SCIM provisioning
LiveSCIM 2.0 user provisioning from your IdP — create, update, deactivate and delete, with a provisioning log.
Plan availability. SCIM is fully implemented, but this is not switched on in any of our four published plans. Starter, Pro, Business and Enterprise all resolve to the same feature set and this one is off in all of them, so a subscription will not unlock it — it has to be enabled for your organisation by arrangement. Ask us before you plan around it.
- ✓SCIM 2.0 user endpoint — list, create, read, replace, patch and delete
- ✓Deactivation via the active flag as well as hard delete
- ✓Discovery documents — service provider config, resource types, schemas
- ✓Read-only virtual groups mapping to a LexVio role
What it is.
A standards-compliant SCIM 2.0 user endpoint at the canonical path, with the discovery documents an IdP expects — service provider configuration, resource types and schemas. Your IdP creates, updates, deactivates and deletes users, and every call is written to a provisioning log so you can see exactly what your IdP did and when.
Group support is read-only and virtual: three groups exist, derived by filtering users on their role, so your IdP can read them and map a group to a LexVio role. Your IdP cannot create or modify a group here, and there is no workspace to map a group onto — see the Workspaces page for why.
Three steps.
End to end.
Mint a bearer token in the admin surface and give your IdP the SCIM base URL.
IdP group display names map to a LexVio role — company admin or member.
Every provisioning call is recorded, so a failed sync is diagnosable rather than mysterious.
What you get.
- ✓SCIM 2.0 user endpoint — list, create, read, replace, patch and delete
- ✓Deactivation via the active flag as well as hard delete
- ✓Discovery documents — service provider config, resource types, schemas
- ✓Read-only virtual groups mapping to a LexVio role
- ✓Every provisioning call written to a log
- ✓Bearer tokens stored hashed, with a visible prefix, mintable and revocable
Quick answers.
No. Groups are read-only and derived from user roles — your IdP can read them and use them to set a role, but not create or edit them.
Not a single action. Rotation is mint a new token, point the IdP at it, then revoke the old one.
No — SCIM works on its own, which is just as well, because SAML sign-in is not shipped.
More in Team & Enterprise.
Not built. The organisation is the isolation boundary; matters are how work is grouped inside it.
Four seeded roles with per-capability view / add / edit / delete permissions, plus custom roles you define.
Shared editing sessions on a document, and a propose-review-merge flow for changes to it.
Group contracts, court research, compliance items, meetings and tasks by matter — with a timeline of everything that happened on it.