Governance App SCIM provisioning

The Oleria Governance App is a dedicated portal for running identity governance workflows - access reviews, approval requests, and policy-driven entitlement decisions. Reviewers, approvers, and other users access it independently from the main Oleria workspace, using accounts scoped to the governance portal. Provision and deprovision governance app users automatically from your identity provider (IdP), instead of adding them by hand. Oleria exposes a dedicated governance SCIM 2.0 endpoint, separate from the workspace SCIM endpoint, so your IdP can create and remove users as your directory changes. Governance app users are the people who participate in governance workflows - completing access review assignments, acting on approval requests, and taking action in the governance portal. They are a separate population from the administrators, operators, and analysts who operate your Oleria workspace.

How governance SCIM differs from workspace SCIM

Oleria has two independent SCIM endpoints. Use the one that matches who you are provisioning:

	Workspace SCIM	Governance SCIM
Provisions	Workspace users (admins, operators, analysts)	Governance app users
Base URL	`.../scim/v2`	`.../governance/scim/v2`
Credentials	Main Workspace tab in Settings → SCIM Configuration	Governance App tab in Settings → SCIM Configuration
Roles	Multiple RBAC roles, assigned through group membership	A single `reviewer` role, applied automatically
Reference	SCIM user provisioning	This page

The authentication flow, request and response formats, and endpoint paths are otherwise identical to the workspace endpoint. This page documents only what is specific to governance app provisioning. See SCIM user provisioning for the full request and response reference.

Prerequisites

Administrator access to your Oleria workspace.
The governance app enabled for your workspace. The Governance App SCIM credentials are available only when governance is deployed for your tenant.
The governance SCIM client credentials, found on the Governance App tab in Settings → SCIM Configuration.
A SCIM 2.0 client, such as your IdP’s outbound provisioning feature, that can send a bearer token on every request.

Authenticate to the governance SCIM API

Authenticate exactly as described in Authenticate to the SCIM API, with two differences:

Use the Client ID, Client Secret, and OAuth Token URL from the Governance App tab in Settings → SCIM Configuration, not the Main Workspace tab.
Send SCIM requests to the governance SCIM Base URL, which ends in /governance/scim/v2 (for example, https://devx.YOUR_TENANT.oleria.io/governance/scim/v2).

The Main Workspace and Governance App tabs issue separate credentials. A token minted with workspace credentials is not valid against the governance endpoint, and vice versa.

The reviewer role

Every user you provision through the governance endpoint is assigned the single reviewer role automatically. This role grants access to the governance portal, where users can complete access review assignments, act on approval requests, and participate in other governance workflows. There is no role selection: unlike the workspace endpoint, you do not assign roles through groups, and you do not need to send a roles attribute. Any roles value you include in a create, replace, or patch request is ignored.

Provision a governance app user

Send a POST to /governance/scim/v2/Users with the user’s userName, name, and emails:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "sam@example.com",
  "name": {
    "formatted": "Sam Rivera"
  },
  "emails": [
    {
      "primary": true,
      "value": "sam@example.com"
    }
  ]
}

Returns 201 Created. The reviewer role is applied automatically:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "ol_7c9e6f2a-1b3d-4e5f-8a90-2c4d6e8f0a1b",
  "userName": "sam@example.com",
  "name": {
    "formatted": "Sam Rivera"
  },
  "emails": [
    {
      "primary": true,
      "value": "sam@example.com"
    }
  ],
  "active": true,
  "roles": [
    {
      "value": "reviewer"
    }
  ],
  "meta": {
    "resourceType": "User",
    "location": "Users/ol_7c9e6f2a-1b3d-4e5f-8a90-2c4d6e8f0a1b"
  }
}

Manage governance app users

The remaining endpoints behave the same as the workspace endpoints, under the /governance/scim/v2 base path. See the linked sections for request and response details:

Action	Request	Reference
List users	`GET /governance/scim/v2/Users`	List users
Get a user	`GET /governance/scim/v2/Users/{id}`	Get a user
Update a user	`PATCH /governance/scim/v2/Users/{id}`	Update a user
Deactivate a user	`PATCH /governance/scim/v2/Users/{id}` with `active` set to `false`	Update a user
Delete a user	`DELETE /governance/scim/v2/Users/{id}`	Delete a user

SCIM specification reference

Contact us

For questions about SCIM provisioning, contact us at support@oleria.com.

Getting Started

Posture

Governance

Administration

Support

How governance SCIM differs from workspace SCIM

Prerequisites

Authenticate to the governance SCIM API

The reviewer role

Provision a governance app user

Manage governance app users

SCIM specification reference

Contact us

​How governance SCIM differs from workspace SCIM

​Prerequisites

​Authenticate to the governance SCIM API

​The reviewer role

​Provision a governance app user

​Manage governance app users

​SCIM specification reference

​Contact us

How governance SCIM differs from workspace SCIM

Prerequisites

Authenticate to the governance SCIM API

The reviewer role

Provision a governance app user

Manage governance app users

SCIM specification reference

Contact us