Enterprise plan only. SCIM user provisioning is available exclusively on the Enterprise tier. If you are on another plan and want to use it, contact us to talk about upgrading.

This reference lists the SCIM attributes Pensero reads when your identity provider pushes a user. Use it when configuring attribute mappings in Okta or another SCIM 2.0 client. See User Data Fields for how each Pensero field affects reporting.

Connection details

Base URL: https://pensero.ai/api/scim/v2
Authentication: HTTP Header, Authorization: Bearer <token:secret> (the full string shown once when you generate the token)
Unique identifier: userName (the user’s corporate email)
Endpoints: /ServiceProviderConfig, /ResourceTypes, /Schemas, /Users. /Groups, /Bulk and /Me are not supported.
Operations: GET (list and filter), POST, PUT, PATCH, DELETE on /Users. Filtering supports eq only (for example userName eq "[email protected]").

Core user attributes

Schema: urn:ietf:params:scim:schemas:core:2.0:User

SCIM attribute	Type	Pensero field	Notes
`userName`	String	Email	Required. Must be the corporate email. Used to match existing users and prevent duplicates.
`name.givenName`	String	First name	Falls back to `displayName` if missing.
`name.familyName`	String	Last name	Falls back to `displayName` if missing.
`emails[].value`	String	Email	Used only when `userName` is not an email.
`active`	Boolean	Active / deactivated	Managed by the IdP. `false` deactivates the user, frees the seat and ends reporting lines and team memberships. Do not map manually.

Enterprise extension

Schema: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

SCIM attribute	Type	Pensero field	Notes
`manager`	String	Manager	Send the manager’s email. If no user in your organization has that email, the push fails with a 400 error.
`externalId`, `userType`, `department`, `division`, `employeeNumber`	String	—	Accepted but ignored.

Pensero extension

Schema (use this as the external namespace in Okta): urn:pensero:params:scim:schemas:extension:2.0:User

SCIM attribute	Type	Pensero field	Notes
`githubUsername`	String	GitHub username	Must be unique across Pensero. Required for coding metrics on GitHub.
`gitlabUsername`	String	GitLab username	Must be unique across Pensero.
`bitbucketUsername`	String	Bitbucket username	Must be unique across Pensero.
`jiraUserId`	String	Jira account	Jira account ID or email. Only applied if your organization has Jira connected.
`slackUserId`	String	Slack account	Slack member ID or email. Only applied if your organization has Slack connected.
`employeeType`	String	Employee type	`FTE` or `CONTRACTOR` (case-insensitive). Other values are ignored.
`startDate`	String	Started at	Format `YYYY-MM-DD`. Any other format fails the push with a 400 error.
`level`	Integer	Level	`1`, `2` or `3`. Other values are ignored.
`penseroLoginEnabled`	Boolean	Login enabled	Defaults to `false`. Set to `true` to let the user sign in to Pensero. Any create or full update that omits it sets login back to false, so map it in your IdP rather than enabling login by hand.
`team`	String	—	Accepted and logged but not applied (advertised as read-only in `/Schemas`). Manage teams in Pensero.
Custom field name	String	Custom field	Any attribute whose name matches (case-insensitively) a custom field enabled in your organization is written to that field. For select-type custom fields the option must already exist.

Response codes

Code	Meaning
200 / 201	Success.
400	Invalid value: manager email matches no user, `startDate` not `YYYY-MM-DD`, or no email could be derived from `userName` / `emails`.
401	Missing, invalid, revoked or regenerated token, or user provisioning is not enabled for the organization (Enterprise plan required).
403	Creating or reactivating the user would exceed the seat limit.
404	User not found in this organization.
409	Uniqueness conflict: the email or a Git username already belongs to another user or organization.

SCIM attribute reference