Governance App SCIM provisioning

Governance App users are the people who complete access review assignments, act on approval requests, and review governance queues in the Governance App portal. They are a separate population from the administrators, operators, and analysts who operate your Main Workspace, with their own accounts. Oleria exposes a dedicated Governance App SCIM 2.0 endpoint so your IdP can create, update, and remove Governance App users as your directory changes. The Governance App SCIM endpoint is independent of the Main Workspace SCIM endpoint, and has its own credentials and base URL.

How Governance App differs from Main Workspace SCIM

Oleria has two independent SCIM endpoints. Use the one that matches who you are provisioning:

	Main Workspace SCIM	Governance App SCIM
Provisions	Main Workspace users	Governance App users
Base URL	`.../scim/v2`	`.../governance/scim/v2`
Credentials	Main Workspace tab in Settings → SCIM Configuration	Governance App tab in Settings → SCIM Configuration
Roles	Multiple RBAC roles, assigned through group membership	A single `reviewer` role, applied automatically
Reference	SCIM user provisioning	This page

The authentication flow, request and response formats, and endpoint paths are otherwise identical to the Main Workspace endpoint. This page documents only what is specific to Governance App provisioning. See SCIM user provisioning for the full request and response reference.

Prerequisites

Administrator access to your Oleria Main Workspace.
The Governance App SCIM client credentials, found on the Governance App tab in Settings → SCIM Configuration.
A SCIM 2.0 client, such as your IdP’s outbound provisioning feature, that supports the OAuth 2.0 Client Credentials grant. Oleria issues only short-lived tokens through that exchange, so a client that can send only a static, long-lived bearer token isn’t supported.
If you’re using your IdP’s outbound provisioning: a plan that includes it. Outbound provisioning is usually licensed separately from SSO - Okta requires Lifecycle Management entitlements, without which the SCIM option never appears, and Microsoft Entra requires Entra ID P1 or P2. Governance App provisioning needs users only and no groups, which is the one case Microsoft lists as covered by Entra ID Free - treat it as unsupported there anyway, since provisioning logs are themselves a P1 feature and a Free tenant can’t see why a sync failed. See Okta Lifecycle Management is required for SCIM and Entra ID P1 or P2 is required for SCIM.

Authenticate to the Governance App SCIM API

Authenticate exactly as described in Authenticate to the SCIM API, with two differences:

Use the Client ID, Client Secret, and OAuth Token URL from the Governance App tab in Settings → SCIM Configuration, not the Main Workspace tab.
Send SCIM requests to the Governance App SCIM Base URL, which ends in /governance/scim/v2 (for example, https://api.YOUR_TENANT.oleria.io/governance/scim/v2).

The Main Workspace and Governance App tabs issue separate credentials. A token minted with Main Workspace credentials is not valid against the Governance App endpoint, and vice versa.

See Set up common identity providers for Okta- and Entra-specific steps to connect outbound provisioning - use your governance SCIM Base URL and credentials in place of the Main Workspace ones, and you can skip any group push or role mapping, since every provisioned user gets the single reviewer role automatically. Pushing groups anyway is harmless if your identity provider is already configured to do it - see Manage Governance App groups.

The reviewer role

Every user you provision through the governance endpoint is assigned the single reviewer role automatically. There is no role selection: unlike the Main Workspace endpoint, you do not assign roles through groups, and you do not need to send a roles attribute. Any roles value you include in a create, replace, or patch request is ignored.

Governance user attributes

Governance App users follow the same SCIM core schema as Main Workspace users, documented in Users, with minor differences regarding RBAC.

Attribute	Notes
`userName`	The user’s primary identifier. Must be their email address.
`name`	Provide either `formatted` or the name components (for example, `givenName` and `familyName`).
`emails`	Email addresses in SCIM format. At least one is required. Oleria associates only one email with the user: the `primary` email if one is marked, otherwise the first email in the list.
`active`	Whether the user is active. Defaults to `true`. Set to `false` to deactivate the user without deleting them.
`externalId`	Optional. An immutable identifier set by your provisioning client. You can set it on create; it cannot be changed afterward.
`groups`	Optional. Governance App users all receive the same role (`reviewer`), so assigning roles through group membership is unnecessary. See Manage Governance App groups.
`roles`	Read-only, and always the single `reviewer` role. See The reviewer role.

