Gatehouse
Sign inGet started
DocsEnterprise identity

SCIM provisioning

Create, update and deactivate people and groups automatically from Okta, Entra ID, OneLogin or JumpCloud.

SCIM 2.0 keeps Gatehouse in sync with your identity provider. People are created and deactivated automatically, and groups become Gatehouse groups.

Set it up

  1. In Gatehouse, open Settings → Provisioning, name the token (for example "Okta production") and click Create token. Copy it now. It's shown only once.
  2. In your identity provider, add a SCIM app with:
    • SCIM base URL: https://gatehouse.yourcompany.com/scim/v2
    • Authentication: HTTP header, bearer token
    • Unique identifier: userName (the email address)
  3. Enable pushing users, user updates, deactivation and groups.

Tokens can be revoked under Provisioning. Each shows when it was last used.

Endpoints

Endpoint Methods
/scim/v2/ServiceProviderConfig, /ResourceTypes, /Schemas GET
/scim/v2/Users GET, POST
/scim/v2/Users/<id> GET, PUT, PATCH, DELETE
/scim/v2/Groups GET, POST
/scim/v2/Groups/<id> GET, PUT, PATCH, DELETE

Supported filters are the ones identity providers send: userName eq "…", emails.value eq "…" and externalId eq "…" for users, and displayName eq "…" for groups.

What happens to people

  • Created people get the Member role. Change roles in Gatehouse.
  • Deactivated (active: false) or deleted people are disabled: signed out, with every agent token revoked at once. Their audit history stays.
  • Group membership sets the person's Gatehouse groups, so your policies follow your directory. Groups pushed by SCIM show a SCIM badge and their members can only be changed in your identity provider.

Every SCIM change is recorded in the audit log with via: scim.