SCIM provisioning

Camper hosts a SCIM 2.0 endpoint per tenant (product path). Configure your IdP’s SCIM client with:

• Base URL — shown in Directory settings (copyable)
• Bearer token — generated and rotatable in-product; sealed at rest

What Camper accepts

Resource	Effect
User create / update	Upsert identity; store attributes; apply attribute map
User deactivate / delete	Suspend identity; revoke operator sessions if any
Group push	Place identities on mapped org units / team axis
roles on User	Elevate / demote platform operators

Security tips

• Treat the SCIM bearer token like an API key — rotate if leaked.
• The token is shown once when generated; store it in your IdP vault.
• Membership changes in Google/Slack/etc. still flow through Camper’s normal sync — not directly from the SCIM request.

In Camper today

1. Open Directory in the admin app.
2. Copy the SCIM base URL ({API}/scim/v2).
3. Generate token (shown once). Configure your IdP with Bearer auth.
4. Provision Users — email/userName, displayName, active, optional roles (e.g. Admin).

Example create

POST /scim/v2/Users
Authorization: Bearer cmp_scim_…
Content-Type: application/scim+json

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "avery@acme.com",
  "externalId": "idp-user-123",
  "displayName": "Avery Stone",
  "active": true,
  "emails": [{ "value": "avery@acme.com", "primary": true }],
  "roles": [{ "value": "Admin" }]
}

• Always creates/updates a directory identity.
• roles: Admin (also Owner / Viewer / Member) elevates a platform operator membership.
• active: false (or PATCH) suspends the identity.

Attribute map

On Directory, map profile keys → hierarchy levels (division / department / sub-department / team). On User create/update, Camper materialises org units and places the identity on the leaf.

Groups

POST /scim/v2/Groups
Authorization: Bearer cmp_scim_…

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "externalId": "grp-platform",
  "displayName": "Platform",
  "members": [{ "value": "<user-id-or-externalId>" }]
}

Creates org units under teams.* (kind team) and multi-membership rows (source: scim_group).

Coming soon

• Custom hierarchy levels beyond the default four
• Worker My Access view for non-operators
• Richer SCIM list filters