SCIM provisioning syncs your organization with your identity provider: assign someone to StackShip in your IdP and they get an account; deactivate them and they lose access.
Set up SCIM
There’s no self-serve SCIM settings page yet; StackShip support sets it up.
-
As an organization owner or admin, email support@stackship.run with your organization slug and identity provider.
-
Support sends you a SCIM bearer token for your organization.
-
In your identity provider’s SCIM settings, enter:
Setting Value SCIM base URL https://api.stackship.run/api/auth/scim/v2Authentication HTTP header / bearer token Token The token from support -
Enable user provisioning, and assign a test user.
-
Confirm the test user appears on the Members page, then assign everyone else.
Store the token only in your identity provider. Tokens expire after one year; support replaces a token before it expires, or right away if you think it was exposed.
What SCIM manages
| Action in your IdP | Result in StackShip |
|---|---|
| Assign a user | Creates their account and adds them to your organization as a Member. |
| Update a user | Updates their name and email. |
| Deactivate a user | Blocks the account, signs them out of every session, revokes their OpenTofu CLI logins and connected agents, and removes them from your organization. |
| Reactivate a user | Unblocks the account and adds them back to your organization as a Member. |
A deactivated user who is the only owner stays in the organization as owner, but their account is blocked: they can’t sign in or use any token. Contact support if no owner can sign in. A reactivated admin returns as a Member; promote them again on the Members page.
SCIM syncs users only. Groups your identity provider pushes don’t change membership, and SCIM doesn’t set roles. Promote people to Admin on the Members page.
Deactivating a user never deletes their runs, state, or audit history.
SCIM never takes over an existing StackShip account. If a user’s email belongs to an account SCIM didn’t create for your organization, your identity provider reports a conflict. Invite them from the Members page instead, or contact support.
SSO and SCIM together
SCIM controls who has an account; Enterprise SSO controls how they sign in.