> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wede.pt/llms.txt
> Use this file to discover all available pages before exploring further.

# Provisioning (SCIM)

> Create, update and suspend wede accounts from your directory with SCIM 2.0

With SCIM 2.0 your directory, for example Microsoft Entra ID or Okta, manages the wede accounts of your organisation. It creates the accounts of the people you assign to wede, changes their role when their groups change and suspends them the moment they leave. Nothing is ever deleted: a suspended account keeps its history in the audit log.

Provisioning works together with [single sign-on](/security/single-sign-on.md). It needs single sign-on turned on and at least one verified email domain, and accounts created by your directory have no password: they sign in through your identity provider.

Only a `company_admin` of your organisation can connect a directory, in **Settings > Provisioning (SCIM)** of the dashboard.

***

## Connect your directory

1. In your directory, add wede as an application with SCIM provisioning.
2. Use the base address shown in the dashboard: `https://api.wede.pt/scim/v2`.
3. In the dashboard, create a token and paste it in your directory as a Bearer token. The token starts with `wscim_` and is shown only once: wede keeps only a hash of it. You can have up to 5 active tokens, and revoking one stops it at once.

***

## What wede supports

| Resource or feature | Support |
| - | - |
| `Users` | List, read, create, replace (`PUT`), update (`PATCH`), deactivate |
| `Groups` | List, read, create, replace, update members and name, delete |
| `ServiceProviderConfig`, `ResourceTypes`, `Schemas` | Yes |
| Filters | `attribute eq "value"`, for example `userName eq "ana@bank.com"` |
| Paging | `startIndex` and `count`, up to 200 per page |
| `PATCH` | Yes, including the variants that Entra ID and Okta send |
| Bulk, sort, ETag | No |

**Users.** The `userName`, or the primary email, must be an email in one of your verified domains: it is the identity of the account in wede. wede also keeps the display name, `active` and `externalId`. If an account with that email already exists in your organisation, the directory takes it over instead of creating a second one.

**Deactivating or deleting a user** suspends the account and ends its open sessions. Reactivating it in the directory makes it active again, with the role its groups give.

***

## Roles

Roles come from the same group lines as single sign-on, matched by group name or ID. When no group matches, the default role is used. With neither, the account is created but waits, suspended, until a group gives it a role.

Changing the role of an account or suspending it ends its open sessions at once. Saving new group lines in the dashboard recalculates the roles of the accounts that come from your directory straight away.

The emergency account of your organisation and the wede and country roles are never managed by a directory.

***

## Audit

Every change made by your directory is recorded in the audit log with an action that starts with `scim.`, for example `scim.user_created`, `scim.user_role_changed` or `scim.user_suspended`, and the creation and revocation of tokens as `tenant.scim_token_created` and `tenant.scim_token_revoked`. These entries can be sent to your SIEM with the [security export](/security/siem-export.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.