How SCIM Works with axe Account
SCIM uses Users and Groups as core concepts. This page maps them to axe Account components so you can configure your identity provider with confidence.
Core concepts
| SCIM concept | In axe Account | What it is |
|---|---|---|
| Tenant (your API key's scope) | Enterprise | Your axe Account organization. Every SCIM request is scoped to one enterprise. It determines which subscriptions, users, and settings apply. |
| User | An axe Account user | A person's identity in axe. |
| Group (subscription) | A product subscription | For example, "Axe Monitor" or "Axe DevTools for Web". Adding a user to this group grants a product seat. |
| Group (team) | A team | A named group of users (for example, "Design System Team"). Used within products to organize access. |
active attribute |
Enterprise membership | active: true means the user is a member of your enterprise. active: false removes them. |
The two kinds of Group
When your identity provider lists groups (GET /Groups), it sees two kinds of group together. They look the same but behave differently — this is the most important distinction to understand.
Subscription groups — grant product access
A subscription group represents a Deque product your enterprise has purchased (for example, axe Monitor). Adding a user to a subscription group grants them a seat for that product. Removing them frees the seat.
- Subscription groups are subject to your purchased seat limits.
- You cannot create or delete products through SCIM — only manage who has a seat.
Team groups — organize users
A team group is a named collection of users. Team membership on its own does not grant product access. Teams are used inside certain products to organize access — for example, an axe Monitor administrator assigns a team access to specific scans or scan groups.
- Teams can be created and deleted through SCIM.
- If your identity provider pushes a group whose name matches a Deque product, it maps to that product subscription. If the name does not match a product, axe creates a new team.
A typical provisioning flow
Your identity provider generally performs these operations in sequence:
1. Create the user → user is added to the enterprise + sent an invite
2. Add to a group → user is granted a product seat (e.g. axe Monitor)
3. Add to a team (optional) → user is placed on a team for in-product access
4. Later: deprovision the user → user is removed from the enterprise (access revoked)What "active" means
The active attribute reflects enterprise membership, not whether the account exists:
active: true— the user is a member of your enterprise and has access.active: false— the user is removed from your enterprise. Their sign-in account still exists but has no access. Reactivating restores access.