Skip to main content

Notion SCIM Admin

Notion SCIM Admin lists Enterprise workspace members and can deactivate a member through Notion's SCIM 2.0 API (GET / PATCH /scim/v2/Users).

This connector is separate from the regular Notion OAuth integration. A Notion internal/public integration token cannot call SCIM. Use a SCIM token created by an organization owner.

Guests are not included. Notion SCIM only manages workspace members (and restricted members). Page guests must be handled in the Notion UI.

Authentication Types​

Notion SCIM Admin supports 1 authentication method:

  • SCIM token — sent as Authorization: Bearer. Generated per workspace under organization SCIM provisioning.
    • Pros: Matches how Notion expects IdP provisioning tools to authenticate
    • Cons: Enterprise Plan only; each workspace needs its own token; the owner who created the token cannot be removed via SCIM

Setting up a SCIM token​

  1. Confirm the workspace is on the Enterprise Plan.
  2. Sign in as an organization owner.
  3. Open the workspace switcher → Manage organization → General → SCIM provisioning. Set up the organization first if prompted.
  4. Generate a SCIM API token for that workspace and paste it into Willow.

See Notion's SCIM help.

Changing a member's name or email through SCIM also requires a verified domain.

Available Tools​

  • List Users — GET /scim/v2/Users. Page with startIndex (1-based) and count (max 100). Optional email filter (email eq "..."). Returns userName (email), active, name, and Notion workspace role (owner, membership_admin, member, restricted_member).
  • Get User — GET /scim/v2/Users/{id}. Id is a UUID from List Users.
  • Deactivate User — PATCH /scim/v2/Users/{id} with SCIM PatchOp active=false. Removes the member from the workspace. The Notion user account is not deleted. The workspace owner who created this SCIM token cannot be removed.

Troubleshooting​

401 or token rejected​

Cause: The secret is a regular Notion integration token, or the SCIM token was revoked when its creator left.

Solution: Generate a new SCIM token under Manage organization → SCIM provisioning. Do not paste an OAuth integration token.

Guests missing from the list​

Cause: Notion SCIM does not provision or list page guests.

Solution: Manage guests in the Notion workspace UI.

Cannot deactivate the token owner​

Cause: Notion forbids removing the workspace owner that created the SCIM bot token.

Solution: Replace the token with one created by another owner first, then deactivate the original owner.

On this page