Slack: choosing SCIM Admin API vs standard admin.* APIs for org provisioning and invites
domain: slack.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Distinguish two provisioning paths: the SCIM API (api.slack.com/admins/scim, protocol-standard user/group lifecycle management) and Slack's own admin.* Web API methods for Grid-specific operations like workspace invites.
Note SCIM operations apply org-wide on Enterprise Grid (not per-workspace) and require an OAuth token installed at the organization level — only an Org Owner can initially install the SCIM-capable app.
Use SCIM to bulk-create/deactivate members and sync profile fields or group membership (Business+ groups, Grid IdP groups), typically driven by an external IdP.
Use standard admin.* methods (e.g. admin.users.invite, admin.inviteRequests.*) for workspace-level invite flows that don't map cleanly to SCIM's strict user-lifecycle model.
Target SCIM calls at https://api.slack.com/scim/v1/ with the correct resource path (/Users, /Groups), matching whichever SCIM version (1.1 or 2.0) the org has configured.
Known gotchas
SCIM requires an Enterprise Grid org and an org-level-installed app — a workspace-level bot token will not authenticate SCIM calls.
SCIM and the admin.* Web API family overlap in purpose but are separate systems with separate auth and scopes — mixing them up is a common integration mistake.
Only Org Owners can install/authorize the SCIM app initially, even though Org Admins can operate it afterward — plan the initial setup step around that.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?