SCIM provisioning

With SCIM 2.0 your identity provider, for example Microsoft Entra ID or Okta, manages exoCortex users for you: when you hire someone the user is created, when they change role it is updated, when they leave the company it is deactivated.

Connecting the identity provider

1. In exoCortex Core, open Identity → SCIM and generate a SCIM token. Copy it straight away: it is shown only once.
2. In your identity provider, add an application with SCIM 2.0 provisioning and enter:
   • Base URL: https://exocortex-api.ai-exo-cortex.com/scim/v2
   • Authentication: bearer token, with the token generated in step 1.
3. Run a connection test from the identity provider, then assign the users and groups to synchronise to the application.

The token belongs to a tenant: the identity provider sees and manages only that tenant’s users.

What exoCortex supports

Feature	Support
Users: create, read, replace, update (PATCH), delete	yes
Groups: create, read, update (PATCH), delete	yes
Filters	yes, for example userName eq "[email protected]", also with and; up to 200 results
Sorting	yes
Bulk operations (bulk)	no
Password change	no: the user chooses the password
ETag	no

User attributes

exoCortex uses the standard attributes of the SCIM user schema:

• userName: the user identifier, usually the company email;
• externalId: the user’s identifier in your identity provider;
• name.givenName and name.familyName, displayName;
• emails, with the main address marked as primary;
• active: if false, the user is deactivated;
• title and userType, if present.

Deactivating and removing a user

When a user leaves the company, the identity provider deactivates them with a PATCH that sets active to false:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{ "op": "replace", "path": "active", "value": false }]
}

A DELETE request on the user removes them from provisioning (deprovisioning).

Errors

SCIM endpoints respond with SCIM error documents (RFC 7644). A 401 means a missing, invalid, revoked or expired token: generate a new token and update it in the identity provider.