-only. Most IdPs do not send a password — Softr generates one automatically and the user sets their own via the invitation email.

​
Supported filters

The GET /Users endpoint supports a single filter form, which is what Okta and Entra ID send during user lookup: 
GET /Users?filter=userName eq "user@example.com"

​
Setting up SCIM in your IdP

The provisioning flow looks the same in every SCIM-capable IdP — only the UI differs. In your IdP’s SCIM (or “User Provisioning”) settings:
1

Create or open the Softr app in your IdP

Add Softr as a SCIM-enabled application in your IdP, or open the existing app you already use for SSO. SCIM is configured on the same application.
2

Enter the SCIM Base URL and Bearer Token

Paste the Softr SCIM Base URL (https://studio-api.softr.io/scim/v2/applications/{applicationId}/Users) and your Softr API key as the Bearer token.
3

Verify the connection

Use your IdP’s built-in Test Connection / Verify button. It will issue a test request against Softr to make sure the URL and token are valid.
4

Enable provisioning and assign users

Turn on the provisioning actions you want (Create Users, Update Attributes, Deactivate Users) and assign the users or groups that should have access to the Softr app. Your IdP will start pushing them to Softr.
For provider-specific UI details, see your IdP’s documentation:

​
Example requests

You can smoke-test the SCIM endpoint with curl before pointing your IdP at it.

​
Create a user

curl --request POST 'https://studio-api.softr.io/scim/v2/applications/YOUR_APP_ID/Users' \
  --header 'Authorization: Bearer YOUR_SOFTR_API_KEY' \
  --header 'Content-Type: application/scim+json' \
  --data-raw '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "userName": "jane@example.com",
    "name": {
      "givenName": "Jane",
      "familyName": "Doe"
    },
    "emails": [
      { "value": "jane@example.com", "type": "work", "primary": true }
    ],
    "active": true
  }'

​
Deactivate a user

curl --request PATCH 'https://studio-api.softr.io/scim/v2/applications/YOUR_APP_ID/Users/USER_ID' \
  --header 'Authorization: Bearer YOUR_SOFTR_API_KEY' \
  --header 'Content-Type: application/scim+json' \
  --data-raw '{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
      { "op": "replace", "path": "active", "value": false }
    ]
  }'

​
Error responses

Errors follow the standard SCIM error schema (urn:ietf:params:scim:api:messages:2.0:Error). Common statuses:
StatusMeaning
400Malformed request, unsupported PATCH path, or invalid filter.
401Missing or invalid Bearer token.
403SCIM is not enabled for this workspace’s plan.
404The application or user does not exist.
409A user with the same email already exists in the app.

​
Limitations

Softr’s current SCIM implementation supports:
  • The Users resource only — Groups provisioning is not yet supported.
  • add and replace PATCH operations.
  • The userName eq "value" filter form.
Manage user groups inside Softr while SCIM keeps the underlying user records in sync.