Everything you need to integrate, configure, and operate the LabsNinja SCIM Connector.
Sign up at /signup and verify your email. Your workspace and master tenant are provisioned automatically — no manual setup needed.
In the customer portal, open /portal/connector and create a SCIM connector. Copy the one-time bearer token immediately — it is only shown once.
Set the SCIM base URL to https://scim.labsninja.com/scim/v2 and paste the bearer token into your IdP.
Trigger a full sync from your IdP. Monitor provisioning from the customer dashboard at /portal/.
Platform operators only: tenants and SCIM clients can also be managed centrally from the operator console at /admin/. That console is for LabsNinja platform operators — it is not part of customer onboarding, and customer accounts cannot sign in to it.
Group membership is managed with PATCH /scim/v2/Groups/{id} (add / remove / replace members) and dedicated member sub-resources POST /scim/v2/Groups/{id}/members and DELETE /scim/v2/Groups/{id}/members/{userId}. Full-resource replace via PUT /scim/v2/Users/{id} and PUT /scim/v2/Groups/{id} is supported (RFC 7644 §3.5.1) alongside PATCH; unknown/extension attributes an IdP sends are accepted and ignored (not stored). See the capability matrix for the exact supported filter and PATCH subset.
LabsNinja exposes a standard SCIM 2.0 endpoint, so any SCIM 2.0-capable identity provider can provision into it. The setup is the same shape everywhere — point the IdP at your SCIM base URL, paste your bearer token, and enable the user and group operations you want — only the console labels differ between providers. The guides below cover the common ones plus the generic flow.
Create a connector in the customer portal at /portal/connector. You'll get a SCIM base URL and a one-time bearer token — copy the token immediately, because it is hashed at rest and shown only once. Rotating a token revokes the previous one straight away, so update your IdP after a rotation. Every request is authenticated: a missing or unknown token is rejected with 401, and a revoked or rotated-away token with 403.
In the Okta admin console open your application's Provisioning tab and choose Configure API Integration. Set the SCIM connector base URL to your LabsNinja base URL and paste the bearer token as the API token, then enable Create Users, Update User Attributes, and Deactivate Users under To App. Use the Push Groups tab to provision group membership (Okta sends membership changes as PATCH operations). LabsNinja advertises its capabilities at /ServiceProviderConfig, so Okta's connection test reflects what is actually supported.
In Entra ID (Azure AD), open Enterprise applications → your app → Provisioning, set Provisioning Mode to Automatic, and enter your LabsNinja base URL as the Tenant URL and the bearer token as the Secret Token. Run Test Connection, review the attribute Mappings, then start provisioning. Entra provisions users and group memberships with PATCH; it does not require full-resource replace.
In the JumpCloud admin console, open your SSO application's Identity Management / Configure SCIM section, set the Base URL to your LabsNinja base URL and the Token Key to your bearer token, and enable user and group provisioning. LabsNinja publishes its supported operations at /ServiceProviderConfig for any client that reads it.
Where your Google Workspace app exposes SCIM auto-provisioning, open Admin console → Apps → Web and mobile apps → your app → Auto-provisioning and supply the LabsNinja base URL and bearer token. Google Workspace's provisioning support varies by application type; use the same base URL and token wherever its SCIM 2.0 flow is available.
For any other IdP with a SCIM 2.0 client — OneLogin, Ping, or a custom implementation — configure a SCIM 2.0 / custom provisioning app, set the base URL and bearer token, and let it discover capabilities from /ServiceProviderConfig, /Schemas, and /ResourceTypes. Filtering is eq-based on a narrow attribute set (userName, externalId for Users; displayName for Groups); list responses page with startIndex and count.
You can define and dry-run attribute mappings from the connector page before they affect anything: the preview transforms a sample payload and shows the result without changing live provisioning. Whether saved mappings are then applied to live SCIM ingestion depends on whether attribute mapping is enabled on this deployment — the connector page shows the current state, and preview works either way. Most IdPs also let you map source attributes on their side; you can use either or both.
LabsNinja SCIM is built on the open SCIM 2.0 standard (RFC 7643/7644), so you are never tied to a single identity provider. The same connector works with any SCIM 2.0-capable IdP — Okta, Microsoft Entra ID, Google Workspace, JumpCloud, OneLogin, Ping, or a custom implementation.
Owner-controlled JSON data export is available: workspace owners and administrators can download their workspace configuration, provisioned users and groups, team roster, and redacted audit history from the customer portal. Automated provider-to-provider migration tooling remains on the roadmap and is not available today. Owner-controlled account closure is available: requested in the portal, confirmed by email, and processed by our team. The flow is intentionally not instant, so requests can be reviewed before completion. Provider switching uses the standard SCIM surface you already have.
Talk to us about your identity stack and provisioning requirements.
Contact Support