> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SCIM with JumpCloud

> Connect a JumpCloud custom SCIM application to Living Security SCIM: token, attributes, a test user, and troubleshooting.

> [!NOTE]
>
> **Which SCIM setup applies to you?** These pages describe **Living Security SCIM**. Open the SCIM card in your settings. If the card shows **Set up SCIM**, or its **Mode** row says **Native SCIM**, these pages apply. If **Mode** says **Current SCIM**, your organization still uses the earlier SCIM setup. An admin can move it: see [Move from the earlier SCIM setup](https://docs.livingsecurity.com/features/settings/scim/connection.md#move-from-the-earlier-scim-setup). If the card says SCIM is set up and managed in the setup wizard, use [SCIM Provisioning](https://docs.livingsecurity.com/features/settings/scim.md).

JumpCloud creates, updates and deactivates people in Living Security through SCIM. This guide connects a JumpCloud custom SCIM application to Living Security and tests it with one person.

> [!NOTE]
>
> Living Security has not certified JumpCloud in a live run. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644). Its tests replay the requests JumpCloud sends: a create that carries a password (Living Security discards it), full `PUT` updates, and group membership sent as the complete list. The JumpCloud menu names below come from JumpCloud documentation and can differ in your version. Check each step with the [setup checklist](https://docs.livingsecurity.com/features/settings/scim/testing.md#the-setup-checklist) and the **Attributes** tab.

## What you need

* A Living Security admin with permission to manage SSO and SCIM settings.
* An administrator of JumpCloud, or a [setup link](https://docs.livingsecurity.com/features/settings/scim/connection.md#send-a-setup-link-to-your-it-administrator) you send to one.
* SSO is not required. If you use SSO, the SCIM `userName` must be the same value your SSO sends as the NameID: the person's email address. See [SSO and sub-organizations](https://docs.livingsecurity.com/features/settings/scim/sso-and-sub-organizations.md).

## Set up provisioning

**1. Create the SCIM token in Living Security**

On the SCIM card, select **Set up SCIM**. Copy the **SCIM base URL** and the **Bearer token**. You can't see the token again. See [Set up a SCIM connection](https://docs.livingsecurity.com/features/settings/scim/connection.md).

**2. Create the application in JumpCloud**

In the JumpCloud Admin Portal, open **SSO Applications**, add a **Custom Application**, and turn on **Manage Single Sign-On (SSO)** and **Identity Management** (SCIM). Name it `Living Security` and save it. The **Identity Management** settings appear after you save.

You can use an application you already have for Living Security SSO.

**3. Enter the connection**

On the **Identity Management** tab:

1. Choose SCIM **2.0**.
2. Paste the SCIM base URL into **Base URL**.
3. Paste the token into **Token Key**, and choose **Bearer Token** as the token type.
4. Enter a **Test User Email** that does not exist in Living Security yet.
5. Select **Test Connection**, then **Activate**.

> [!TIP]
>
> The Living Security **Checklist** shows **First request received** and **Connection test passed**.

The connection test creates the test user and then deletes it. The test person then stays in **Workforce → People** as deactivated. Turn off **Send welcome email when SCIM provisions a new user** first if that address should not get a welcome email.

To replace the token later, enter the new token and select **Update**. **Save** alone does not change the token.

**4. Check the attributes**

JumpCloud sends its standard user attributes. Check that each person has:

* An email. JumpCloud sends it as `userName` and as the work email. When the email changes, the `userName` changes too.
* First name, last name, job title and department, if you want them in Living Security.

JumpCloud sends every user update as a `PUT`, which replaces the whole user. An attribute that is not in the request is cleared in Living Security.

**5. Choose who to provision**

On the application's **User Groups** tab, bind one group that holds only your test person. JumpCloud provisions the members of the bound groups, and sends those groups to Living Security.

