Volnyn – Website Builder, Domains, Property, Freelancers & Free Games
Open App

Set up SCIM user provisioning

Automatically create and remove Volnyn team members from Okta, Microsoft Entra ID, JumpCloud, or any SCIM 2.0 provider using a per-team bearer token.

SCIM (System for Cross-domain Identity Management) lets your identity provider provision and deprovision people on a Volnyn team. A SCIM “User” maps to an AiTeamMember row — access to the team is granted or revoked without deleting the person’s Volnyn account.

Mint and disable tokens from the same SSO settings page as SAML: /user/sso.

Prerequisites

  • Team owner access
  • An IdP that supports SCIM 2.0 (Okta, Entra ID, JumpCloud, …)
  • Ideally SAML SSO configured for the same team so provisioned users have a clear sign-in path
  • The team id used in the SCIM base URL

Volnyn’s SCIM API is team-scoped (/scim/v2/{team}/Users). It does not expose a Groups resource today.

How SCIM works in Volnyn

User provisioning

When the IdP creates or assigns a user:

  1. The IdP sends a SCIM request with a bearer token.
  2. Volnyn authenticates the token (stored only as a SHA-256 hash).
  3. A team membership is created/updated for that email.

User deprovisioning

When the IdP deactivates or deletes the SCIM user:

  1. Volnyn revokes the member’s access to the team.
  2. The underlying Volnyn user account is not deleted.

Supported operations

Resource Operations
Users List, get, create, patch/update, delete
Groups Not implemented

Minimal filter support includes forms like:

userName eq "user@acme.com"

Set up SCIM in Volnyn

  1. Open /user/sso as the team owner.
  2. Under SCIM, generate a token.
  3. Copy it immediately — Volnyn shows the raw token once; only a hash is stored.
  4. Note your SCIM base path:
Setting Value
Base URL https://your-host/scim/v2/{team}
Users endpoint https://your-host/scim/v2/{team}/Users
Auth Bearer token (HTTP Authorization header)
Unique id Email / userName

Replace {team} with your numeric team id.

Rotate or disable

  • Generate a new token to rotate (update the IdP right away — the old token stops working when replaced).
  • Disable SCIM on the same page to stop accepting provisioning calls. Existing members remain until you remove them manually or via a final IdP sync.

Configure your identity provider

Okta (general)

  1. Open your Volnyn (or custom SAML) app → Provisioning.
  2. Enable API integration; paste Base URL and API token.
  3. Enable Create / Update / Deactivate users.
  4. Assign people or groups.

Microsoft Entra ID (general)

  1. Enterprise application → Provisioning.
  2. Tenant URL = SCIM base; Secret token = Volnyn SCIM token.
  3. Test connection, then start provisioning.

Other SCIM 2.0 IdPs

Use bearer auth, Users endpoint as above, and unique identifier = email. Enable create, update, and deactivate.

Limitations

  • Users only — no SCIM Groups API
  • Team membership, not platform-wide account deletion
  • Token shown once — rotate if lost
  • Owner-only management
  • Filter surface is minimal (userName eq "…")

FAQ

Can I use SCIM without SSO?
Technically the SCIM API can mint members with a valid token, but users still need a way to sign in. Configure SAML SSO for a complete enterprise setup.

What happens to existing members when I enable SCIM?
They stay. SCIM manages members the IdP sends; previously invited people can coexist.

I lost the API token. What now?
Generate a new token on /user/sso and update the IdP. The previous token will no longer match the stored hash.

Does deactivate delete the Volnyn login?
No. It removes team access only.