Setting up SCIM with Okta

To enable SCIM, you must first set up SAML SSO with Okta. Read this article to find out how.

For an overview of how Whimsical supports SCIM, check out this article.

First, go to Workspace settings, which you'll find under your workspace name in the top left corner:

Enable SCIM provisioning and click Reveal to retrieve an OAuth token:

Paste the OAuth token into Okta, click "Test API Credentials", then Save:

User provisioningCopied!Link to this section

There are two cases to consider when provisioning a user.

Provisioning a new userCopied!Link to this section

When creating a new user, if editor is undefined or you do not provide a value, the user will have the default role set in your Whimsical workspace settings.

To set the role explicitly when provisioning:

  • true - provisions the user as an editor
  • false - provisions the user as a viewer

Updating an existing userCopied!Link to this section

When updating an existing user, if editor is undefined or you do not provide a value, there will be no change to the user's role in Whimsical.

To set the role explicitly when updating:

  • true - provisions the user as an editor
  • false - provisions the user as a viewer

Tip: If you're managing user roles with groups, we strongly recommend always having a true and a false group. Setting undefined may lead to undesired outcomes.

If you provision with SCIM but prefer managing user roles within your Whimsical workspace, do not specify a value for editor — then any roles defined in Whimsical will be maintained.


Note:Copied!Link to this section

  • To use SCIM, SAML has to be enabled and correctly configured.
  • After user creation, given name and family name fields can only be updated by the users themselves in Whimsical.
  • Provisioned users will receive an activation email and will have to log in through SAML to appear in your workspace in Whimsical.
  • If you disable SAML in your Whimsical settings, SCIM will also be disabled. After reenabling SAML and SCIM, you will have to import all users into Okta.
  • Once SCIM is enabled, please make any user role changes directly from Okta since Okta will overwrite the choices made within the Whimsical app.
  • Email addresses must be sent to Whimsical in lower case, to do this you can change the Whimsical user name format in Okta to "String.toLowerCase(user.email)" or "String.toLowerCase(user.login)":
  • The SCIM endpoint URL is https://api.whimsical.com/scim-v2/ . The Okta app is preconfigured, so you shouldn’t need to use it, but it is available for manual testing. Whimsical follows the standard SCIM-v2 endpoints, e.g. https://api.whimsical.com/scim-v2/Users
  • To learn more about SCIM provisioning with Groups in Okta please check out this article.

Written by:

  • Dārta

    Dārta