Skip to main content

1Password SCIM Admin

1Password SCIM Admin lists Business members and can suspend a member through your SCIM Bridge (GET / PATCH {bridge}/scim/v2/Users).

Service accounts cannot manage members. A 1Password Connect Server or Events API service account will not work. This connector needs the SCIM Bridge bearer token and the public Bridge URL.

If the account uses 1Password-hosted automated provisioning for Entra ID or Okta (no self-hosted bridge), this connector does not apply.

Authentication Types​

1Password SCIM Admin supports 1 authentication method:

  • SCIM Bridge bearer token — sent as Authorization: Bearer, plus the Bridge URL as a connector setting.
    • Pros: Same path IdPs use to provision and suspend users
    • Cons: Requires a deployed SCIM Bridge and 1Password Business; token is highly privileged

Configuration​

FieldExample
SCIM Bridge URL (no trailing slash)https://scim.example.com

Setting up SCIM Bridge credentials​

  1. Confirm 1Password Business and a running SCIM Bridge.
  2. Sign in at 1Password.com as an administrator.
  3. Go to Integrations → User Provisioning, open the SCIM Bridge details, and copy the bearer token. Store it in 1Password; treat it as production secret.
  4. Paste the token into Willow and enter the public Bridge URL (for example https://scim.example.com).

Available Tools​

  • List Users — GET {bridge}/scim/v2/Users. Page with startIndex (1-based) and count (max 100). Optional email filter (userName eq "..."). active is the member state.
  • Get User — GET {bridge}/scim/v2/Users/{id}.
  • Suspend User — PATCH {bridge}/scim/v2/Users/{id} with SCIM PatchOp active=false. The member cannot sign in. You can still delete the account later on 1Password.com. Do not change a suspended member's email in the identity provider first.

Troubleshooting​

401 or empty responses​

Cause: The credential is a Connect/Events service account, the bearer token was rotated, or the Bridge URL is wrong.

Solution: Use the SCIM Bridge bearer token from Integrations → User Provisioning, and the public DNS name of the Bridge with no trailing slash.

Bridge unreachable​

Cause: The SCIM Bridge is offline or not exposed to Willow's network.

Solution: Confirm the Bridge health endpoint and that Willow can reach https://scim.example.com. Existing 1Password accounts are not deleted when the Bridge is down.

On this page