> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# sazabi_sso_scim

> Terraform resource that turns SCIM on for the SSO connection and holds its token.

Turns SCIM on for the organization's SSO connection so your identity provider can add members, update them and remove the ones who leave. Creating it mints the SCIM token your identity provider sends as a bearer token. Destroying it turns SCIM off and revokes every SCIM token; members and their SCIM records are kept, but people who leave your identity provider are no longer removed automatically. If the SSO connection was replaced after Terraform turned SCIM on, destroying leaves the replacement connection's SCIM on.

The token is sensitive and write-once. Sazabi answers it only when it is minted, so Terraform never reads it back. Change `rotation_trigger` to rotate it: the new token replaces it in state, and the previous one keeps working for 24 hours so you can update your identity provider. If the token Terraform holds is revoked or expires outside Terraform, `token` becomes null and the next apply mints a new one.

Creating it fails when SCIM is already on, because Terraform did not mint that token and cannot read it. Import it instead, turn SCIM off first, or leave it out of Terraform. It needs an owner's key, or a secret key that can manage SSO.

## Example

```hcl theme={"system"}
resource "sazabi_sso_scim" "example" {
  rotation_trigger = "2026-q4"
  depends_on       = [sazabi_sso_connection.example]
}

output "scim_token" {
  value     = sazabi_sso_scim.example.token
  sensitive = true
}
```

## Arguments

| Attribute | Type | Behavior | Description |
| - | - | - | - |
| `organization_id` | string | Optional, Computed | Owning organization. Defaults to the provider's organization, then to the API key's. Immutable. |
| `rotation_trigger` | string | Optional | Any value. Changing it mints a new token; the previous one works for 24 more hours. The first apply after import never rotates: any `rotation_trigger` in the configuration at that apply is recorded as the baseline, and `terraform plan` warns. After that first apply, changing `rotation_trigger` rotates as usual. |
| `token_expires_at` | string | Optional | When each token this resource mints stops working (RFC 3339, in the future). Unset means it never expires. Applies from the next minted token. |
| `id` | string | Computed | ID of the SSO connection SCIM is on for. |
| `token` | string | Computed, Sensitive | The SCIM bearer token. Write-once; null after import, and once it is no longer live. |
| `token_id` | string | Computed | ID of the token Terraform holds. |
| `token_prefix` | string | Computed | The token's first characters, as the dashboard and CLI show it. |
| `enabled_at` | string | Computed | When SCIM was turned on. |
| `last_change_at` | string | Computed | When Sazabi last received a change from your identity provider. |

## Import

```bash theme={"system"}
terraform import sazabi_sso_scim.example <organization_id>
terraform import sazabi_sso_scim.example -
```

`-` imports the API key's own organization. Import fails when SCIM is off. Import holds the live token by its `token_id` and `token_prefix` but cannot read its value, so `token` stays null and Terraform warns you. Import never rotates the token: the plan after import is empty, and your identity provider keeps using the token it has. The first apply after import never rotates: any `rotation_trigger` in the configuration at that apply is recorded as the baseline, and `terraform plan` warns. After that first apply, changing `rotation_trigger` rotates as usual. If SCIM is on with no live token, the first apply mints one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.