Directory sync (SCIM)

One /v1 endpoint for every provider. Point your OpenAI client at a new base URL and key, bring your own provider keys, and pay 0% markup on tokens.

Directory sync (SCIM 2.0) lets your company directory manage who has access. When IT adds someone to the app in Okta or Microsoft Entra ID, they get a seat here; when IT deactivates them, their seat ends. Directory groups decide which clients (workspaces) people see.

Directory sync is part of the Enterprise plan and is set up by an Owner. Set up single sign-on first: directory sync only provisions people at your verified email domains, and they sign in with SSO.

What it does

  • New person in the directory → a Developer seat limited to workspaces. If they already have a seat, it keeps its role.
  • Group membership → the workspace roles you map to that group (Member or Workspace admin). Across several groups the highest role wins.
  • Deactivated or removed in the directory → their seat ends and their dashboard sessions end at once. API keys they created keep working, because they often run production agents. The Keys page marks them Creator left so you can decide.
  • Reactivated in the directory → nothing changes here. Bringing back a removed seat is an Owner’s decision: invite them again under Members.
  • Groups never grant an organisation role. Owners, Admins and Finance are set by hand under Members.
  • Workspace memberships you set by hand (Clients → People) are never changed by the directory.

Step 1: Create a SCIM token

  • In Settings → Directory sync (SCIM), select Create SCIM token.
  • Copy the token right away; it is shown only once. Also copy the SCIM base URL:
text
https://autonomousrelay.com/v1/scim/v2

Keep the token secret: anyone with it can add and deactivate people in your organisation. Replace token issues a new one and stops the old one at once.

Step 2: Connect your directory

Okta

  • Open the Autonomous Relay app you created for single sign-on. On the General tab, under App Settings, select Edit, set Provisioning to SCIM, and save.
  • On the new Provisioning tab, select Integration → Edit:
    • SCIM connector base URL: the base URL from step 1.
    • Unique identifier field for users: userName.
    • Supported provisioning actions: Push New Users, Push Profile Updates and Push Groups.
    • Authentication Mode: HTTP Header, and paste the token as the Bearer authorization.
  • Select Test Connector Configuration, then Save.
  • Under Provisioning → To App, select Edit and enable Create Users, Update User Attributes and Deactivate Users.
  • On Assignments, assign the people or groups who should have access. On Push Groups, push the groups you want to map to clients.

Microsoft Entra ID

  • In the Entra admin center, go to Identity → Applications → Enterprise applications → New application → Create your own application. Name it Autonomous Relay directory sync and choose Integrate any other application you don’t find in the gallery (Non-gallery).
  • Open its Provisioning page and select Get started. Set Provisioning Mode to Automatic.
  • Under Admin Credentials, set Tenant URL to the base URL from step 1 and Secret Token to the token. Select Test Connection, then Save.
  • Under Mappings, keep the defaults (userPrincipalName → userName). The user principal name must be at one of your verified domains.
  • Under Settings, set Scope to Sync only assigned users and groups, then assign users and groups on the app’s Users and groups page.
  • Set Provisioning Status to On and save. Entra syncs about every 40 minutes; Provision on demand pushes one person now.

Other directories

Any SCIM 2.0 client can use the base URL and token as an Authorization: Bearer header. We support /Users and /Groups with create, read, replace, PATCH and delete, and the filters userName eq, externalId eq and displayName eq. The userName must be the person’s work email.

Step 3: Map groups to clients

  • Once your directory has pushed its groups, they appear under Settings → Directory sync → Directory groups.
  • For each group, choose a workspace and a role (Member or Workspace admin) and select Map. A group can map to several workspaces.
  • Changes apply at once: everyone in the group gets the role, and anyone who leaves the group loses it.

Stopping directory sync

Stop directory sync deletes the token, so your directory can no longer make changes. People it provisioned keep their seats and roles; manage them under Members from then on.

Troubleshooting

  • 401 from your directory: the token is wrong or was replaced. Create a new one and paste it again.
  • 403: the organisation is not on the Enterprise plan.
  • “… is not one of this organisation’s verified domains”: verify that email domain under Settings → Single sign-on first, or correct the person’s user name.
  • “A user with userName … already exists”: the person was provisioned before. Your directory normally matches them by userName on its next sync.
  • Someone sees no clients: their seat is limited to workspaces. Map one of their groups to a client, add them under Clients → People, or set What they can see to Whole organisation under Members.