SCIM provisioning

With SCIM your identity provider pushes changes to Waxell: assign someone to the app and they get an account; unassign or deactivate them and their access is revoked.

Turn it on

1. Settings → Identity → edit your provider → SCIM provisioning.
2. Click Generate token. Copy it now: it's shown once. Rotate token issues a new one and the old one stops working immediately.
3. Give your IdP:

Setting	Value
SCIM base URL	https://<workspace>.waxell.dev/api/scim/v2/
Authentication	HTTP header Authorization: Bearer <token>
Unique identifier	userName (the user's email)

A token belongs to one provider in one workspace, and works only on that workspace's URL.

Accounts SCIM creates are not emailed, so you can set the workspace up first. When you're ready, send the sign-in email from Settings → Users, or turn on Email people when SCIM adds them. See Telling people they're ready.

Okta

In your Waxell app integration: General → Provisioning → SCIM, then on the Provisioning tab:

• SCIM connector base URL: the base URL above
• Unique identifier field for users: userName
• Authentication Mode: HTTP Header → paste the token
• Test Connector Configuration → Save
• To App: enable Create Users, Update User Attributes and Deactivate Users
• Push Groups to create Waxell teams from Okta groups

Microsoft Entra

In the Waxell enterprise application: Provisioning → Get started → Automatic.

1. Make sure the provider is Enabled in Waxell first. SCIM rejects every token for a disabled provider.
2. Tenant URL: the base URL above.
3. Secret Token: the token. Generate it once and paste it straight in. Generating again replaces it, and Entra keeps failing with the old one until you paste the new one.
4. Test Connection, then Save.
5. Mappings → Provision Microsoft Entra ID Users: set the target attribute userName to source userPrincipalName (or mail if your users sign in with a different address than their mail). Waxell identifies people by email. Entra's default for some apps sends an object ID instead, and then no one is ever matched.
6. Users and groups: assign the people or groups to provision, then Start provisioning.

If Test Connection fails with Invalid SCIM token, the provider is disabled or the token in Entra isn't the latest one.

What each operation does

SCIM request	In Waxell
POST /Users	Creates the user (if needed) and adds them to the workspace as a member. No email unless the provider's Email people when SCIM adds them is on
PUT / PATCH /Users/{email}	Updates name and active
PATCH with active: false, or DELETE /Users/{email}	Deprovisions: see Offboarding
GET /Users?filter=userName eq "jane@acme.com"	Looks up one user
POST /Groups	Creates a team in this workspace
PATCH /Groups/{id} (add/remove members)	Adds or removes team members
PUT /Groups/{id}	Renames the team and replaces its members
DELETE /Groups/{id}	Deletes the team

User IDs are the user's email address. Group IDs are the team slug.

Endpoints

Path	Methods
/api/scim/v2/ServiceProviderConfig	GET
/api/scim/v2/Users	GET, POST
/api/scim/v2/Users/{email}	GET, PUT, PATCH, DELETE
/api/scim/v2/Groups	GET, POST
/api/scim/v2/Groups/{id}	GET, PUT, PATCH, DELETE

SCIM only ever sees the workspace whose URL it's called on, and only that workspace's teams.