> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dacard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning

> Automate user provisioning and deprovisioning from your identity provider.

<Note>
  SCIM is on the Enterprise plan. Add a user in your IdP, they get a Dacard account. Remove them, access is revoked. Pair with SSO for fully automated identity management.
</Note>

# SCIM provisioning

SCIM (System for Cross-domain Identity Management) lets your identity provider automatically provision and deprovision Dacard accounts. When you add a user to your IdP group, they get an account. When you remove or deactivate them, access is revoked immediately. No manual steps.

SCIM is available on the **Enterprise plan**. Navigate to **Settings > SCIM** to see your endpoint details.

## Supported operations

| Operation           | What it does                                                                   |
| ------------------- | ------------------------------------------------------------------------------ |
| **Create user**     | Automatically provisions a new Dacard account when a user is added in your IdP |
| **Deactivate user** | Revokes access when a user is deactivated or removed in your IdP               |
| **Update user**     | Syncs name and email changes from your IdP to Dacard                           |
| **Push groups**     | Maps IdP groups to Dacard roles (admin, lead, member)                          |

## SCIM endpoint

Your SCIM base URL is:

```
https://clerk.dacard.ai/scim/v2
```

Your bearer token is available after enterprise onboarding. Contact [support@dacard.ai](mailto:support@dacard.ai?subject=SCIM%20Provisioning%20Setup) to retrieve it.

<Warning>
  Never share your SCIM bearer token. Treat it like a password. If it is compromised, contact support immediately to rotate it.
</Warning>

## Setup guide

SCIM is configured in your identity provider, not in the Dacard UI. The general process:

<Steps>
  <Step title="Contact support">
    Email [support@dacard.ai](mailto:support@dacard.ai?subject=SCIM%20Provisioning%20Setup) to request your SCIM bearer token and provider-specific setup guide.
  </Step>

  <Step title="Add a SCIM app in your IdP">
    In your identity provider (Okta, Azure AD, etc.), create a new SCIM application. Enter the Dacard SCIM base URL and your bearer token.
  </Step>

  <Step title="Configure attribute mapping">
    Map IdP user attributes to SCIM standard fields: `userName` (email), `name.givenName`, `name.familyName`, and `groups` for role mapping.
  </Step>

  <Step title="Test provisioning">
    Assign a test user in your IdP and verify their Dacard account is created. Then deactivate the test user and verify access is revoked.
  </Step>

  <Step title="Go live">
    Assign your full user group. SCIM provisioning is active.
  </Step>
</Steps>

## Role mapping via groups

Map IdP groups to Dacard roles using group push:

| IdP group name   | Dacard role |
| ---------------- | ----------- |
| `dacard-admins`  | Admin       |
| `dacard-leads`   | Lead        |
| `dacard-members` | Member      |

Group names can be customized during setup.

## Provider-specific guides

Our team provides setup guides for:

* **Okta** SCIM 2.0 app configuration with attribute mapping
* **Azure AD / Entra** Enterprise application provisioning setup
* **Google Workspace** Requires a third-party provisioning bridge
* **OneLogin** SCIM provisioning with role synchronization

Contact [support@dacard.ai](mailto:support@dacard.ai?subject=SCIM%20Provisioning%20Setup) and specify your IdP.

## Requirements

| Requirement      | Detail                                          |
| ---------------- | ----------------------------------------------- |
| **Plan**         | Enterprise                                      |
| **Bearer token** | Provided by Dacard support during onboarding    |
| **Setup time**   | Typically under 2 hours once you have the token |

<CardGroup cols={2}>
  <Card title="SSO" icon="shield-check" href="/knowledge-base/sso">
    Pair SCIM provisioning with SSO for fully automated identity management.
  </Card>

  <Card title="Roles & Permissions" icon="shield" href="/rbac">
    Understand Dacard roles before configuring group mapping.
  </Card>
</CardGroup>