Skip to main content
LaunchKit implements a SCIM 2.0 service provider, so your identity provider creates, updates, and deactivates workspace members (and, optionally, teams) directly from your directory.

​
Supported resources

Pagination is capped at 200 resources per page. Requests are rate-limited; a 429 response carries a Retry-After header.

​
How resources map to LaunchKit

  • Users are workspace members. userName is the member’s email.
  • Deactivating a user (active: false, or deleting the resource) releases the member’s seat and archives their personal assets. This is the deprovisioning path to wire into your leaver process.
  • Groups map 1:1 to LaunchKit teams, with a deliberate boundary: SCIM only sees and manages teams it created itself. Teams created manually in LaunchKit are invisible to your IdP and never modified by it, and SCIM-provisioned teams are managed solely by the IdP.
SCIM and enterprise SSO are independent but designed to pair: SCIM decides who exists ahead of time, SSO decides how they sign in. With both enabled, a new hire is provisioned by the directory and signs in through your IdP on day one.
Continue to Setup for token minting and IdP configuration.