Skip to main content
Okta can provision users and push groups to ResolveAI. After you link a pushed group to a team, Okta keeps the team roster current.
An Okta Administrator must complete this setup. A ResolveAI organization admin must generate the credentials.Set up Okta SSO first. SCIM attaches to the same ResolveAI application.
Before you start, read Directory Sync (SCIM) for the effects of each push and the required setup order.

​
1. Get your credentials from ResolveAI

In ResolveAI:
  • Go to Admin → Authentication
  • Find Directory provisioning (SCIM)
  • Click Generate SCIM credentials
ResolveAI gives you:
  • A SCIM base URL, of the form https://api.app0.resolve.ai/scim/v2/i/<your-connection-id>
  • A SCIM token
ResolveAI shows the token only when you create or rotate it. You cannot retrieve it later. Copy it before you leave the page. If you lose it, use Rotate to issue a replacement.
Use the plain base URL exactly as ResolveAI shows it. Okta does not need a query suffix.

​
2. Enable SCIM provisioning on the app

  • In the Okta Admin Dashboard, open Applications → Applications and select your ResolveAI app
  • On the General tab, click Edit next to App Settings
  • Set Provisioning to SCIM
  • Click Save
A Provisioning tab appears on the app once this is saved.

​
3. Configure the SCIM connection

Open the Provisioning tab, then Integration, and click Edit.
  • SCIM connector base URL: the base URL from step 1
  • Unique identifier field for users: userName
  • Supported provisioning actions: enable Push New Users, Push Profile Updates, and Push Groups
  • Authentication Mode: HTTP Header
  • Authorization: Bearer <your SCIM token>
Click Test Connector Configuration, then Save.
ResolveAI identifies people by userName, which must contain the person’s email address. Leave the unique identifier field set to userName.

​
4. Enable provisioning to ResolveAI

Still on the Provisioning tab, choose To App in the left panel and click Edit. Enable:
  • Create Users
  • Update User Attributes
  • Deactivate Users
Click Save. Deactivating a user in Okta freezes their ResolveAI account and ends their sessions immediately. It does not erase their history.

​
5. Check the attribute mappings

Under To App, confirm the ResolveAI attributes are mapped: Only userName is required. A person with no first or last name is accepted and stored with those fields empty.

​
6. Assign people and sync them

  • Open the Assignments tab
  • Assign the users or groups who should have ResolveAI access
Okta pushes people when you assign them. In ResolveAI, confirm they appear in the imported directory under Admin → Authentication.
Push users before groups. If a group names people ResolveAI does not have yet, ResolveAI stores the group push but refuses to reconcile the linked team. The team stays unchanged; it is not emptied.

​
7. Push groups

  • Open the Push Groups tab
  • Click Push Groups and select the groups you want ResolveAI to know about
  • Leave Push group memberships immediately enabled
  • Click Save
Pushed groups appear in the groups list under Admin → Authentication. A pushed group does not change a team roster until you link it to that team.

​
8. Put the groups to work

Link groups to teams in ResolveAI, not Okta. See Linking groups to teams. After you verify the directory, you can restrict sign-in to it. Sign-in enforcement previews who will gain or lose access.

​
Troubleshooting

Test Connector Configuration fails, or Okta reports HTML instead of JSON. Check that the base URL matches the one ResolveAI displayed and uses the api. host. A URL built from the application host reaches the web app, not the SCIM service. “Email domain is not configured for this SCIM connection”. ResolveAI accepts only the email domains configured on your connection. Matching is exact and does not include subdomains. Map Okta to send an address on a configured domain, or ask your Resolve contact to add the domain. A group pushed, but the team did not change. Confirm that every group member exists in ResolveAI. If ResolveAI cannot resolve all members, it stores the group push but refuses to reconcile the team. The team stays unchanged, and the Authentication page shows Sync needs attention with the reason. Someone was pushed but cannot use ResolveAI. A pushed user is active in the imported directory, but the push does not grant access. Access begins when the user first signs in. Membership in a linked team is separate from organization access. Rotating a token. Rotate issues a replacement and keeps the old token working for 24 hours while you update Okta. If a token may have leaked, use Revoke to stop it immediately. Group external IDs are empty. Some providers send an external identifier with each pushed group. Okta does not, so that column stays empty in ResolveAI. The empty value does not affect syncing. Renaming a group in Okta pushes the new name to ResolveAI, and any linked team keeps its binding.