Skip to main content
This guide shows Okta administrators how to configure SCIM 2.0 provisioning for ClosedLoop AI from the Okta Integration Network catalog.

​
Prerequisites

  • An Okta admin account with permission to configure application provisioning.
  • A ClosedLoop AI workspace admin account.
  • Your ClosedLoop AI workspace ID.
  • Your ClosedLoop AI workspace region: US or EU.
  • The ClosedLoop AI Okta OIDC SSO setup should be configured before assigning users through SCIM.

​
Supported Features

FeatureSupport
Create usersSupported
Read usersSupported
Update user attributesSupported for the mapped attributes listed below
Deactivate usersSupported
PATCH usersSupported for active and roles
Import new usersSupported
Import profile updatesSupported for the mapped attributes listed below
Create groupsSupported
Read groupsSupported
Update groupsSupported with PATCH
Delete groupsSupported
Group PushSupported
Role entitlementsSupported for Admin and Member
Change password / sync passwordNot supported
Import User SchemaNot supported; use the mappings in this guide
ClosedLoop AI treats Okta as the source of truth for provisioned users, group membership, access status, and assigned role entitlements.

​
Configure Okta

  1. In Okta Admin, go to Applications > Applications.
  2. Click Browse App Catalog.
  3. Search for ClosedLoop AI.
  4. Add the ClosedLoop AI integration.
Enter the tenant settings for the ClosedLoop AI workspace you are connecting.
LabelValue
Workspace IDYour ClosedLoop AI workspace UUID
Regionus or eu
Use us for https://app.closedloop.sh. Use eu for https://eu.app.closedloop.sh.
  1. Open the generated ClosedLoop AI app instance in Okta.
  2. Go to Provisioning > Integration.
  3. Click Configure API Integration.
  4. Select Enable API integration.
  5. Click Authenticate with ClosedLoop AI.
  6. Complete the authentication flow.
  7. Click Test API Credentials.
  8. Click Save.
Okta uses OAuth 2.0 to obtain a scoped bearer token for SCIM calls.
In Provisioning > To App, enable:
User operationSetting
Create UsersOn
Update User AttributesOn
Deactivate UsersOn
Sync PasswordOff
In Provisioning > To Okta, imports may remain enabled so Okta can import users and profile updates from ClosedLoop AI.
On the Sign On tab, set Application username format to Email.ClosedLoop AI uses the SCIM userName value as the user’s primary email address.
Assign users or groups to the ClosedLoop AI app in Okta.Okta creates or links the user in ClosedLoop AI when the app is assigned. Deactivating the Okta user or unassigning the app removes the user’s ClosedLoop AI workspace access and revokes active sessions.

​
Okta OIN Values

These are the SCIM values used by the ClosedLoop AI Okta catalog integration.
Okta fieldValue
Base URL'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/scim/v2/' + app.team_id
Authorize endpoint'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/okta/scim/oauth/authorize?team_id=' + app.team_id
Token endpoint'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/okta/scim/oauth/token'
Scopesscim.read, scim.write, entitlements.read
Link to configuration guidehttps://closedloop.sh/docs/integrations/okta-scim-provisioning

​
SCIM Attribute Mappings

Keep these mappings in the Okta app profile.
Okta attributeSCIM attributeClosedLoop AI usage
user.emailuserNamePrimary email address
user.firstNamename.givenNameFirst name
user.lastNamename.familyNameLast name
user.displayNamedisplayNameFull name fallback
App active stateactiveWorkspace access status
Okta user IDexternalIdStable Okta identifier
Assigned entitlementrolesClosedLoop AI workspace role
ClosedLoop AI does not use these default Okta profile attributes. Remove the mappings and attributes if they appear in the app profile:
Unsupported attribute groupAttributes
Name extrasmiddleName, honorificPrefix, honorificSuffix, nickName
Contact detailsprofileUrl, primaryPhone, primaryPhoneType, streetAddress, locality, region, postalCode, country, formatted
Locale and organizationpreferredLanguage, locale, timezone, userType, employeeNumber, costCenter, organization, division, department
ManagermanagerValue, managerDisplayName
Passwordpassword

​
Group Push

ClosedLoop AI supports Okta Group Push.
  1. In Okta, open the ClosedLoop AI app instance.
  2. Go to Push Groups.
  3. Add the Okta group you want to push.
  4. Confirm the group appears in ClosedLoop AI after Okta pushes it.
Important behavior:
  • Users must be assigned to the ClosedLoop AI app and provisioned through SCIM before they can be added as members of a pushed group.
  • ClosedLoop AI stores the Okta group displayName, externalId, and members.
  • Group names should be unique within one ClosedLoop AI workspace.
  • Removing a user from a pushed group removes that group membership in ClosedLoop AI. It does not delete the user.

​
Role Entitlements

ClosedLoop AI exposes workspace roles as Okta entitlements. Resource type mapping:
FieldValue
Resource TypeRole
Endpoint/Roles
Propertiesid, displayName, description
DescriptionClosedLoop AI workspace roles
Entitlement details:
FieldValue
Display nameRole
Variable nameroles
Entitlement typeSingle value entitlement
Entitlement values:
Display nameValue
Adminadmin
Membermember
ClosedLoop AI supports one workspace role entitlement per user. If no role entitlement is assigned, users are provisioned as Member by default.

​
Verify Provisioning

  1. Assign a test user to the ClosedLoop AI app in Okta.
  2. Confirm Okta creates the user in ClosedLoop AI.
  3. Update the test user’s first name or last name in Okta and run provisioning.
  4. Confirm the profile update appears in ClosedLoop AI.
  5. Push a test group that contains the provisioned user.
  6. Confirm the group and membership appear in ClosedLoop AI.
  7. Assign the Admin role entitlement to the test user.
  8. Confirm the user becomes an admin in ClosedLoop AI.
  9. Unassign or deactivate the test user in Okta.
  10. Confirm the user’s ClosedLoop AI workspace access is removed.

​
Troubleshooting

SymptomFix
Okta reports an invalid SCIM base URLConfirm the Base URL uses Okta Expression Language string concatenation and that the tenant setting names are region and team_id.
API credential validation failsConfirm the Workspace ID belongs to the selected region and retry Authenticate with ClosedLoop AI.
Users are created with the wrong usernameSet Application username format to Email on the Sign On tab.
Profile updates do not syncConfirm unsupported attributes were removed and the supported attributes remain mapped.
Group Push fails for membersConfirm every group member is assigned to the ClosedLoop AI app and provisioned before the group is pushed.
Role entitlements do not appearConfirm the SCIM OAuth scopes include entitlements.read, then refresh the Governance tab.
Change password failsLeave password synchronization disabled. ClosedLoop AI does not accept SCIM password updates.

​
Support

For help configuring Okta SCIM provisioning with ClosedLoop AI, contact support@closedloop.sh.