Skip to main content
This topic explains how to use the System for Cross-domain Identity Management (SCIM) API to work with users, roles, and teams in your SSO-enabled LaunchDarkly account. The SCIM API enables user provisioning of account members from identity providers (IdPs). SCIM enables IdPs such as Okta, OneLogin, or Entra ID to tell LaunchDarkly which users should or should not have an account, and optionally determine what level of access users have in LaunchDarkly. SCIM uses web (REST) APIs to exchange data formatted in JSON, with a standard schema that works with two resource types: User and Group. The LaunchDarkly SCIM API maps the Group resource to LaunchDarkly teams. Group-based team sync is currently only available through the Okta integration. We provide an extension schema to work with LaunchDarkly roles. To learn more, read Teams and Roles.
You cannot manage teams using the UI after enabling SCIMIf you configure SCIM to provision resources from identity providers, you can no longer manage teams using the LaunchDarkly user interface.

​
Authentication

The SCIM API is only supported for the OAuth2 authorization type. Not all supported third-party providers support user provisioning through SCIM. To learn more about how LaunchDarkly treats users imported from the IdP, read Default initial role. All SCIM endpoints require OAuth2 authentication with the scim scope. Regular personal access tokens will not work. You must use a SCIM-enabled OAuth client. The following information is generally needed to configure SCIM in your IdP. The actual names for these fields may vary by IdP:
  • SCIM Base URI: https://app.launchdarkly.com/trust/scim/v2
  • Authorization method: oauth2
  • Authorization URI: https://app.launchdarkly.com/trust/oauth/authorize
  • Access token URI: https://app.launchdarkly.com/trust/oauth/token
  • Unique Identifier field for account members: userName
If you are using the LaunchDarkly app from the Okta or OneLogin catalog, authentication is handled automatically during the setup wizard. For Entra ID or any other provider you configure manually, you will also need a Client ID and Client Secret. Start a Support ticket and we will generate these for you.
You can also use the REST API: OAuth2 Clients

​
SCIM API reference

To learn more about working with the SCIM API, read the following topics: