Skip to content
BriefCatch
Esc
↑↓navigate↵open⌘Jpreview
On this page

Set up SCIM provisioning

Let your identity provider create, update, and deactivate BriefCatch accounts automatically, and map provisioned groups to BriefCatch roles.

Goal: hand user lifecycle to your identity provider. With SCIM in place, the BriefCatch member list becomes a reflection of your directory rather than something you maintain by hand.

Step 1: Review prerequisites

  • Your role is admin or owner.
  • Your plan includes enterprise SCIM.
  • Single sign-on is already connected. Until it is, the SCIM screen shows “Connect SSO before setting up SCIM” and leaves the token and mapping controls disabled. See Set up single sign-on.
  • You can administer your identity provider’s provisioning settings.

Step 2: Create a SCIM token

Go to Settings → Security → SCIM and create a token.

Treat the token as a credential with directory-level reach. Never send it over email or chat, and never paste it into a support ticket. BriefCatch support will not ask you for it.

Step 3: Point your identity provider at BriefCatch

In your provider’s provisioning configuration, supply:

  • The SCIM base URL, which is your BriefCatch API host followed by /api/v1/scim/v2. Note the /api/v1 — a URL ending in just /scim/v2 will not reach the service. If you are not certain which API host your organization is on, ask BriefCatch support rather than guessing; a wrong base URL usually surfaces as an authentication failure, which points you at the token instead of the address.
  • The token from step 2, as the bearer token.

BriefCatch implements SCIM 2.0 and publishes the standard discovery endpoints (ServiceProviderConfig and Schemas), so most providers can validate the connection themselves before you push any users.

Supported user operations: create, list, read, update, replace, and deactivate.

Step 4: Map groups to roles

Provisioned groups are mapped to a BriefCatch Organization role: Member or Admin.

Mapping by group rather than by person is the point. Someone joins the group in your directory and gets the matching BriefCatch role automatically; they leave the group and lose it. The mapping panel shows provisioned groups as “Managed by the connected identity provider”, because their membership belongs to your directory rather than to BriefCatch.

The owner role is deliberately not a SCIM mapping target. Ownership carries billing and destructive account actions, and it stays a decision made inside BriefCatch. See Roles and permissions.

Step 5: Verify with one user before syncing everyone

Provision a single test user and confirm they appear in BriefCatch with the expected role, then let the full sync run. This is the same reasoning as the SSO test sign-in: a mapping mistake caught on one account is an edit, and the same mistake caught after a full sync is a cleanup.

Guardrails you may run into

BriefCatch refuses directory operations that would leave the organization in an unusable state:

  • An organization cannot lose its last owner. A deprovisioning request that would remove the only owner is rejected. Transfer ownership inside BriefCatch first.
  • Inactive organizations do not accept provisioning.
  • Users outside your organization’s scope are rejected, so a misconfigured provider cannot reach into accounts that are not yours.

These are refusals, not errors to retry. Each means the request would have broken something.

Important notes

  • SCIM does not replace SSO. Provisioning creates and maintains accounts; SSO authenticates them. You need both for a directory-managed deployment.
  • The token is per organization. If you administer more than one, each needs its own.
  • Deprovisioning cuts access. Confirm any document handoff before removing someone from the mapped group. See Teams and organizations.

Was this page helpful?