## Test your setup

Follow [Test your SCIM setup](https://docs.livingsecurity.com/features/settings/scim/testing.md) with one person first. In short:

1. Select **Test Connection** on the **Identity Management** tab. On the Living Security **Checklist** tab, **First request received** and **Connection test passed** show **Done**.
2. Bind a group that holds the test person to the application. **First user received**, then **First user ready to sign in**, show **Done** within a few minutes.
3. Open the **Attributes** tab. Fix each item under **What to fix**, and check that **Attributes received** has the attributes you mapped. Compare with the [SCIM attribute reference](https://docs.livingsecurity.com/features/settings/scim/attributes.md).
4. To see the exact request JumpCloud sent, look at **Newest user** on the **Attributes** tab, or search the [SCIM events](https://docs.livingsecurity.com/features/settings/scim.md#review-received-scim-requests) for the person's email.
5. Ask the test person to sign in. **First sign-in by a SCIM user** shows **Done**.
6. Send one group. **First group received** shows **Done**.
7. Remove the test person from the bound group, or suspend them in JumpCloud. The person shows as deactivated in **Workforce → People**.

When every step shows **Done** or **Not used** and the **Health** tab shows **No warnings**, widen the scope in JumpCloud.

## Troubleshoot

Each failed request has an `LS-SCIM` code in the error `detail`. JumpCloud shows it in its provisioning logs. Open **Troubleshoot SCIM → Health** in Living Security for failed requests, held accounts and token expiry.

| Code | Meaning and fix |
| - | - |
| [LS-SCIM-1001](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1001) | Authentication failed. Copy the SCIM base URL and a current token from the SCIM card into JumpCloud again. A token sent to another region's base URL also fails. |
| [LS-SCIM-1103](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1103) | A required attribute is missing. Map `userName` for users and `displayName` for groups. |
| [LS-SCIM-1104](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1104) | A value has the wrong type. Correct the mapping, for example `active` must be true or false. |
| [LS-SCIM-1107](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1107) | No usable email. Map the person's email to `emails[type eq "work"].value`. |
| [LS-SCIM-1108](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1108) | More than one primary email. Mark exactly one email as primary. |
| [LS-SCIM-1201](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1201) | The `userName` is already in use. Two JumpCloud users map to the same `userName`, or JumpCloud did not match an existing user. |
| [LS-SCIM-1601](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1601) | Rate limited. No action: JumpCloud retries after the `Retry-After` time. |
| [LS-SCIM-1602](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1602) | Changes paused. No action: JumpCloud retries. |
| [LS-SCIM-1604](https://docs.livingsecurity.com/features/settings/scim/errors.md#ls-scim-1604) | Internal error. Retry. If it continues, contact Living Security support with the output of **Copy diagnostics**. |

Some changes succeed in JumpCloud but are held in Living Security, for example a change that would remove your last owner. The SCIM card shows **Held accounts**. See [Held changes](https://docs.livingsecurity.com/features/settings/scim/user-lifecycle.md#held-changes).

Every code is in the [SCIM error reference](https://docs.livingsecurity.com/features/settings/scim/errors.md). For a support request, select **Copy diagnostics** on the troubleshooting page. It has no names, email addresses or tokens.

### The connection test fails

* **The test user already exists.** JumpCloud's test creates the **Test User Email**. Use an email that is not in Living Security, or a new address each time.
* **`401`.** Check that the token type is **Bearer Token** and that the base URL is your organization's regional URL from the SCIM card.

## Related

* [SCIM attribute reference](https://docs.livingsecurity.com/features/settings/scim/attributes.md)
* [Test your SCIM setup](https://docs.livingsecurity.com/features/settings/scim/testing.md)
* [SCIM error reference](https://docs.livingsecurity.com/features/settings/scim/errors.md)
* [API reference and limits](https://docs.livingsecurity.com/features/settings/scim/api-reference.md)


## Related topics

- [Set up a SCIM connection](https://docs.livingsecurity.com/features/settings/scim/connection.md)
- [SCIM and Google Workspace](https://docs.livingsecurity.com/features/settings/scim-google-workspace.md)
- [Living Security SCIM](https://docs.livingsecurity.com/features/settings/scim/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.