Organizations

SCIM 2.0 provisioning

Add, update and deactivate members and groups from Okta, Microsoft Entra ID, JumpCloud or any SCIM 2.0 identity provider.

Base URL: https://rqblosdixajthfdzqotj.supabase.co/functions/v1/scim/v2
Auth: Bearer pxscim_…
Paging: startIndex, count (up to 200)

Set up

Open Admin console › Security › Sign-in & SSO (Business plan).
Verify your company domain by adding the DNS TXT record shown on the screen.
Paste your identity provider's SAML metadata URL and save. Test sign-in with one account before you require SSO for everyone.
Create a SCIM token and add it, with the SCIM URL, to your identity provider to provision people and groups.
Map each SCIM group to a vault so membership follows your directory. Removing someone revokes their access and flags shared vaults for key rotation.

SSO signs people in; their separate vault password still protects the vault, so the identity provider can never read vault data.

Step-by-step for your identity provider: SSO and SCIM guide.

Connection

Base URL: https://rqblosdixajthfdzqotj.supabase.co/functions/v1/scim/v2
Auth: Authorization: Bearer pxscim_…
Paging: startIndex, count (up to 200)

Find and deactivate a user

curl -s 'https://rqblosdixajthfdzqotj.supabase.co/functions/v1/scim/v2/Users?filter=userName%20eq%20%22ada%40example.com%22' \
  -H "Authorization: Bearer $PASSKEY_X_SCIM_TOKEN"

# Deactivate (access to every shared vault ends at once)
curl -s -X PATCH "https://rqblosdixajthfdzqotj.supabase.co/functions/v1/scim/v2/Users/$USER_ID" \
  -H "Authorization: Bearer $PASSKEY_X_SCIM_TOKEN" -H 'Content-Type: application/scim+json' \
  -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"replace","value":{"active":false}}]}'

Routes

Method and path	What it does
`GET /ServiceProviderConfig`	What this server supports (PATCH, filters, up to 200 results).
`GET /ResourceTypes · GET /Schemas`	The User and Group resource types and their schemas.
`GET /Users · POST /Users`	Find people (with a filter) or add one. A new person gets an invitation to the organization.
`GET · PUT · PATCH · DELETE /Users/{id}`	Read, replace, change (active: false deactivates) or remove a person.
`GET /Groups · POST /Groups`	Find groups or add one.
`GET · PUT · PATCH · DELETE /Groups/{id}`	Read, replace, add or remove members, or delete a group.

Filters and PATCH

Filters: userName, externalId or emails eq for users; displayName or externalId eq for groups. PATCH follows RFC 7644 (add, replace and remove, including members[value eq "…"]). Errors use the SCIM error schema with scimType. Deactivating a user ends their access to every shared vault at once; their personal vault stays theirs.

Need help building on Passkey-X?

Questions about the API, a bug or a missing endpoint? Our team replies by email, usually within one business day.

Contact developer support Help Center