Directory provisioning
Authpermit serves SCIM 2.0 at /scim/v2 so your directory drives joiners, movers and leavers. Issue a provisioning token in Settings → Enterprise and give it to your provider as a bearer token.
What is supported
| Resource | Operations |
|---|---|
| Users | list with filter, get, create, replace, patch, delete |
| Groups | list (read-only; groups are Authpermit roles) |
| ServiceProviderConfig, ResourceTypes | get |
Filtering supports equality on userName, displayName, externalId and id — the filters directories actually send. An operation on an attribute Authpermit does not model is accepted and ignored rather than refused, so a sync does not break over a field we do not keep.
Deprovisioning
A DELETE, or a patch setting active to false, suspends the membership rather than erasing it. An access review needs to see that someone was removed and when.
It then runs the leaver cascade: the person's sessions in your organization are revoked (all of their sessions when they belong to no other organization), the API keys they created here and their OAuth grants here are revoked, and identity.deprovisioned is emitted with what was done.
Audit
Every provisioning change runs through the same command path as a change made by hand, so it appears in the audit ledger with the same shape. That is what makes a directory-driven joiner reviewable.
Directory provisioning is on the Enterprise and Sovereign plans.