> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paxos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Automatically import and deprovision Dashboard users from your Identity Provider with SCIM 2.0.

SCIM (System for Cross-domain Identity Management) 2.0 lets you manage Paxos Dashboard access directly from your Identity Provider (IdP). Once set up, user imports and deprovisioning stay in sync with your IdP, so you don't invite or remove users by hand.

<Tip>
  SCIM is available for Organizations using [SSO](/guides/dashboard/admin/sso). To enable it for your Organization, contact [Support](https://support.paxos.com).
</Tip>

## How It Works

* **Sign-in and SCIM are separate.** SSO (your SAML/OIDC app) signs users in; SCIM (a separate app) keeps the Dashboard in sync. Adding SCIM doesn't change how users sign in.
* **Users are created on first sign-in (JIT).** A Dashboard account is created the first time a user signs in with SSO — not when you assign them in your IdP. Assigning a user alone doesn't create their account; they must sign in once.
* **Users are matched by email** between your IdP and the Dashboard.
* **Group membership grants access only through a [Role mapping](/guides/dashboard/admin/sso#map-groups-to-roles).**

Once connected, SCIM keeps the Dashboard in sync with your IdP by:

* **Matching** existing Dashboard users to your IdP by email, so the two stay in sync (your IdP may label this "importing users").
* **Syncing names** (optional). The Dashboard uses the SCIM `displayName` if your IdP sends it, otherwise it combines `givenName` and `familyName`; if neither is provided, the existing name is left unchanged.
* **Deprovisioning** — removing Dashboard access when you deactivate or unassign a user.
* **Pushing groups** so their members receive mapped Roles.

## Set Up in the Dashboard

These steps happen in the Paxos Dashboard and are the same for any Identity Provider. Once done, follow your [Identity Provider's integration guide](#identity-provider-guides) to connect it.

Before you start, SSO must already be working for your Organization.

### ➊ Create an API credential

Go to [**Admin > API Management**](/guides/dashboard/admin/api) and create a credential with the `scim:read` and `scim:write` scopes. Under [**Advanced Settings**](/guides/dashboard/admin/api#advanced-settings):

* Set the **Grant Types** to include **Authorization Code** and **Refresh Token**.
* Enter your IdP's OAuth **redirect URI** (its callback URL). This is required, and it must match exactly — otherwise authorization later fails with a `redirect_uri does not match` error. See your [Identity Provider guide](#identity-provider-guides) for where to find it.

Copy the **Client ID** and **Client Secret** — your IdP needs them.

### ➋ Authorize the credential

When your IdP initiates the OAuth connection, you're redirected to the Paxos Dashboard to **authorize the credential** for the `scim:read` and `scim:write` scopes. Sign in and approve — your IdP stores the resulting refresh token and uses it to authenticate every SCIM call from here on, refreshing automatically.

Your IdP connects to these Paxos endpoints:

|                   | Sandbox                                        | Production                             |
| ----------------- | ---------------------------------------------- | -------------------------------------- |
| **SCIM base URL** | `https://api.sandbox.paxos.com/v2/scim`        | `https://api.paxos.com/v2/scim`        |
| **Authorization** | `https://oauth.sandbox.paxos.com/oauth2/auth`  | `https://oauth.paxos.com/oauth2/auth`  |
| **Token**         | `https://oauth.sandbox.paxos.com/oauth2/token` | `https://oauth.paxos.com/oauth2/token` |

## Identity Provider Guides

Follow the guide for your Identity Provider to complete the connection:

* [**Okta**](/guides/dashboard/admin/scim-okta)

<Note>
  Guides for additional Identity Providers are coming. Using a different SCIM 2.0 IdP (for example, Microsoft Entra ID)? The Dashboard steps above are the same — only the IdP-side setting names differ. Contact [Support](https://support.paxos.com) for help.
</Note>

## Removing and Limiting Access

<Warning>
  **Deprovisioning deletes the account.** Deactivating a user in your IdP, or unassigning the app, deletes their Dashboard account and globally signs them out — it is not a temporary pause. A user who returns later is re-created from scratch and re-matched by email; their prior account and history are not restored.
</Warning>

Two actions block a user's access, with different consequences:

* **Deprovision from your IdP — destructive.** Deactivating or unassigning the user in your IdP deletes the Dashboard account and globally signs them out. This can't be undone — a returning user is re-created fresh.
* **Disable in the Dashboard — reversible.** Use the **Edit Status** dropdown at [**Admin > Team Management > Users**](https://dashboard.paxos.com/admin/team-management/users) to disable a user. This is a second layer for a temporary block: it keeps their account, history, and Roles so you can re-enable them at any time. Disabling here does **not** remove the user from your IdP app or deassign them in your IdP.

Other behaviors:

* **What triggers deprovisioning depends on your IdP.** Only an explicit deprovision — for example, deactivating or unassigning the user — deletes the account. Some IdP states, such as a temporary suspend, send no SCIM signal and have no effect. See your [integration guide](#identity-provider-guides) for the exact triggers.
* **Removing a member from an IdP group** removes that user from the Dashboard Role(s) the group is mapped to. Un-pushing a whole group from your IdP does **not** delete it in the Dashboard (it anchors the Role mapping) — remove members or update the mapping instead.

## Verify and Roll Out

Test in a non-production environment first:

1. Sign a test user in via SSO — confirm they appear **Active** in **Admin > Team Management > Users** with the expected Roles.
2. Import from your IdP — confirm the user is matched by email.
3. Deprovision the user — confirm their Dashboard access is removed.

Once verified, roll out to your production users.

> Questions? Contact [Support](https://support.paxos.com).