Access and security
Directory provisioning (SCIM)
Create and disable logins automatically from Entra ID, Okta or any SCIM 2.0 directory.
Ergira exposes a SCIM 2.0 service. Your identity provider can create, update and disable logins here as people join, move and leave.
Setting it up
- 1
Mint a token
Settings → Provisioning. Name it after the connector that will hold it — a token nobody can attribute is one nobody dares revoke. It is shown once and stored only as a hash, so it cannot be recovered.
- 2
Paste the endpoint and token into your provider
The tenant URL is shown on the same screen. Authentication is an ordinary bearer token.
- 3
Map attributes
User name must be an email address — it becomes the login. A mis-mapped attribute sending an employee number is refused with a message saying so, rather than creating a login nobody can use.
Provisioning creates a login, not an employee
A directory knows an address and a display name. An HR record needs a legal entity, a work country and a start date, and without those there are no leave rules, no overtime rules and nothing to put in a payroll snapshot. So people are still added under People — and where a work email matches, the login and the HR record are joined up automatically.
Disabling somebody revokes access, never employment
Setting a user inactive — or deleting them from your directory — suspends their membership here. Their worker record, engagements, leave ledger, documents and payroll history are untouched. Employment data has to be retained after somebody leaves, and a disabled account is not a resignation: people are disabled for a sabbatical, a lost device or a security review.
Provisioning never grants a role
Everybody arrives with ordinary member access and no HR role. Groups map to teams, not to roles. A group in a directory is a filing decision; an HR administrator role reads every salary in the company — and if a group could confer one, whoever administers groups could grant it to themselves.
What is supported
| Resource | Operations |
|---|---|
| Users | List with filters, create, fetch, replace, patch, delete |
| Groups | List with filters, create, fetch, replace, patch, delete |
| Discovery | Service provider configuration, resource types, schemas |
- Filters support the comparison operators,
and,or,notand grouping. An operator that is not supported is refused rather than approximated — a filter silently widened returns people your provider did not ask about. - Deleting a user returns success and disables them, which is the outcome the provider wanted: gone from its side, access gone from ours.
- Errors come back in SCIM's own format, so the reason appears in your provider's log. A seat limit reads as a plain statement that no seats are available.
- Bulk operations are not supported, and the discovery endpoint says so rather than letting a connector batch a whole cycle into one failing request.
Revoking a token
Revoke it on the same screen; it stops working immediately. Tokens are revoked rather than deleted, because the audit trail records which connector provisioned or disabled somebody, and that is exactly the question asked afterwards.