Summary
The SCIM API token authenticates your identity provider to KnowledgeCity so it can automatically provision, update, and deactivate user accounts and groups. From the Integrations area you can copy the SCIM API URL and its token, and generate a new token whenever you need to rotate credentials. Regenerating the token issues a fresh secret and replaces the previous one so the connection stays secure.
Introduction
SCIM (System for Cross-domain Identity Management) provisioning lets your identity provider create, update, and deactivate accounts and adjust group membership in KnowledgeCity automatically, so account lifecycle mirrors your directory without manual data entry. To do this, your identity provider connects to a SCIM API endpoint (URL) and authenticates with a SCIM API token.
This feature is used by administrators and integration owners, the people responsible for provisioning access and maintaining the connection between your identity provider and KnowledgeCity. Regenerating the token solves the problem of rotating credentials on a schedule or replacing a token you believe may have been exposed, all without leaving the Integrations settings.
Key Concepts
- SCIM provisioning: automatic creation, update, and deactivation of user accounts and their group membership, driven by your identity provider so accounts stay in sync with your directory.
- SCIM API URL: the endpoint your identity provider connects to in order to send provisioning requests to KnowledgeCity.
- SCIM API token: the secret credential your identity provider presents to authenticate its requests to the SCIM API; treat it like a password.
- Copy: the action that puts the SCIM API URL or the token onto your clipboard so you can paste it into your identity provider's configuration.
- Regenerating the token: issuing a new SCIM API token that replaces the previous one, so the old token stops working and only the new value remains valid.
- Credential rotation: the practice of periodically replacing a token, or replacing it immediately if it may have been exposed, to reduce the risk of unauthorized access.
Steps to Follow
Open the Integrations settings
Sign in as an administrator and open the Integrations area from your account settings. This is where the SCIM connection details for your account are managed, alongside your other integration settings.
Copy the SCIM API URL
Locate the SCIM API URL and use the Copy action to place it on your clipboard. Paste this value into the provisioning configuration of your identity provider so it knows which endpoint to send requests to.
Copy the current SCIM API token
Locate the SCIM API token and use the Copy action to place it on your clipboard. Paste it into your identity provider alongside the URL so it can authenticate its provisioning requests. Keep this value out of emails, public forums, and client-side code, because anyone who holds it can act against your SCIM endpoint.
Generate a new SCIM token
When you are rotating credentials on a schedule, or you suspect the current token has been exposed, generate a new SCIM token. Regenerating the token issues a fresh secret and replaces the previous one, which means the old token stops working. Because this invalidates the previous value, any system still using the old token will lose access until it is updated.
Update your identity provider with the new token
After generating the new token, copy it and paste it into your identity provider's SCIM configuration, replacing the old value. Save the configuration on the identity provider side so provisioning continues without interruption. It is good practice to confirm that user and group synchronization still works after the change.
Conclusion
The SCIM API URL and token connect your identity provider to KnowledgeCity so user and group provisioning stays automatic and accurate. Copying these values wires up the connection, and generating a new token lets you rotate credentials securely. Just remember that a new token replaces the old one, so update your identity provider promptly to avoid a break in provisioning.