🔧 SCIM 2.0 Auto-Provisioning ROADMAP — Q3 2026 ENTERPRISE

Roadmap feature — not yet generally available. Standard IdP-flow SCIM 2.0 (Okta, Azure AD, Google Workspace) with OAuth Bearer token authentication is planned for Enterprise customers in Q3 2026. Today the /scim/v2 endpoint is gated on a marketplace API key and does not yet support the standard IdP provisioning flow described below. The documentation below reflects the final target specification. For enterprise SCIM questions, email enterprise@thinkkits.com.

ThinkKits is building SCIM 2.0 (System for Cross-domain Identity Management) for automated user provisioning and deprovisioning from enterprise identity providers.

🤖 Automated Provisioning

Automatically create user accounts when new users are added to your identity provider.

⚡ Real-time Sync

Updates to user information in your IdP are immediately reflected in ThinkKits.

🔒 Secure Deprovisioning

Automatically deactivate accounts when users leave your organization.

👥 Group Management

Map identity provider groups to ThinkKits roles and permissions.

🚀 Quick Setup

1. Configure ThinkKits

Contact your ThinkKits administrator to enable SCIM provisioning and obtain:

SCIM Base URL: https://api.thinkkits.com/scim/v2
Bearer Token: Secure authentication token for SCIM requests

2. Identity Provider Configuration

Configure your identity provider to connect to ThinkKits:

📱 Azure AD / Microsoft Entra ID

Navigate to Enterprise Applications → New Application
Search for "ThinkKits" or create custom SCIM application
Configure provisioning:
- Tenant URL: https://api.thinkkits.com/scim/v2
- Secret Token: Your SCIM bearer token
Test connection and start provisioning

🌀 Okta

Go to Applications → Browse App Catalog
Search for "ThinkKits" or create SCIM 2.0 app
Configure SCIM connection:
- SCIM connector base URL: https://api.thinkkits.com/scim/v2
- Unique identifier field: userName
- Authentication: OAuth 2.0 Bearer Token
Configure attribute mappings and enable provisioning

🏢 Google Workspace

Go to Admin Console → Apps → Web and mobile apps
Add custom SCIM app or search for "ThinkKits"
Configure provisioning:
- Provisioning URL: https://api.thinkkits.com/scim/v2
- Authorization: Bearer token authentication

📋 SCIM API Reference

Authentication

All SCIM endpoints require Bearer token authentication:

Authorization: Bearer your_scim_bearer_token_here

User Management

GET /scim/v2/Users

List users with pagination and filtering support.

Query Parameters:

startIndex - 1-based index of first result (default: 1)
count - Number of results per page (default: 20, max: 100)
filter - SCIM filter expression

POST /scim/v2/Users

Create a new user account.

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "teacher@example.edu",
  "name": {
    "givenName": "Jane",
    "familyName": "Smith"
  },
  "emails": [{
    "value": "teacher@example.edu",
    "type": "work",
    "primary": true
  }],
  "active": true,
  "roles": ["teacher"]
}

GET /scim/v2/Users/{id}

Get a specific user by ID.

PUT /scim/v2/Users/{id}

Replace user (full update).

PATCH /scim/v2/Users/{id}

Partially update user.

DELETE /scim/v2/Users/{id}

Delete/deactivate user account.

Group Management

GET /scim/v2/Groups

List available groups (ThinkKits roles).

GET /scim/v2/Groups/{id}

Get specific group details.

🗺️ Role Mapping

ThinkKits maps SCIM groups and roles to internal permission levels:

SCIM Role/Group	ThinkKits Role	Permission Level	Description
admin, administrator, superintendent, principal	district	High	District-level administrative access
teacher, staff, faculty, instructor	school	Standard	School-level user access
student, parent	school	Limited	Basic platform access
vendor, partner	vendor	Specialized	Vendor/partner features
researcher, analyst	researcher	Specialized	Research and analytics tools

🔍 SCIM Discovery Endpoints

These endpoints provide metadata about the SCIM implementation:

GET /scim/v2/ServiceProviderConfig

Get SCIM service provider configuration and capabilities.

GET /scim/v2/ResourceTypes

List supported SCIM resource types (User, Group).

GET /scim/v2/Schemas

Get SCIM schema definitions for User and Group resources.

⚠️ Important Considerations

🛡️ Security & Compliance

Bearer Token Security: Keep your SCIM bearer token secure and rotate regularly
HTTPS Only: All SCIM communication uses encrypted HTTPS
Audit Logging: All provisioning actions are logged for compliance
Data Privacy: SCIM operations comply with GDPR, FERPA, and CCPA requirements

📊 Monitoring & Troubleshooting

Provisioning Logs: Check your identity provider's provisioning logs for sync status
SCIM Errors: Monitor for HTTP 400/401/500 responses indicating configuration issues
User Validation: Verify new users receive appropriate ThinkKits access levels
Deprovisioning: Confirm that deleted users lose ThinkKits access immediately

🔧 Common Issues

401 Unauthorized: Check bearer token configuration
400 Bad Request: Verify required fields (userName, emails) are provided
404 Not Found: User/group may not exist or may be deactivated
409 Conflict: Username/email already exists in the system

📞 Support

Need help setting up SCIM provisioning?

🔧 Technical Support

SCIM configuration assistance
support@thinkkits.com

🏢 Enterprise Setup

Identity provider integration
enterprise@thinkkits.com

📚 Documentation

Full API reference
/docs#tag/SCIM

🐛 Issues

Report SCIM bugs or issues
bugs@thinkkits.com