Skip to main content
A SCIM directory lets your identity provider (IdP) provision people and Groups into your Ryvn organization. Each organization can have one directory at a time. SCIM handles provisioning, not sign-in. Configure single sign-on (SSO) separately; creating or removing a SCIM directory does not configure or remove SSO.

​
Before you begin

  • Have access to configure SCIM provisioning in your identity provider.
  • Select the Ryvn organization that should receive the people and Groups.
  • Have permission to view integrations (integration.read) and manage them (integration.write). If setup controls are missing, ask an organization administrator for access.

​
Configure the directory

1

Create the directory

Open Settings > Connections > SCIM directory and click Add connection. In the popup, click Create.If a directory already exists, inspect it before replacing it. Removing a directory is not the same as rotating its token.
2

Copy the endpoint and token

Copy the exact SCIM endpoint and Bearer token returned by Ryvn. Store the token securely before closing the popup; it is shown only once. If you lose it, rotate the token.
Treat the bearer token as a credential. Do not put it in source control, screenshots, logs, or support messages.
3

Configure your identity provider

In your IdP’s SCIM provisioning settings, enter the returned endpoint as the base URL and the token as the bearer credential. Use the URL exactly as returned rather than substituting the Ryvn dashboard URL.Choose the people and Groups your IdP should send to Ryvn, then enable provisioning according to your provider’s instructions. Check its provisioning results, Settings > People, and Settings > Groups in Ryvn. A configured directory alone does not confirm that the IdP has sent data.To grant access through a Group, add it to a Team and use the Team in an access policy.

​
First sign-in

Provisioning creates or updates a person’s account but sends no invitation or email, sets no password, and does not link an SSO identity. To sign in for the first time, the person:
  1. Opens the normal Ryvn login page and enters their provisioned work email.
  2. Signs in with your organization’s SSO when Ryvn offers or requires it. The IdP must assert a verified email that matches the provisioned email. Ryvn then links the SSO identity to the existing account; no separate invitation or SSO auto-join is needed.
  3. Otherwise, uses the email sign-in link Ryvn sends, if your organization does not require SSO.
  4. Follows any setup prompts Ryvn shows. Provisioning does not complete these on the person’s behalf.

​
How people are provisioned

Ryvn provisions people only into the directory’s organization. Your IdP can find and update existing active or inactive human accounts whose home is that organization, not only people the directory created, so a directory association does not mean the directory originally created the account. In Settings > People, people associated with the directory show Managed by SCIM.
  • Matching. Configure your IdP to match existing people by userName, or by externalId once it is stored. Creating a person whose userName already exists fails with a conflict; let the IdP match and update that person instead.
  • Email. Map the email Ryvn receives to the address the person signs in with. New accounts and email addresses changed through SCIM are marked verified; an unchanged existing email keeps its verification status. Use the provisioned email for sign-in; externalId is not a sign-in identifier.
  • Deactivation. When your IdP sends active: false, Ryvn deactivates the person; their direct role grants are kept. Changing an inactive person back to active: true reactivates them and restores their organization membership.
  • Deletion. A SCIM delete request does not remove or deactivate the person in Ryvn. Deactivate them through SCIM with active: false, or remove their access in Ryvn.

​
Inspect the configuration

Return to Settings > Connections > SCIM directory. The directory row shows the endpoint, token version, and update time. Click the row to open a summary with the endpoint, token version, and token issue time. The existing token cannot be retrieved.

​
Rotate the token

Open the directory row’s actions menu and choose Rotate token, then confirm Rotate token. Copy the new token from the popup and update your IdP’s bearer credential. The endpoint and stored externalId values stay the same.
Rotation invalidates the previous token immediately. Provisioning requests using it will fail until you update the IdP with the replacement token, which is shown only once.
Check your IdP’s next provisioning result after updating the credential.

​
Remove or replace the directory

Open the row’s actions menu, choose Remove, and confirm Remove. This stops provisioning through that endpoint and invalidates its bearer token. It clears the directory’s associations with people, including stored externalId values, but keeps the people, their memberships and access, Groups, Team assignments, and SSO. Removing the directory is not an access-revocation action. Creating a directory again produces a different directory, endpoint, and token. Update the IdP with both new values; it must match existing people again. Retained Groups still belong to their original directory; the replacement does not silently adopt them. Retained Group names remain reserved, so sending a new Group with the same name can cause a conflict. Review the old Groups and their Team references before deleting retained Groups.

​
Troubleshooting

If the directory cannot be configured, contact Ryvn support without including the bearer token.