Skip to main content
The System for Cross-domain Identity Management (SCIM) is a standard for managing user provisioning, updates, and deletions in cloud-based applications. It allows you to use your company’s identity provider, such as Okta or Entra ID, to provision, update, and delete users securely in Connect AI.
SSO must be configured on your account before you can enable SCIM Users. To enable SCIM, contact CData Support.
Connect AI currently supports SCIM provisioning with the following identity providers:
  • Microsoft Entra ID
  • Okta Workforce Identity Cloud
  • Custom IdP (configured via SAML or OpenID Connect)
The following SCIM providers are NOT supported:
  • PingFederate
  • Google Workspace
  • Active Directory Federation Services (ADFS)
  • Active Directory/LDAP

​
SCIM User Provisioning, Updates, and Deprovisioning

When you provision SCIM, CData Support supplies a unique base URL following this format: https://{your-domain.com}/scim/v2. The URL endpoint contains the necessary user metadata. All SCIM endpoints require an Authorization header with a Bearer token. To provision a new user, POST to your unique SCIM endpoint. The system provisions the user in Connect AI. There is no need for the user to verify via email. The new user has a default role of Query user. See Roles for details on system roles. The new user only has access to connections that have user-defined credentials turned on. To update a SCIM user’s name and email, use PATCH with the SCIM endpoint. When a SCIM update user request comes in, the system updates the information in Connect AI. To delete a user, use DELETE and your unique SCIM endpoint. The SCIM delete event calls the delete endpoint. For complete deprovisioning, also call DELETE /users/{id} from the Management API to revoke PATs and any direct role and permission grants. The Connect AI Audit Log displays SCIM user provisioning, updates, and deletions.

​
Roles and Permissions

A user’s access in Connect AI is the combination of group-derived roles (from SCIM group assignments), direct role assignments, and direct resource permissions. You can manage direct assignments and fully deprovision users using the Management API (base path /api/v1/): See Roles for details on system and access roles.