Revspire Resources

Okta SCIM Provisioning

The Okta SCIM integration provisions and deactivates Revspire users and groups from your Okta organization.

Before You Start

  • Okta administrator access.
  • A tested Revspire SAML application in Okta.
  • An active Revspire Deal Room entitlement for the Revspire organization.
  • Revspire access to Setup > SSO with View SSO Settings, Edit SSO Providers, and Generate API Tokens permissions.
  • A default internal profile unless Okta sends an explicit profile mapping, plus an eligible default product when users should be created active.

Step 1: Copy Revspire SCIM Values

In Revspire > Setup > SSO, select the Okta provider and click SCIM Config.

SCIM Base URL = <copy from Revspire>
SCIM Token = <generate and copy once>

Step 2: Enable SCIM on the Tested SAML Application

Revspire uses Okta’s Classic-experience SAML application flow because Okta currently supports adding SCIM provisioning to that integration type.

Path: Okta Admin Console > Applications > Applications > Revspire > General > App Settings > Edit

  1. Set Provisioning to SCIM and save.
  2. If the SCIM option is not available, confirm that the SAML integration was created using Okta’s Classic experience and ask Okta Support whether provisioning can be enabled for your organization.
  3. Use an Okta private SCIM test template only as a non-production fallback unless Okta has approved that integration for your production organization.

Step 3: Configure API Integration

Path: Provisioning > Settings > Integration > Edit

Okta Field Label: SCIM connector base URL
Value: <Revspire SCIM Base URL>

Okta Field Label: Unique identifier field for users
Value: userName

Supported provisioning actions:
Push New Users = enabled
Push Profile Updates = enabled
Push Groups = enabled
Import New Users and Profile Updates = disabled unless deliberately required

Okta Field Label: Authentication Mode
Value: HTTP Header

Okta Field Label: Authorization
Value: <paste the Revspire SCIM Token exactly as copied>

Confirm with Test API Credentials that Okta emits Authorization: Bearer <SCIM_TOKEN>. Do not configure Basic authentication or manually duplicate the Bearer prefix.

Click Test API Credentials. Save only after the connection test succeeds.

Step 4: Enable Provisioning Actions

Path: Provisioning > To App > Edit

Create Users = enabled
Update User Attributes = enabled
Deactivate Users = enabled
Password synchronization = disabled

Step 5: Verify Attribute Mapping

Okta user.login -> userName
Okta user.email -> emails[type eq "work"].value
Okta user.firstName -> name.givenName
Okta user.lastName -> name.familyName
Installed template's immutable Okta user identifier -> externalId
Okta assignment lifecycle -> active

Exact source-attribute labels vary by Okta template. In Profile Editor, inspect a preview request and confirm that externalId is stable and that assignment/deactivation events change the SCIM active value.

Use the Revspire default profile unless you have deliberately added the Revspire profile extension to the Okta app profile.

Step 6: Assign Users and Push Groups

  1. Assign one test user whose username and work email are not already used in Revspire.
  2. Confirm the user is created, active, licensed, and has the expected profile.
  3. Use Push Groups to push a small test group after its users have been provisioned.
  4. Expand assignments only after the user and group tests succeed.

Troubleshooting

  • 401: verify the exact base URL, Bearer header, selected provider, and token status. Rotate only when the token is expired, revoked, or unavailable.
  • 409: resolve the reported uniqueness conflict or unavailable product seat. Revspire does not silently link or overwrite another resource.
  • 422: verify the default internal profile, default product, product dependencies, and organization defaults.
  • Group push failures: provision the users first and ensure the group and members are owned by this same SCIM provider.

See the SCIM Provisioning overview for supported operations and lifecycle rules.