SCIM provisioning | Farside Research

Pick your identity provider

Farside speaks standard SCIM 2.0, so most providers can connect. We have step by step guides for two of them.

OktaAdd a SCIM connector, push users and push groups.
Microsoft Entra IDAutomatic provisioning for an enterprise application.

At a glance

Use these values when your provider asks for them.

Item	Detail
Base URL	`https://api.farsideresearch.com/scim/v2`
Protocol	SCIM 2.0 (RFC 7643 and RFC 7644)
Authentication	Bearer token that starts with fss_, sent in the Authorization header
Users	Create, update, deactivate, delete, filter by userName, externalId or email, paging
Groups	Create, rename, add and remove members, delete
Rate limit	600 requests per minute per token
Not supported	Bulk, sort, ETags and password sync

Create a provisioning token

An owner or admin creates the token in Farside under Settings, then Security, then Provisioning. Give it a name you will recognize later, such as the identity provider it belongs to.

Farside shows the token once. Copy it somewhere safe before you close the dialog, because it cannot be shown again. If you lose it, rotate the token and paste the new one into your identity provider. You can revoke a token at any time, and a workspace can have up to 5 active tokens.

What to expect once it is running

Groups pushed from your identity provider show up in Farside, where an admin can map each one to a Farside role: Admin, Member or Read only. The mapping lives in Farside, so changing a role never means editing the connector.

SCIM never changes an owner, and the last owner of a workspace cannot be removed this way.

Deactivating or deleting a user removes their membership in this workspace, revokes the API keys they created in it and signs out connected apps for it. Their Farside account and any other workspaces they belong to are untouched.

If a user's email domain is not verified by the workspace, Farside sends them an email invitation instead of creating an instant account. They join once they accept it.

Every SCIM change is written to the audit log.

Troubleshooting

Symptom	Likely cause	What to do
401 Unauthorized	The token was revoked, rotated, or pasted incorrectly.	Create or rotate a token in Settings, Security, Provisioning, then paste the new value. If your provider wants the whole header value, send it as Bearer followed by the token.
400 with scimType invalidValue on a new user	The userName is not an email address.	Map userName to the person's email in your provider. Farside uses it as their sign-in address.
400 with scimType mutability on deactivate or a role change	The person is a workspace owner. Owners are managed in Farside, never by SCIM, and the last owner can never be removed.	Change or remove the owner in Farside under Settings, Members. Unassign them in your provider afterwards if you like.
403 seat limit reached	The workspace has no free seats for another active member.	Add seats on the billing page or deactivate someone, then retry the push.
403 on every request with a valid token	The workspace IP allowlist blocks your provider's servers. SCIM calls follow the same allowlist as people.	Add your provider's published egress IP ranges to the allowlist under Settings, Security.
409 Conflict	A user with that userName or email already exists in the workspace.	Match the existing person instead of creating a duplicate. Check the userName and email values your provider sends, then retry.
429 Too Many Requests	The token went over 600 requests per minute.	Wait a minute and let the provider retry. For a very large first sync, assign people in batches.
A user got an email invitation	Their email domain is not verified by the workspace.	Verify the domain in Farside if you want instant accounts, or have the person accept the invitation.

Last updated November 11, 2026. More on how we protect access is on the security page.