Skip to main content

Mixpanel SCIM Admin

Mixpanel SCIM Admin lists Enterprise organization members and can deactivate a member through Mixpanel's SCIM 2.0 API (GET / PATCH /api/app/scim/v2/Users).

This connector is separate from the regular Mixpanel analytics integration. A Mixpanel service account (username + secret) cannot call SCIM. Use a SCIM token from Organization Settings.

Only claimed-domain users are included. Mixpanel SCIM affects users whose email is on a verified claimed domain. Project-level roles are not returned or set through SCIM.

Authentication Types​

Mixpanel SCIM Admin supports 1 authentication method:

  • SCIM token — sent as Authorization: Bearer. Generated under Organization Settings → Access Security → SCIM.
    • Pros: Matches how Mixpanel expects IdP provisioning tools to authenticate
    • Cons: Enterprise plan and configured SSO; token is shown only once; regenerating revokes the previous token

Setting up a SCIM token​

  1. Confirm the organization is on the Enterprise plan and SSO is configured.
  2. Sign in as an Organization Owner or Admin.
  3. Open Organization Settings → Access Security → SCIM.
  4. Generate a SCIM token and paste it into Willow.

See Mixpanel's SSO / SCIM help. Mixpanel implements a RFC 7644 subset at https://mixpanel.com/api/app/scim/v2.

Mixpanel recommends enabling IDP Managed Access when using SCIM so the identity provider and Mixpanel stay in sync.

Available Tools​

  • List Users — GET /api/app/scim/v2/Users. Page with startIndex (1-based) and count (max 100). Optional email filter (userName eq "..."). Returns userName, active, name, and emails. No project-role field.
  • Get User — GET /api/app/scim/v2/Users/{id}. Id comes from List Users.
  • Deactivate User — PATCH /api/app/scim/v2/Users/{id} with SCIM PatchOp active=false. This is Mixpanel's documented IdP deprovision path.

Troubleshooting​

401 or token rejected​

Cause: The secret is a Mixpanel service account or project token, or the SCIM token was regenerated.

Solution: Generate a new SCIM token under Access Security → SCIM. Do not paste a service-account username:secret.

Users missing from the list​

Cause: Their email domain is not in the organization's verified claimed domains.

Solution: Claim and verify the domain, or invite those users in the Mixpanel UI.

Project role did not change​

Cause: Mixpanel SCIM does not assign Organization Role or project access. Those stay in Mixpanel (or IdP group mappings where supported).

Solution: Update project access in Mixpanel Organization Settings.

On this page