Setting up SCIM provisioning from your identity provider

If your company already manages who has access to what through an identity provider that supports SCIM 2.0, you do not have to invite each teammate to rollfuse by hand. A SCIM token lets that identity provider create, update, and deactivate users in your Organization directly, so access here stays in sync with whatever your provider already enforces.

Issuing and revoking a SCIM token both require a session for a Member holding the role-management permission. Provisioning itself, once the token exists, is driven entirely by your identity provider, not by calls you make yourself.

Before you start: SCIM provisioning requires the Enterprise plan. Your Organization needs an Enterprise subscription that is active, trialing, or past due, or the token request is refused with 402 plan_upgrade_required. If the Organization is later downgraded, only creating users is refused: your identity provider can still look users up and deactivate people who left, and you can still list and revoke tokens. If the plan cannot be checked for a moment, creating a user or issuing a token gets a temporary 503 (plan_check_unavailable on the token request) and nothing is created; retry shortly.

Step 1: issue a SCIM token

const orgId = "018f2f3a-6000-7000-9c3a-1f2b3c4d5e6f";
const token = process.env.ROLLFUSE_SESSION_TOKEN;

const tokenRes = await fetch(
  `https://api.rollfuse.com/v1/organizations/${orgId}/scim-tokens`,
  { method: "POST", headers: { Authorization: `Bearer ${token}` } }
);

const scimToken = await tokenRes.json();
console.log(scimToken.token); // plaintext token, shown only now

The response is the only place the plaintext token ever appears. Copy scimToken.token into your identity provider's SCIM configuration screen right away: rollfuse stores only enough to verify it later, and there is no endpoint that can hand it back to you if you lose it.

Step 2: point your identity provider at rollfuse

In your identity provider's compatible SCIM 2.0 setup, enter rollfuse's SCIM base URL and paste the token you just issued as its bearer credential. From that point on, whenever your provider assigns, updates, or removes a person from the app tied to this integration, it sends the corresponding SCIM request itself; you do not need to write that integration code.

Step 3: list active tokens

Before issuing a new token, check what already exists so you are not leaving forgotten credentials active:

const listRes = await fetch(
  `https://api.rollfuse.com/v1/organizations/${orgId}/scim-tokens`,
  { headers: { Authorization: `Bearer ${token}` } }
);

const { scim_tokens } = await listRes.json();
scim_tokens.forEach((t) => console.log(t.id, t.status, t.created_at));

This lists every token ever issued for the Organization, active or revoked, and never includes the plaintext value again, only its id, status, and timestamps.

Step 4: revoke a token

If a token is compromised, or you are decommissioning an identity provider integration, revoke it immediately:

await fetch(
  `https://api.rollfuse.com/v1/organizations/${orgId}/scim-tokens/${scimToken.id}`,
  { method: "DELETE", headers: { Authorization: `Bearer ${token}` } }
);

Once revoked, any further SCIM request authenticated with that token is rejected. Revoking a token that is already revoked comes back as a conflict rather than succeeding silently, which is a useful signal if you are scripting cleanup across several tokens.