Skip to main content
For organizations using the public Basedash deployment at charts.basedash.com, SCIM provisioning is available on the Enterprise plan. SCIM is also available in self-hosted deployments. SCIM lets a compatible identity provider, such as Okta or Microsoft Entra ID, manage users, groups, and group memberships in your Basedash organization.
Only organization admins can configure SCIM or manage SCIM tokens. In Basedash, go to Settings → Security to get started.

​
Configure SCIM

  1. In Settings → Security, create a SCIM token.
  2. Give the token a name that identifies its identity provider or purpose.
  3. Copy the token when it appears. SCIM tokens begin with bd_scim_ and are shown only once.
  4. In your identity provider, create a SCIM 2.0 application or connection.
  5. Set the base URL and use the SCIM token as the bearer token.
  6. Test the connection, then assign the users and groups you want to provision.
For Basedash Cloud, use this base URL: 
https://charts.basedash.com/scim/v2
For self-hosted Basedash, append /scim/v2 to your deployment’s base URL. For example: 
https://charts.example.com/scim/v2
Store the token securely when you create it. Basedash stores only a hash of the token and cannot show it again.
Refer to your identity provider’s documentation for its SCIM application fields and assignment workflow. The names of these settings vary between providers.

​
User provisioning

Basedash supports these user lifecycle operations:
OperationBehavior
CreateCreates the user as a member of the organization without sending an invite email
List and getReturns provisioned users individually or as a collection
Update and PATCHUpdates supported profile and active-status fields
DeactivateDeactivates the user’s organization membership
ReactivateReactivates a previously deactivated organization membership
DeleteDeactivates the user’s organization membership rather than deleting the user record
Provisioned users always receive the Member role. Change roles separately in Basedash when needed. The user’s email address is their SCIM userName. Both the email address and userName are immutable after provisioning.

​
Group provisioning

Basedash supports creating, listing, getting, updating, patching, and deleting groups through SCIM. Group membership sync adds and removes provisioned users as your identity provider changes group assignments.
Group sync manages group records and membership. Configure each group’s permissions separately in Basedash.

​
Manage tokens

The SCIM token list in Settings → Security shows each token’s name and when it was last used. Use separate named tokens when you need to identify or rotate identity provider connections independently. To rotate a token:
  1. Generate and copy a new named token.
  2. Replace the bearer token in your identity provider.
  3. Test provisioning with the new token.
  4. Revoke the old token in Settings → Security.
Revoking a token prevents subsequent SCIM requests that use it. If a token is exposed or no longer needed, revoke it promptly.

​
Discovery endpoints

SCIM clients can inspect the service through these discovery endpoints:
  • /ServiceProviderConfig
  • /Schemas
  • /ResourceTypes
Append each path to the SCIM base URL. For example, the Basedash Cloud service provider configuration is available at: 
https://charts.basedash.com/scim/v2/ServiceProviderConfig

​
Limitations

  • Bulk operations are not supported.
  • Sorting is not supported.
  • ETags are not supported.
  • Password changes through changePassword are not supported.
  • Filtering supports one eq comparison at a time. Compound filters and other filter operators are not supported.

​
Troubleshooting

Confirm that the identity provider sends the token in the Authorization header as a bearer token. Check that the complete token was copied, has not been revoked, and belongs to the Basedash organization you are provisioning.
The token was recognized, but SCIM is not available for the organization associated with it. Confirm that the organization has a plan that includes SCIM provisioning.
Inspect the response body for the invalid field or request. Common causes include malformed SCIM JSON, an attempt to change an immutable email or userName, and an unsupported or compound filter. Also confirm that the request uses the SCIM content type application/scim+json.

​
Self-hosted deployments

SCIM works in self-hosted Basedash without any SCIM-specific environment variables. Use your deployment’s public base URL followed by /scim/v2, and configure tokens from Settings → Security in the same way as Basedash Cloud.