Overview
SCIM lets your identity provider keep your Hourari roster up to date. When someone is assigned to Hourari in Okta or Microsoft Entra ID, they appear on your roster. When they are unassigned or disabled, they are deactivated in Hourari: they can no longer sign in, and their seat is freed.
SCIM is part of the Enterprise plan, and only the workspace owner can set it up.
The address to use
Your identity provider sends everything to one base URL. It adds /Users and /Groups itself, so enter the base exactly as shown:
https://www.hourari.com/api/scim
The same address, with a copy button, is at the top of the API keys page: open Settings → Integrations and choose API keys, under Developer.
Create a key
- Open Settings → Integrations and choose API keys, under Developer.
- Choose New key.
- Name it after the identity provider, for example "Okta SCIM", and tick Provisioning (SCIM) only.
- Copy the key straight away. It is shown once, and Hourari keeps only a fingerprint of it, so nobody can show it to you again. If you lose it, revoke it and create another.
If your identity provider calls with a revoked, expired or mistyped key, the refused requests are recorded in your activity log as API key rejected, up to five per key per hour.
Your identity provider sends the key as a bearer token: Authorization: Bearer hri_<prefix>_<secret>.
What Hourari does with each request
Adding someone. The person appears on your roster with the name, job title and email your directory sends, and takes a seat. If someone with that email is already on your roster, Hourari links them to the directory instead of adding a second entry. Provisioning does not send an email or create a login: they get access the usual way, by invite.
Deactivating someone. Unassigning, disabling or deleting a person in your directory deactivates them in Hourari. They lose access to your workspace's data straight away and cannot sign back in, their calendar and Slack connections are disconnected, and their seat is freed. Their past meetings stay on your reports. Reactivating them in your directory gives access back; they reconnect their calendar the next time they sign in.
Two-factor applies to signed-in sessions. Your identity provider signs in with its SCIM key and can't ask for a code, so treat the key like a password. SCIM can add and deactivate people; it never reads costs or pay.
What Hourari will not do over SCIM:
- Make anyone the workspace owner, or deactivate the owner. Ownership only moves by a transfer the owner makes in Hourari.
- Change a name, job title or role after the person was added. Those are edited in Hourari, so an admin's correction is not overwritten by the next sync. Your identity provider may report these updates as failed; that is expected.
- Create, rename or delete teams. See groups below.
Allowed networks
If your workspace has an IP allowlist (Settings → Access & data), it does not cover provisioning unless you choose it. Your identity provider calls Hourari from its own networks, not your office, so applying your office ranges would refuse every request, deactivations included.
To hold provisioning to the list as well:
- Look up your identity provider's published IP ranges (Okta and Microsoft both publish theirs) and add them to the allowlist.
- In the same card, turn on Apply to user provisioning.
From then on, a provisioning request from outside the list is refused with 403, even with a valid key. Only the workspace owner can change this, on the Enterprise plan, after entering their two-factor code. Turning it off works on every plan.
There is one list, so the ranges you add for your identity provider also count when someone signs in to Hourari from those addresses. They are the provider's own servers, not addresses people browse from.
Attributes
| SCIM attribute | Used for |
|---|---|
userName |
The person's email. If it is not an email address (common in Entra), the primary address in emails is used instead. |
externalId |
Required. Your directory's permanent id for the person, used to find them again when they leave. |
name.givenName, name.familyName, displayName |
Their name on the roster. |
title |
Their job title. |
roles |
admin or member. Anything else, or nothing, means member. |
active |
false deactivates them; true reactivates them. |
You can filter users on userName, externalId or id, with a single eq. Pages hold up to 200 results.
Groups and teams
A SCIM group is a team in Hourari. Create the team on the Team page first, with the same name as the group. Your identity provider can then add and remove its members. It cannot create teams, so a group with no matching team is refused rather than silently ignored.
Set up Okta
- In Okta, create an app integration with SCIM provisioning, or open your existing Hourari app and turn provisioning on.
- On the Provisioning tab, set the SCIM connector base URL to the address above and the Unique identifier field for users to
userName. - Under Supported provisioning actions, choose Push New Users, Push Profile Updates and, if you use teams, Push Groups.
- Set Authentication Mode to HTTP Header and paste the key as the bearer token.
- Choose Test Connector Configuration, then save.
- Under To App, turn on Create Users and Deactivate Users, and assign people or groups to the app.
Set up Microsoft Entra ID
- In Entra, open Enterprise applications, create a non-gallery application, and open Provisioning.
- Set Provisioning Mode to Automatic.
- Set Tenant URL to the address above and Secret Token to the key.
- Choose Test Connection, then save.
- Under Mappings, keep the user mapping and map your directory's object id to
externalId. If you do not use teams, turn off group provisioning. - Assign people or groups to the application and start provisioning.
If you leave the Enterprise plan
Taking people out keeps working on every plan: your identity provider can still look people up and deactivate them, so someone who leaves your company still loses access. Adding people and syncing teams stop until you are back on Enterprise. Revoke the key from API keys when you no longer use it. Revoked keys are folded under Show revoked at the bottom of the list.