SCIM provisioning
LiveSCIM 2.0 user provisioning from your IdP — create, update, deactivate and delete, with a provisioning log.
Plan availability. SCIM is fully implemented, but this is not switched on in any of our four published plans — Starter, Pro, Business and Enterprise all have it off — so a subscription will not unlock it. It has to be enabled for your organisation by arrangement. Ask us before you plan around it.
- ✓SCIM 2.0 user endpoint — list, create, read, replace, patch and delete
- ✓Deactivation via the active flag as well as hard delete
- ✓Discovery documents — service provider config, resource types, schemas
- ✓Read-only virtual groups mapping to a LexVio role
What it is.
A standards-compliant SCIM 2.0 user endpoint at the canonical path, with the discovery documents an IdP expects — service provider configuration, resource types and schemas. Your IdP creates, updates, deactivates and deletes users, and every call is written to a provisioning log so you can see exactly what your IdP did and when.
Group support is read-only and virtual: three groups exist, derived by filtering users on their role, so your IdP can read them and map a group to a LexVio role. Your IdP cannot create or modify a group here, and there is no workspace to map a group onto — see the Workspaces page for why.
Three steps.
End to end.
Mint a bearer token in the admin surface and give your IdP the SCIM base URL.
IdP group display names map to a LexVio role — company admin or member.
Every provisioning call is recorded, so a failed sync is diagnosable rather than mysterious.
What you get.
- ✓SCIM 2.0 user endpoint — list, create, read, replace, patch and delete
- ✓Deactivation via the active flag as well as hard delete
- ✓Discovery documents — service provider config, resource types, schemas
- ✓Read-only virtual groups mapping to a LexVio role
- ✓Every provisioning call written to a log
- ✓Bearer tokens stored hashed, with a visible prefix, mintable and revocable
Quick answers.
No. Groups are read-only and derived from user roles — your IdP can read them and use them to set a role, but not create or edit them.
Not a single action. Rotation is mint a new token, point the IdP at it, then revoke the old one.
No — SCIM works on its own, which is just as well, because SAML sign-in is not shipped.
More in Team & Enterprise.
Not built. The organisation is the isolation boundary; matters are how work is grouped inside it.
Four seeded roles with per-capability view / add / edit / delete permissions, plus custom roles you define.
Shared editing sessions on a document, and a propose-review-merge flow for changes to it.
Group contracts, research, obligations, meetings and tasks by matter — with a timeline of everything that happened on it.