Provision a Governance App user

Send a POST to /governance/scim/v2/Users with the user’s userName, name, and emails:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "sam@example.com",
  "name": {
    "formatted": "Sam Rivera"
  },
  "emails": [
    {
      "primary": true,
      "value": "sam@example.com"
    }
  ]
}

Returns 201 Created. The reviewer role is applied automatically:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "id": "ol_7c9e6f2a-1b3d-4e5f-8a90-2c4d6e8f0a1b",
  "userName": "sam@example.com",
  "name": {
    "formatted": "Sam Rivera"
  },
  "emails": [
    {
      "primary": true,
      "value": "sam@example.com"
    }
  ],
  "active": true,
  "roles": [
    {
      "value": "reviewer"
    }
  ],
  "meta": {
    "resourceType": "User",
    "location": "Users/ol_7c9e6f2a-1b3d-4e5f-8a90-2c4d6e8f0a1b"
  }
}

Manage Governance App users

The remaining endpoints behave the same as the Main Workspace endpoints, under the /governance/scim/v2 base path. See the linked sections for request and response details:

Action	Request	Reference
Create a user	`POST /governance/scim/v2/Users`	Provision a Governance App user
List users	`GET /governance/scim/v2/Users`	List users
Get a user	`GET /governance/scim/v2/Users/{id}`	Get a user
Replace a user	`PUT /governance/scim/v2/Users/{id}`	Replace a user
Update a user	`PATCH /governance/scim/v2/Users/{id}`	Update a user
Deactivate a user	`PATCH /governance/scim/v2/Users/{id}` with `active` set to `false`	Update a user
Delete a user	`DELETE /governance/scim/v2/Users/{id}`	Delete a user

Manage Governance App groups

The governance endpoint exposes the same /Groups resource as the Main Workspace endpoint, under the /governance/scim/v2 base path. Groups do not give any role membership in the Governance App. Every Governance App user holds the single reviewer role irrespective of their group membership. Groups are still accepted, but have no effect. This gives more flexibility to your identity provider; no extra configuration is needed if your identity provider is configured to push groups alongside users.

Action	Request	Reference
Create a group	`POST /governance/scim/v2/Groups`	Create a group
List groups	`GET /governance/scim/v2/Groups`	List groups
Get a group	`GET /governance/scim/v2/Groups/{id}`	Get a group
Replace a group	`PUT /governance/scim/v2/Groups/{id}`	Replace a group
Update a group	`PATCH /governance/scim/v2/Groups/{id}`	Update a group
Delete a group	`DELETE /governance/scim/v2/Groups/{id}`	Delete a group

Deleting a group only removes the group itself. Its members keep their Governance App accounts and their reviewer role, because that role doesn’t come from group membership.

Service provider configuration endpoints

Oleria supports the standard SCIM discovery endpoints under the governance base path, so clients can inspect the service provider’s capabilities. Identity providers commonly call these on their own while you set up a provisioning connector. See the SCIM protocol, service provider configuration (RFC 7644 §4) for details.

Endpoint	Purpose
`GET /governance/scim/v2/ResourceTypes`	Discover the resource types the governance endpoint supports: Users and Groups.
`GET /governance/scim/v2/Schemas`	Retrieve the resource schemas the governance endpoint supports.
`GET /governance/scim/v2/ServiceProviderConfig`	Describe the SCIM features available on the governance service provider.

SCIM specification reference

Contact us

For questions about SCIM provisioning, contact us at support@oleria.com.

Getting Started

Posture

Governance

Administration

Support

How Governance App differs from Main Workspace SCIM

Prerequisites

Authenticate to the Governance App SCIM API

The reviewer role

Governance user attributes

Provision a Governance App user

Manage Governance App users

Manage Governance App groups

Service provider configuration endpoints

SCIM specification reference

Contact us

​How Governance App differs from Main Workspace SCIM

​Prerequisites

​Authenticate to the Governance App SCIM API

​The reviewer role

​Governance user attributes

​Provision a Governance App user

​Manage Governance App users

​Manage Governance App groups

​Service provider configuration endpoints

​SCIM specification reference

​Contact us

How Governance App differs from Main Workspace SCIM

Prerequisites

Authenticate to the Governance App SCIM API

The reviewer role

Governance user attributes

Provision a Governance App user

Manage Governance App users

Manage Governance App groups

Service provider configuration endpoints

SCIM specification reference

Contact us