SCIM provisioning

Camper hosts a SCIM 2.0 endpoint for each workspace. Your IdP is the client; Camper is the server.

Camper does not support Okta Import Users or Import Groups. Identity flows Okta → Camper (push). Camper is not an Okta import source.

Prerequisites

• Owner or admin in Camper
• An IdP (or bridge) that can push SCIM with a bearer token
• For Okta: Lifecycle Management module if you want full User/Group push (see Okta setup)

Summary of steps

1. Copy Base URL and generate a token in Camper
2. Configure the IdP SCIM client
3. Assign users (and optionally push groups)
4. Verify people appear in Camper

Full-directory assigns

When you assign Camper to everyone at once, the IdP opens many concurrent SCIM requests. Camper rate-limits successful SCIM writes (and reads) per workspace and returns HTTP 429 with a Retry-After header when the budget is exceeded.

That is intentional:

• Your IdP (Okta, Entra, …) slows down and retries — the assign finishes, it just takes longer than a few seconds for large directories.
• The Camper dashboard stays usable for operators while the import runs.

If a few users show as failed in the IdP after a large assign, re-run provisioning for those users (or cycle the assignment). Already-created people are upserted safely on retry.

You do not need to turn SCIM off or regenerate the token for a normal rate-limit slowdown.

1. Get credentials in Camper

1. Open Settings → Identity Providers.
2. Copy the Base URL (ends with /scim/v2).
3. Click Generate token and store the bearer token — it is shown once.

Treat the token like an API key. Rotate it in Camper if it leaks, then paste the new value into the IdP.

2. Configure the IdP

Point the IdP’s SCIM integration at the Base URL with Bearer authentication. Enable at least:

• Create users
• Update user attributes
• Deactivate users

Group push is optional but recommended for the Teams axis.

Vendor-specific clicks: Okta, Entra ID, Google as source.

Configuration Steps in Okta

Okta-specific walkthrough with attribute and group detail: Okta setup. The Okta Admin steps are:

1. In Camper, open Settings → Identity Providers. Copy the Base URL and click Generate token (shown once).
2. In Okta, go to Applications → Browse App Catalog and add SCIM 2.0 Test App (OAuth Bearer Token) — or the Camper app once it appears in the OIN.
3. On Provisioning, click Configure API Integration:
   • SCIM connector base URL: the Base URL from step 1 (https://api.getcamper.io/scim/v2 in production; no trailing slash)
   • OAuth Bearer Token: the token from step 1
   • Unique identifier field for users: userName
4. Click Test API Credentials.
5. Under Provisioning → To App, enable Create Users, Update User Attributes, and Deactivate Users. Do not enable Import Users or Import Groups — Camper does not support them.
6. Assign people on the Assignments tab. Prefer groups so joiners and leavers flow without per-person work.
7. Optional: on Push Groups, add the Okta groups that should become Camper Teams units.
8. Optional: map department (and other attributes) and SCIM roles (Admin / Viewer only). See Okta setup.

Sign-in is a separate OIDC registration: Enterprise SSO → Configuration Steps in Okta.

What Camper accepts

Resource	Effect
User create / update	Upsert identity; store attributes; resolve org placement
User deactivate / delete	Suspend or deprovision; revoke operator sessions for this workspace
Group push	Place people on team org units (default Teams axis)
roles on User	Admin elevates operators; omit or Viewer for workers — Roles

Membership changes in Google, Slack, and other targets still flow through Camper’s normal reconcile path — not as a side effect of the SCIM HTTP request itself.

Users and roles

• Every active User becomes a directory identity and can sign in (subject to SSO policy).
• Default platform access is Viewer → My Access.
• Send roles = Admin only for people who should operate the dashboard.
• Do not send Owner — Camper rejects it; ownership is only from workspace creation.
• Clearing roles demotes someone to Viewer. Deactivating them in the IdP ends their sessions for this workspace.

Names and email

• Send name.givenName and name.familyName when you can. If the IdP only sends displayName, Camper splits on the first space so SCIM-required name fields stay populated.
• An email is required. Pushes without email are rejected and listed under recent rejected pushes on Settings → Identity Providers.

Profile attributes and org placement

Camper stores the whole User payload, so attributes your IdP sends are available to axes without a separate “declare in Camper” step. When you create an axis, pick the attribute from values Camper has already seen.

Where the attribute sits	Type this in the axis
Top level of the payload	officeLocation
Enterprise extension	costCenter (or the full enterprise URN path)
Vendor / custom namespace	badgeOffice or urn:okta:custom:1.0:User:badgeOffice
Sub-attribute of a complex field	name.givenName

See Custom attributes for IdP walkthroughs.

Groups

Pushed Groups become org units on the Teams axis (multi-membership). Nested display names use the axis delimiter (for example Engineering > Platform).

IdP change	Camper effect
Rename group	Team unit renames in place; linked resources that follow org names update on reconcile
Membership PATCH	Multi-membership rows update
Delete / unpush group	Team unit is archived; managed resources linked to it are archived

Department moves on a hierarchy axis do not remove team memberships.

Filtering and pagination (advanced)

Equality filters, one attribute at a time:

GET /scim/v2/Users?filter=userName eq "avery@acme.com"
GET /scim/v2/Users?filter=externalId eq "idp-user-123"
GET /scim/v2/Groups?filter=displayName eq "Platform"

Unsupported filters return 400 (invalidFilter) rather than silently returning everyone. Paginate with startIndex and count (max 100 per page). userName matching is case-insensitive.

Camper accepts Content-Type: application/scim+json and application/json.

Security tips

• Rotate the bearer token if leaked; update the IdP immediately after
• Prefer group-based assignment in the IdP so joiners and leavers stay correct
• Never put SCIM tokens in tickets, screenshots, or feedback reports

Related

• Roles
• Custom attributes
• Org axes
• Enterprise SSO
• Okta · Entra ID · Google Workspace