SCIM recipe
Okta
Configure Okta Lifecycle Management to provision Niah users and teams.
Contract tested July 30, 2026. The covered Niah operations are exercised by the SCIM compatibility suite: connection discovery, user create/update/deactivate/reactivate, import filtering, and group membership changes.
1. Connect Okta
- Create or open your Niah app in the Okta Admin Console and enable SCIM provisioning.
- Set the SCIM connector base URL to
https://api.niah.si/scim/v2. - Set the unique identifier field for users to
userName. - Select HTTP Header authentication and enter a Niah organization API key with
scim:readandscim:write. - Test the connector, then save it.
2. Enable actions
| Okta action | Niah support |
|---|---|
| Create Users | Supported |
| Update User Attributes | Supported |
| Deactivate Users | Supported via active=false |
| Reactivate Users | Supported via active=true |
| Import Users | Supported, including userName eq lookup |
| Sync Password | Not supported |
3. Map attributes
| Okta | SCIM |
|---|---|
user.login or email | userName (required) |
user.firstName | name.givenName |
user.lastName | name.familyName |
user.email | emails[type eq "work"].value |
| User status | active |
4. Push groups
Enable Push Groups after users are assigned. Okta groups become Niah teams, and pushed membership changes add or remove existing provisioned users.
Limitations: nested groups, role assignment, administrator grants, and API-scope assignment are not supported. A group member must already exist in the same Niah organization. Group deletion removes only the team.
Deprovisioning
Use Okta's Deactivate Users action. Niah preserves the identity and deactivates organization membership when Okta sends active=false. User DELETE is unsupported and must not be used as a lifecycle action.
Overview← SCIMNext recipeMicrosoft Entra ID →