Set Up Okta SCIM Provisioning with Gateco

Why provision principals from Okta

Gateco authorizes every AI retrieval against your identity data. When Okta is the system of record, SCIM provisioning keeps the principal directory in Gateco current automatically: joiners appear, leavers deactivate, and group changes propagate without manual syncs.

Step 1: Create a SCIM-only Okta identity provider

In the Gateco dashboard, open Identity Providers and click Connect Provider. Choose Okta as the type and check "Provisioning only (SCIM)". This mode needs no Okta API token because Okta pushes changes to Gateco.

Step 2: Generate the SCIM bearer token

Open the identity provider you just created and find the SCIM Configuration panel. Click Generate Token and copy the value immediately.

The token is shown exactly once. Store it in a password manager. Generating a new token revokes the previous one immediately.

Step 3: Configure the Okta app

In the Okta Admin Console, add the Gateco integration from the OIN catalog (or a SCIM 2.0 template app).
Open the Provisioning tab and click Configure API Integration.
Set the SCIM 2.0 Base URL to https://api.gateco.ai/api/scim/v2
Choose HTTP Header authentication and paste the bearer token from Step 2.
Click Test API Credentials, then Save.
Enable Create Users, Update User Attributes, and Deactivate Users.

Step 4: Assign users and push groups

Use the Assignments tab to assign individual users or groups. Use Push Groups to mirror Okta groups into Gateco so your policies can reference them by name.

Step 5: Verify

Principals appear under Identity in the Gateco dashboard with source Okta.
Deactivating a test user in Okta flips the principal to inactive.
A policy simulation in the Access Simulator resolves the provisioned groups.

Troubleshooting

Symptom	Cause	Fix
`Test API Credentials fails with 401`	`Token missing, revoked, or pasted with whitespace`	`Generate a fresh token in Gateco and paste it again`
`Test API Credentials fails with 403`	`Organization plan below Growth`	`Upgrade the Gateco organization to Growth or Enterprise`
`Users provision but groups are empty`	`Groups assigned but not pushed`	`Use Push Groups in the Okta app, not only Assignments`
`Duplicate user error in Okta log`	`A principal with the same external ID already exists`	`Unassign and re-assign the user in Okta to relink and reactivate the existing principal`

Frequently asked questions

Which Gateco plans support Okta SCIM provisioning?

SCIM provisioning is available on Growth and Enterprise plans. Creating the SCIM-only Okta identity provider works on any plan, but generating a SCIM token requires Growth or above.

Does deactivating a user in Okta delete the principal in Gateco?

No. Deactivation sets the principal status to inactive and preserves the audit trail and policy history. Re-assigning the user in Okta reactivates the same principal.

What is the difference between SCIM provisioning and the Okta API sync?

SCIM provisioning is push based: Okta sends changes to Gateco in real time and needs no Okta API token. The Okta API sync is pull based: Gateco reads users and groups from the Okta Management API on a schedule and requires an API token.

Do provisioned users get access to the Gateco dashboard?

No. SCIM provisions principals: the workforce identities whose access Gateco evaluates during AI retrieval. Dashboard access for your admin team is managed separately under Team settings.