A production-ready SCIM 2.0 server built for multi-tenant identity synchronization — with full RFC 7643/7644 compliance, worker automation, and deep observability.
Built on the SCIM 2.0 standard with production-grade reliability, security, and operational tooling.
Full RFC 7643/7644 implementation. Users, Groups, filtering, pagination, sorting, ServiceProviderConfig, Schemas, and ResourceTypes endpoints.
Complete tenant isolation with per-tenant SCIM clients, credentials, and data segregation. Manage hundreds of tenants from a single control plane.
Bearer token auth per tenant, admin session management with lease heartbeats, credential rotation, and per-client access controls.
Background workers for consistency checks and reconciliation previews. Distributed lease management prevents duplicate execution across worker instances.
Prometheus metrics, structured audit logs, pre-built Alertmanager rules for lease loss, stale leases, and timeout recovery events.
Immutable audit log for every admin and SCIM operation. Filter by tenant, operation type, actor, and timestamp range via the control plane API.
Adjust rate limits, worker polling intervals, session TTLs, and feature flags at runtime without service restarts.
Full REST API for tenant provisioning, credential lifecycle, job management, and configuration — plus a built-in admin dashboard UI.
Ships with ROLLOUT_CHECKLIST.md, OPERATOR_RUNBOOKS.md, smoke tests, and early-life monitoring guidance for safe production deployments.
Every standard SCIM operation for Users and Groups, plus discovery endpoints for schema-driven integrations.
Full REST control plane for managing tenants, credentials, jobs, audit logs, and runtime configuration.
Distributed worker fleet with lease management ensuring exactly-once execution across all worker instances.
Automated scan across all tenant data to detect drift, orphaned records, and constraint violations. Runs without requiring a tenant ID — covers the full fleet.
✓ Read-only · Safe to run anytimeDry-run reconciliation for a specific tenant. Shows exactly what changes would be applied without persisting anything. Requires tenantId at creation time — rejected with 422 if missing.
Prometheus metrics, structured audit logs, and pre-built alert rules for the most operationally critical events.
Fires when a worker loses its lease unexpectedly. Indicates a crashed worker or network partition. Check worker pod health and database connectivity immediately.
A stale lease was detected and recovered. Occasional occurrences are normal. Sustained spikes suggest worker instability or high load.
Elevated timeout-recovery events. Monitor alongside job latency metrics. May indicate database or downstream slowness affecting job completion times.
Authentication hardening, credential lifecycle management, and audit-everything approach.
Per-tenant SCIM client credentials. Tokens are hashed at rest. Full lifecycle: create, rotate, revoke.
Admin sessions require periodic heartbeats. Expired or dropped sessions are automatically invalidated — no dangling sessions.
All SCIM resources are tenant-scoped at the data layer. Cross-tenant access is impossible by design, not just by convention.
Every create, update, delete, and authentication event is recorded with actor, timestamp, and full context. Non-repudiable.
Strict schema validation at creation time. Invalid jobs rejected with 422 before any database write.
Configuration changes are validated, versioned, and audit-logged. No silent config mutations.
The SCIM connector has passed full rollout-readiness gates and is approved for production deployment.
Full operational documentation ships with the connector — from rollout checklists to per-alert runbooks.
Pre-rollout, deployment, smoke test, and rollback checklists with early-life monitoring windows.
docs/ROLLOUT_CHECKLIST.md
Step-by-step operator procedures for every alert, including lease-loss, stale lease, and timeout recovery.
docs/OPERATOR_RUNBOOKS.md
Current capabilities, known limitations, and worker scope — kept in sync with the actual implementation.
docs/PLATFORM_STATUS.md
All Prometheus metrics, alert rules, and Grafana dashboard guidance for production visibility.
docs/monitoring.md
Complete reference for worker job types, payloads, validation rules, and result schemas.
docs/JOBS.md
Architecture documentation: lease protocol, worker lifecycle, multi-instance coordination.
docs/WORKER_FLEET_DESIGN.md
30-day free trial, no credit card required. Up to 50 users during trial.