Enterprise plan only. SCIM user provisioning is available exclusively on the Enterprise tier. If you are on another plan and want to use it, contact us to talk about upgrading.

Pensero's SCIM endpoint is not tied to Okta. Any client that speaks SCIM 2.0 (Microsoft Entra ID, OneLogin, JumpCloud, a private or custom SCIM application in your IdP, or a provisioning client you built yourself) can create, update and deactivate Pensero users.

On Okta, use the step-by-step Set up SCIM with Okta guide instead.

For an overview of what SCIM does in Pensero, see User provisioning with SCIM.

Prerequisites

Your Pensero organization is on the Enterprise plan and user provisioning is enabled for it. If you do not see Organization Settings → User provisioning, contact [email protected].
You are an organization administrator in Pensero.
Your identity provider or client supports outbound user provisioning over SCIM 2.0 with bearer-token authentication.
Every user you plan to provision has a corporate email address. Pensero identifies people by email, so the SCIM userName must be the user's email.
Your Pensero organization has enough active seats for the users you plan to provision (see How to add and manage seats).

Configuration steps

Step 1: Generate a SCIM token in Pensero

Go to Organization Settings → User provisioning.
Click Generate token.
Copy the full token string (in the form token:secret) and store it somewhere safe. It is shown unmasked only once; you can copy it again later from the same page while it is active.

Step 2: Point your SCIM client at Pensero

Use these connection details in your IdP's provisioning settings or your own client:

Base URL: https://pensero.ai/api/scim/v2
Authentication: HTTP Header — Authorization: Bearer <token:secret> (the full string from step 1)
Unique identifier: userName (the user's corporate email)
Endpoints: /ServiceProviderConfig, /ResourceTypes, /Schemas, /Users. /Groups, /Bulk and /Me are not supported.
Operations: GET (list and filter), POST, PUT, PATCH and DELETE on /Users. Filtering supports eq only (for example userName eq "[email protected]"), with startIndex and count pagination.
Content type: application/scim+json (plain JSON is also accepted).

Do not add a trailing slash to endpoint paths. Requests to /api/scim/v2/Users/ are redirected to the slash-free form and the redirect drops the request body, which most SCIM clients surface as a generic connector failure. Call /api/scim/v2/Users exactly.

Step 3: Map attributes

For a private or generic SCIM app you author the attribute mappings by hand. Two shortcuts:

The Supported attributes card on the User provisioning settings page lists every attribute Pensero accepts — it is the same contract GET /Schemas returns.
The SCIM attribute reference lists every attribute, the Pensero field it writes, and the values it accepts.

The essentials:

userName — required. The corporate email; also how existing Pensero users are matched to avoid duplicates.
name.givenName / name.familyName — first and last name (displayName is the fallback when either is missing).
emails[].value — read only when userName is not an email.
active — drives deactivation/reactivation. Managed by your client's lifecycle operations; do not map it as a plain attribute.
manager — send the manager's email (under urn:ietf:params:scim:schemas:extension:enterprise:2.0:User). If no Pensero user in your organization has that email, the push fails with a 400 naming the address — provision managers first.
Pensero extension attributes under urn:pensero:params:scim:schemas:extension:2.0:User: githubUsername, gitlabUsername, bitbucketUsername, jiraUserId, slackUserId, employeeType (FTE / CONTRACTOR), startDate (YYYY-MM-DD), level (1–3) and penseroLoginEnabled. Attribute names outside the core schema are matched case-insensitively, so SlackUserID works too.
Custom fields: any attribute whose name matches (case-insensitively) an enabled custom field in your organization is written to it. For select-type custom fields the option must already exist.

Step 4: Enable login where needed

Provisioning a user does not let them sign in. Login is opt-in through the penseroLoginEnabled attribute (off by default):

Send penseroLoginEnabled: true (boolean or the string "true") for people who should be able to sign in.
Every full profile push (POST or PUT) that omits the attribute sets login back to off — map it in your client rather than enabling login by hand in Pensero, which the next sync undoes. A PATCH that omits it leaves the current value unchanged.

Step 5: Provision users

Trigger a push from your IdP or client, then check Organization Settings → Users in Pensero. Users appear after their first push; if a Pensero user already exists with the same email, it is linked and updated rather than duplicated. Profile changes apply on each subsequent push, and deactivating or unassigning a user in your IdP deactivates them in Pensero — their seat is freed, reporting lines and team memberships end, and their historical data is kept. See User provisioning with SCIM for the full lifecycle.

Troubleshooting

Response	Cause	Fix
401 Unauthorized	Token missing, mistyped, revoked or regenerated, or user provisioning is not enabled for your organization (Enterprise plan required).	Generate a new token in Pensero and update the token in your client. If you do not see the User provisioning page, contact support.
403 Forbidden	Provisioning or reactivating the user would exceed your seat limit.	Add seats, or free seats by deactivating users or assigning the Viewer role, then retry.
409 Conflict	The email or a Git username is already used by another Pensero user or organization.	Fix the value in your IdP or in the other Pensero user, then retry.
400 Bad Request	The manager value matches no Pensero user's email, `startDate` is not `YYYY-MM-DD`, or no email could be derived from `userName`/`emails`.	Provision the manager first, check the date format and that `userName` is an email, then retry.
404 Not Found	The user id does not exist in this organization, or the path is unsupported (for example `/Groups`).	Check the path and that the user was provisioned. Groups are not supported — manage teams in Pensero.
429 Too Many Requests	Rate limit reached.	Back off and retry after the `Retry-After` interval; sequential provisioning is unaffected.

Also check: user created but cannot sign in → map penseroLoginEnabled to true. A renamed user appears as new → Pensero matches by email, not externalId, so keep emails stable. A reactivated user has no manager or team → push the manager again and re-add the team in Pensero; reactivation does not restore them.

Support

For any question about connecting a non-Okta identity provider, contact [email protected].

Set up SCIM with a different identity provider