> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylaunchkit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Directory sync overview

> SCIM 2.0 provisioning from Okta, Microsoft Entra, or any SCIM client

LaunchKit implements a **SCIM 2.0 service provider**, so your identity provider creates, updates, and deactivates workspace members (and, optionally, teams) directly from your directory.

|                |                                                                                  |
| -------------- | -------------------------------------------------------------------------------- |
| Base URL       | `https://api.trylaunchkit.ai/scim/v2`                                            |
| Authentication | `Authorization: Bearer lks01_...` (a workspace-scoped SCIM token)                |
| Content type   | `application/scim+json` on every response, including errors (RFC 7644 envelopes) |

## Supported resources

| Endpoint                                               | Operations                                                                      |
| ------------------------------------------------------ | ------------------------------------------------------------------------------- |
| `/Users`                                               | List (with filtering and pagination), create, get, replace (PUT), patch, delete |
| `/Groups`                                              | List, create, get, replace (PUT), patch, delete                                 |
| `/ServiceProviderConfig`, `/ResourceTypes`, `/Schemas` | Discovery (GET)                                                                 |

Pagination is capped at **200 resources per page**. Requests are rate-limited; a `429` response carries a `Retry-After` header.

## How resources map to LaunchKit

* **Users** are workspace members. `userName` is the member's email.
* **Deactivating a user** (`active: false`, or deleting the resource) releases the member's seat and archives their personal assets. This is the deprovisioning path to wire into your leaver process.
* **Groups** map 1:1 to LaunchKit **teams**, with a deliberate boundary: SCIM only sees and manages teams it created itself. Teams created manually in LaunchKit are invisible to your IdP and never modified by it, and SCIM-provisioned teams are managed solely by the IdP.

<Note>
  SCIM and [enterprise SSO](/en/sso/overview) are independent but designed to pair: SCIM decides *who exists* ahead of time, SSO decides *how they sign in*. With both enabled, a new hire is provisioned by the directory and signs in through your IdP on day one.
</Note>

Continue to [Setup](/en/scim/setup) for token minting and IdP configuration.