# Source: https://langfuse.com/docs/administration/scim-and-org-api.md

---
title: Organization-Key Scoped API Routes
sidebarTitle: SCIM and Org API
description: Langfuse is open and meant to be extended via custom workflows and integrations. You can use these endpoints to automate project and user management on your Langfuse organization.
---

# SCIM & Organization-Key Scoped API Routes

<AvailabilityBanner
  availability={{
    hobby: "not-available",
    core: "not-available",
    pro: "not-available",
    enterprise: "full",
    selfHosted: "ee",
  }}
/>

Via organization-scoped API keys, you can administer projects, users, and project/organization memberships (see [RBAC docs](/docs/administration/rbac)).

Langfuse is open and meant to be extended via custom workflows and integrations.
You can use these endpoints to automate project and user management on your Langfuse organization.

This documentation covers organization management APIs, SCIM-compliant user provisioning endpoints, and includes a comprehensive guide for setting up Okta authentication and user provisioning with Langfuse.

<Callout type="info">

If you self-host Langfuse, you can use the [Instance Management API](/self-hosting/administration/instance-management-api) to administer organizations across an instance.

</Callout>

## Authentication

Authenticate with the API using [Basic Auth](https://en.wikipedia.org/wiki/Basic_access_authentication).
Organization scoped API keys can be created via the [Instance Management API](/self-hosting/administration/instance-management-api) or in the Organization Settings within the Langfuse UI.

Example:

```bash
curl -u public-key:secret-key https://cloud.langfuse.com/api/public/projects/{projectId}/apiKeys
```

## Organization Management

All applicable endpoints are marked with `(requires organization-scoped API key)`.
Those include the following routes:

- `POST /api/public/projects`
- `PUT /api/public/projects/{projectId}`
- `DELETE /api/public/projects/{projectId}`
- `GET /api/public/projects/{projectId}/apiKeys`
- `POST /api/public/projects/{projectId}/apiKeys`
- `DELETE /api/public/projects/{projectId}/apiKeys/{apiKeyId}`
- `PUT /api/public/organizations/memberships`
- `GET /api/public/organizations/memberships`
- `PUT /api/public/projects/{projectId}/memberships`
- `DELETE /api/public/projects/{projectId}/memberships`

See [API Reference](https://api.reference.langfuse.com) for more details.

## User Management via SCIM

In addition, we implement the following [SCIM](https://datatracker.ietf.org/doc/html/rfc7642) compliant endpoints.
Use `/api/public/scim` as the base URI for them.

To create a new user within Langfuse, you can use the SCIM-style endpoints and `POST /Users`.
This will create a new user if the email does not exist yet.
Then it will add the user to the organization with role `NONE`.

Afterward, the role can be updated using the membership endpoints either on an organization or a project level (see above).

To remove a user from an organization, call the `DELETE /Users/{id}` endpoint.
This will not delete the user itself, only its membership with the organization.

You can either supply an initial password for users via the API and share it with them, or use Single Sign-On (SSO) to authenticate users.
In the latter case, you need to:

- Langfuse Cloud: configure an Enterprise SSO provider ([docs](/security/auth)).
- Self-hosted: configure `AUTH_<PROVIDER>_ALLOW_ACCOUNT_LINKING` for your SSO provider to ensure that the user accounts are linked correctly [SSO Docs](/self-hosting/security/authentication-and-sso#additional-configuration).

The following SCIM endpoints are available:

- `GET /ServiceProviderConfig`
- `GET /ResourceTypes`
- `GET /Schemas`
- `GET /Users`
- `POST /Users`
- `GET /Users/{id}`
- `DELETE /Users/{id}`

### SCIM Vendor Guides

#### Okta

This guide will cover how to setup Okta user provisioning for Langfuse. First, you will need to setup [authentication via OIDC](/docs/administration/authentication-and-sso).

<Video
  src="https://static.langfuse.com/docs-videos/2025-08-06-okta-scim-setup.mov.mp4"
  aspectRatio={647 / 463}
  gifStyle
/>

For user provisioning, Langfuse supports the SCIM 2.0 protocol.
To setup user provisioning in Okta, follow these steps:

1. **Create a SAML/SCIM Application**:
   - Log in to your Okta admin console.
   - Navigate to **Applications** > **Create App Integration**.
   - Choose **SAML 2.0** as the sign-in method and click **Next**.
   - Fill in the application settings. Use your self-hosted domain or one of the Langfuse Cloud domains.
     - **App name**: `Langfuse SCIM`
     - **Single sign-on URL**: `https://your-langfuse-domain.com` (langfuse uses OIDC for authentication, see above, this will not be used)
     - **Audience URI**: `langfuse`
   - Click **Next** and then **Finish**.
2. **Configure SCIM Settings**:
   - In the **General** tab, set `Provisioning` to SCIM.
   - In the **Provisioning** tab, edit your **SCIM Connection**.
   - Enter your credentials:
     - **SCIM connector base URL**: `https://your-langfuse-domain.com/api/public/scim`
     - **Unique identifier field for users**: `userName`
     - **Supported provisioning actions**: `Import new Users and Profile Updates`, `Push New Users`, `Push Profile Updates`
     - **Basic Auth - Username**: Use a public key from your Organization settings.
     - **Basic Auth - Password**: Use a private key from your Organization settings.
   - Test the API credentials and press **Save**.
3. **Configure Provisioning**:
   - In the **Provisioning** tab, enable the following options:
     - **Create Users**
     - **Update User Attributes**
     - **Deactivate Users**
   - Click **Save**.
4. **Add Default User Permissions** (Optional):
   - In the **Provisioning** tab, go to the Profile Editor and add a new `roles` attribute:
     - **Data type**: `string array`
     - **Display Name**: Langfuse Roles
     - **Variable Name**: `roles`
     - **External Name**: `roles`
     - **External Namespace**: `urn:ietf:params:scim:schemas:core:2.0:User`
     - **Attribute members**: `NONE`, `VIEWER`, `MEMBER`, `ADMIN`
     - **Attribute type**: `Personal`
   - In the **Provisioning** tab, modify the `roles` attribute to set default permissions for new users.
   - You can set it for all users of the application to provide a default. Set it to "NONE", "VIEWER", "MEMBER", or "ADMIN".
5. **Assign Users**:
   - Navigate to the **Assignments** tab.
   - Click **Assign** > **Assign to People**.
   - Select the users you want to assign to the Langfuse SCIM application. You can overwrite the role here.
   - Click **Done** and then **Save**.
   - Users should appear as Member within your Langfuse Organization.

##### Troubleshooting

- **Users are provisioned with NONE/VIEWER permissions instead of their intended `role`**: This usually happens if the `roles` attribute has an attribute type `Group` instead of `Personal`.