Help Center

Search
Log in
Sign up

Help Center

Log in
Sign up
Table of Contents

SCIM User Lifecycle

SCIM controls workspace enrollment while preserving the global Diggle account.

Provision

  1. The provider assigns the user and sends POST /Users with an approved email-shaped userName.
  2. Diggle creates or correlates the account and establishes the managed workspace relationship. An approved workspace email domain or existing membership is required.
  3. The workspace role is applied. Effective qualifying membership grants Enterprise access; a pending invitation does not.

Deactivate

Send PATCH or PUT with active=false. Diggle removes managed workspace membership, invitations and related project grants. The global Diggle account, login and SSO identities, personal content, unrelated workspaces and the inactive SCIM resource remain.

If another qualifying Enterprise workspace remains, the user retains Enterprise access. When an ordinary user loses their final qualifying Enterprise workspace, their account becomes Free. A previously cancelled personal paid plan is not restored.

Reactivate

Send active=true for the same SCIM resource. Permitted workspace membership can be restored without an extra flag, but:

  • An explicit local Diggle revoke/block wins and cannot be cleared by SCIM.
  • Pending invitation state is not implicitly accepted.
  • Workspace/company suspension or account access restrictions still apply.
  • Historical private project grants and invitations are not recreated.
  • An old personal paid plan is not restored.

Local revoke and unblock

  1. A Diggle workspace admin can remove access directly or call revokeWorkspaceUserAccess using a Workspace API key and the canonical Diggle user ID (not the SCIM resource ID). For a SCIM-managed relationship, a local administrative veto is retained.
  2. A later source activation or grant-changing update receives 403 while the veto remains.
  3. An authorized admin deliberately clears only the block using the separate upsertWorkspaceUser clearLocalBlock action.
  4. The designated SCIM source may then send active=true; normal access checks still apply.

Profile-only partial updates can change the source profile without restoring missing access. Omitting active never implicitly recreates a missing membership. Another provisioning source cannot take over an already managed relationship.

Credential disablement is separate

Revoking a token or disabling SCIM stops future provisioning but does not offboard existing users. SSO login also cannot restore removed membership.

Related articles