Okta SCIM Directory Sync

What does Okta send to Cremit?

Okta can push SCIM 2.0 user and group requests to Cremit’s /api/scim/v2 endpoint when provisioning is configured and enabled in the Okta app. Cremit stores user and group directory mappings, including active status and supported membership changes. A SCIM user record by itself does not create a Cremit login account or grant an organization membership. Assignments, SSO and membership policy must be checked separately.

When Cremit receives an inactive or deleted user event, it marks matching directory-managed membership in that organization inactive and attempts to revoke the user’s active sessions. This is a best-effort step that does not make the SCIM response fail if it cannot complete. It is not a promise that every account, another organization’s membership or every API token is revoked instantly. Check the resulting member status and session access during offboarding.

Configure the SCIM connection

In Cremit Platform, open directory integrations, add an Okta provider, and open its Tokens tab. Create a directory token and copy its value while the creation dialog is open: the plaintext is shown once, but the token remains usable until it expires or is revoked. Copy the SCIM base URL displayed there. A separate SAML provider may be useful for sign-in, but the SCIM directory provider and its token are configured separately.

In an Okta app integration that supports SCIM provisioning, set the Cremit SCIM base URL and the bearer token in its Provisioning settings. Test the credentials, then explicitly enable the user lifecycle actions your organization intends to send. Configure group push separately if group data is needed. Okta app availability and provisioning controls depend on your Okta configuration; this guide does not assume a published Cremit catalog app or a particular add-on.

Test the actual lifecycle

Assign a harmless test user to the Okta app and check the corresponding directory record and its last sync in Cremit. Push a test group if group context is required. Then deactivate the test user in Okta and verify the SCIM event, directory active state, directory-managed organization membership and session access. If the user only loses group membership, check that change separately; do not assume it is the same event as user deactivation.

Keep the SCIM bearer token secret, review its last-used time and revoke it in Cremit when replacing the connection. For an exposed credential associated with a departed person, confirm the current workload owner and rotate or revoke the credential at its issuer. A directory inactive flag does not disable that credential.

Primary documentation

Okta private SCIM integration setup

Okta SCIM 2.0 operations

Cremit credential ownership