Skip to main content
Requires a Keeper Enterprise plan and administrator access to the node. SCIM provisioning only accepts users whose email domain is reserved to your Keeper tenant; other domains are rejected with a 412. Keeper displays the provisioning token only once, when you generate it, so copy it before leaving the screen. Generating a new token replaces any existing one, so update any identity provider that already uses the node’s SCIM token.

​
Get the SCIM token and node ID

A Keeper administrator sets up SCIM provisioning on the node that holds the users you want to review. A node’s SCIM method does not control its sub-nodes, so users in sub-nodes may not be included — a sub-node can have its own SCIM method.

1

Sign in to Keeper

Sign in to your Keeper Admin Console.

  • Select Admin in the sidebar.
  • Choose the node to review from the Node selector.
  • Provisioning methods cannot be created on the top-level Root Node. Select a node beneath it, or click Add Node under the Root Node first.
The Admin page with the Node selector highlighted
2

Add a provisioning method

Open the node’s Provisioning tab, then click Add Method.

The Provisioning tab with the Add Method button highlighted
3

Select SCIM

Select SCIM (System for Cross-Domain Identity Management), then click Next.

The provisioning method picker with SCIM selected and the Next button highlighted
4

Copy the node ID

The URL shown on this screen ends with your node ID. Copy the number after /v2/ and paste it into the Node ID field in StackOne Hub.

  • Format: https://keepersecurity.com/api/rest/scim/v2/{nodeId}
  • Example: in https://keepersecurity.com/api/rest/scim/v2/1234567890, the node ID is 1234567890.
The SCIM configuration screen with the URL field and Generate button highlighted
5

Generate and copy the token

Click Generate, then copy the provisioning token into the SCIM Token field in StackOne Hub. Click Next to continue the SCIM setup.

  • The token is displayed only once and cannot be retrieved later, so copy it before leaving the screen.
  • The token can create, update, lock, and delete users and teams in Keeper, so keep it secure.
The generated provisioning token with the copy control and Next button highlighted
6

Select the data center

For the Data Center field in StackOne Hub, select the Keeper region that matches the domain in your SCIM URL.

  • Example: a SCIM URL on keepersecurity.eu maps to the EU data center.
1

Connect

  • Click Connect.
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup.
2

Use Actions

Connect an AI platform to the linked account’s actions. See AI Platforms.Other ways to call actions are listed in Protocols & SDKs.