SCIM role mapping

SCIM provisions and deprovisions people from your identity provider into Site Qwality. Roles travel with them. The mapping is exact-string, case-sensitive, and fail-soft: an unknown name becomes Member rather than rejecting the user.

This page is the contract. If a string is not in the table below, it is not a Site Qwality role.

Set up the connection

In Site Qwality open Settings → SCIM provisioning (a Super Admin). Create a connection. Copy the SCIM base URL and the bearer token. The token is shown once.
In your identity provider (Okta, Entra ID, OneLogin, JumpCloud, and so on) create a SCIM 2.0 application. Paste the base URL and token.
Map groups or roles in the IdP to the Site Qwality role IDs in the table below. Stytch is the SCIM endpoint we expose, so the value the IdP sends must be the Stytch role_id, not a display label.
Push one test user, then check Settings → Users. They should appear with the mapped role. If the role looks wrong, the IdP is sending a string that is not in the table.

SCIM is included with Enterprise, and only a Super Admin can set it up. Creating a connection or rotating its token returns 403 without Enterprise. Reading and deleting the connection stay open, so an account whose Enterprise ended can still remove it.

Role IDs the IdP must send

Send one of these strings as the member’s role. They are the same IDs you pick in the invite dialog.

IdP / Stytch `role_id`	Dashboard role	What they can do
`super_admin`	Super Admin	Everything, including billing, roles, SSO, and SCIM.
`admin`	Admin	Team, API keys, and the audit log. Not billing, roles, SSO, or SCIM.
`billing_admin`	Billing Admin	Billing only. Not team or role management.
`member`	Member	Full product access. No team, credentials, or billing. New users start here.
`viewer`	Viewer	Read-only. Can still acknowledge and resolve incidents if they are on call.
`auditor`	Auditor	Read-only, plus the audit log.

owner is a retired alias for Super Admin. Existing grants still work. Do not assign owner to new people.

If a member has more than one of these roles, Site Qwality keeps the first one in that list that appears on the member. Extra roles are ignored.

Unknown names become Member

These do not map and fall through to Member:

Stytch’s implicit stytch_member (every member has it; it is not a Site Qwality role)
Custom Stytch roles you created in the Stytch dashboard
Display names (Super Admin, Admin, Viewer)
Okta/Entra group names (Engineering, On-Call)
Empty role lists

The user is still created. They land as Member. A Super Admin can raise the role later in Settings → Users, or you can fix the IdP mapping and push the user again.

Who cannot be removed

Two people are protected. The IdP cannot take the account down by deleting them.

Who	Dashboard	SCIM deprovision
The account’s original user (the primary user)	Cannot be deleted or demoted	The delete is ignored. They stay a Super Admin.
The last Super Admin	Cannot be deleted or demoted	Do not remove their Super Admin group in the IdP until someone else holds `super_admin`.

Everyone else is removed when the directory deletes them, even if they are on call. They are taken out of every rotation and escalation level in the same step, the people after them in a rotation move up a place, the removal is recorded in the audit log, and if they were in any, every Super Admin gets an email listing them. Check that each of those still pages someone.

Always keep at least two Super Admins if you manage roles from the directory. Map a break-glass group to super_admin so a directory outage does not lock you out of billing and SCIM.

Invites still work

SCIM does not replace invites. You can still invite one person or paste up to 25 emails at once from Settings → Users. A pending invite counts toward the seat limit immediately (Enterprise has none, so this matters only after it ends; see Plan limits). An expired invite (14 days) stops counting and can be resent or replaced.

If SCIM later pushes the same email, Site Qwality attaches the directory member to the existing user rather than creating a duplicate.