Home SSO Enable SCIM 2.0 on OKTA SSO

Enable SCIM 2.0 on OKTA SSO

Last updated on Jul 07, 2026

How to Configure SCIM Provisioning with Okta for Activaire Curator

This guide walks Okta administrators through enabling automatic user provisioning (lifecycle management) from Okta to Activaire Curator using SCIM 2.0.

Prerequisites

  • The Activaire Curator app added to your Okta org with SSO configured. See the SSO configuration guide first.

  • A SCIM API token for your organization. An organization admin can generate it in Activaire Curator under Profile > Account > Single Sign-On with Okta > Generate SCIM provisioning token (the token is shown once — copy it right away). Alternatively, request one from Activaire support, mentioning your Okta org URL.

Supported features

  • Create users — users assigned to the app in Okta are created in Curator automatically.

  • Update user attributes — profile updates (name, email) in Okta sync to Curator.

  • Deactivate users — unassigning a user (or deactivating them in Okta) deactivates their Curator account, ends any active Curator session immediately, and revokes access.

  • Import users — existing Curator users can be imported into Okta for matching.

Group push is not supported. Password sync is not applicable (SSO users have no Curator password).

For more information on the listed features, visit the Okta Glossary.

Configuration steps

  1. In your Okta Admin Console, open the Activaire Curator app.

  2. Go to the Provisioning tab and click Configure API Integration.

  3. Check Enable API integration.

  4. In the API Token field, paste the SCIM API token you generated in Curator (Profile > Account > Single Sign-On with Okta > Generate SCIM provisioning token). If your team requested a token from Activaire support instead, use that value.

  5. Click Test API Credentials. You should see a success message.

  6. Click Save.

  7. Under Provisioning > To App, click Edit and enable:

    • Create Users

    • Update User Attributes

    • Deactivate Users

  8. Click Save.

Attribute mapping notes

  • userName must be the user's work email address (this is the default Okta mapping). Curator identifies users by email.

  • displayName (or given/family name) maps to the user's display name in Curator.

  • No other attributes are required.

How lifecycle events behave
Event in Okta Result in Curator
User assigned to the app Account created, or an existing account with the same email is linked, with standard access
Profile updated, such as name or email Account updated
User unassigned or deactivated Account deactivated; any active Curator session ends immediately; the user can no longer sign in
User re-assigned or reactivated Account reactivated with standard access

Troubleshooting

  • Test API Credentials fails: verify you pasted the token exactly (no leading/trailing spaces). If it still fails, generate a fresh token in Curator (Profile > Account > Single Sign-On with Okta) and paste the new value — generating a new token immediately replaces any previous one. If the problem persists, contact our support team.

  • A user was created without company access: contact Acitvaire Support, so your account team can adjust the user's role.

  • For any other issue, contact us with your Okta org URL and the affected user's email.