Single sign-on

Turn on SCIM, or make a new SCIM token

Turn on SCIM for the workspace's single sign-on, or replace its token: returns token (shown this once; the old one stops working), hint (its last four characters) and scim_url, the SCIM 2.0 base URL to give the identity provider with the token as a bearer token.

POST/workspaces/{workspace}/sso/scim

With SCIM on, only people the provider has assigned (active users) can sign in through single sign-on, and one it deactivates or deletes leaves the workspace at once: membership, roles, link and sessions. Owners are never removed that way. Users only; groups are not kept. Needs single sign-on set up and a paid plan. Recorded as sso.scim_enabled or sso.scim_token_rotated. Owners only, as people.

Authentication: Required. Send an access token as Authorization: Bearer.
MCP tool: workspace with action enable_scim, and the same inputs
Scope: An access token needs workspace:admin.

Path parameters

Name	Type	Required	Description
`workspace`	string	Yes	The workspace’s name, e.g. “acme”.

Example request

curl -X POST https://api.g1t.sh/workspaces/flagon-io/sso/scim \
  -H "Authorization: Bearer $G1T_TOKEN"

Example response

A successful request answers 200 with:

{
  "token": "g1t_scim_4f1c…",
  "hint": "9a2e",
  "scim_url": "https://api.g1t.sh/scim/v2/wsp_01m3xbtsa9d3b4c5e6f7g8h9j0"
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	`unauthenticated`	A token is required, or the one sent is not valid.
403	`forbidden`	The token is valid but not allowed to do this, such as a member-only change, or a token without the scope it needs.
404	`not_found`	It does not exist, or you cannot see it.
409	`conflict`	The request conflicts with the current state.
422	`invalid`	The input is not valid. `message` says which field and why.