SCIM provisioning
Directory provisioning, Clerk sign-in, and the account lifecycle Sentisec supports.
Hosted Sentisec uses Clerk for identity. Directory provisioning requires a configured connection for your organisation; it is not automatically enabled by choosing a Sentisec plan. Contact us to establish your directory requirements and connection details before configuring SCIM.
Setting it up
Clerk supports SAML and OIDC enterprise sign-in, and SCIM directory sync for a configured enterprise connection. Those provider capabilities do not by themselves provision a Sentisec integration. Use only the connection URL, credentials and mappings supplied for your organisation. See Clerk's directory-sync documentation.
Pair directory provisioning with Single Sign-On: sign-in establishes identity, while workspace permissions decide access. Sentisec does not expose its own general-purpose SCIM Users or Groups API.
What propagates, and when
| Identity event or change | Sentisec behaviour |
|---|---|
| Clerk user creation delivered to the configured webhook | Creates a personal workspace and initial workspace API key; the webhook response carries that key once. It is not a directory-issued user credential. |
| Clerk organisation creation delivered to the configured webhook | Creates the organisation workspace. |
| Organisation membership or role | Workspace access uses the organisation and role in the signed Clerk session token presented with the request. |
| User deletion or directory deactivation | Do not rely on this to delete workspaces, expire sessions, or revoke workspace API keys. Revoke keys explicitly during offboarding. |
The API verifies the token on each request; it does not query your directory on each request. A role change must reach a refreshed token before that request can reflect it. Directory groups are not automatically mapped to Sentisec workspaces by a Sentisec SCIM service.
What SCIM does not manage
Workspace API keys, stored provider credentials, and workspace policies have their own lifecycle. During offboarding, remove the person's identity access and separately revoke relevant workspace keys through the dashboard or Administration API.
Related
Self-managed OIDC
Point a Sentisec install you run yourself at your own OIDC provider — realm setup, the workspace claim, role mapping, and what the mode does not cover.
Roles and permissions
A Sentisec workspace has two roles, admin and member. What each can do, and how your identity provider assigns them.