SCIM Groups allow your identity provider to push group memberships into LangWatch. Admins can then map those groups to specific roles at the organization, team, or project level — so users automatically get the right access the moment they are provisioned.Documentation Index
Fetch the complete documentation index at: https://langwatch.ai/docs/llms.txt
Use this file to discover all available pages before exploring further.
SCIM Groups are an Enterprise feature. See SCIM Provisioning for setting up user provisioning first.
How It Works
- Your identity provider pushes groups to LangWatch via the SCIM
/Groupsendpoint - Groups appear in Settings → Groups in LangWatch
- Admins assign role bindings to each group (e.g. MEMBER on Team Engineering)
- When a user is added to the group in the IdP, they inherit all roles assigned to that group
- When a user is removed from the group (or deprovisioned), access is revoked automatically
Viewing Groups
Navigate to Settings → Groups to see all groups pushed from your identity provider. Each row shows:| Column | Description |
|---|---|
| Group | The group name as defined in your IdP |
| Source | SCIM for IdP-managed groups, Manual for manually created groups |
| Access | The role bindings assigned to this group |
| Members | Number of users currently in the group |
Assigning Roles to a Group
Open a group and use the Access granted section to add role bindings:- Select a role (Admin, Member, Viewer, or a custom role)
- Select the scope — Organization, Team, or Project
- Select the specific team or project (for Team/Project scope)
- Click Add
Role Scopes
| Scope | What it grants |
|---|---|
| Organization | Access across the entire organization at the specified role level |
| Team | Access to a specific team and all its projects |
| Project | Access to a single project only |
Role Resolution
A user may belong to multiple groups, each with different role assignments. LangWatch resolves the effective role using the highest privilege wins rule: Hierarchy:ADMIN > MEMBER > VIEWER
If a user is in:
- Group A → Member on Team Engineering
- Group B → Admin on Team Engineering
User Lifecycle with Groups
When a User is Added to a Group
The user immediately inherits all role bindings assigned to that group. If they were not yet a member of your LangWatch organization, they are provisioned as a Member first (see User Provisioning).When a User is Removed from a Group
Their group-inherited roles are removed. If they have no other active bindings, they will have no project or team access but remain in the organization.When a User is Deprovisioned (DELETE)
When your IdP sends a SCIM DELETE for a user:- Their org membership and all role bindings are removed
- Their account is deactivated — they can no longer sign in
- Their data (traces, annotations, datasets) is preserved
404 Not Found — the operation is idempotent.
When a User is Suspended (PATCH active=false)
When your IdP suspends a user (setsactive: false):
- Their account is deactivated — they can no longer sign in
- Their org membership and role bindings are preserved
- Re-activating (
active: true) immediately restores access
Use
PATCH active=false for temporary suspension (e.g. leave of absence). Use DELETE for permanent offboarding. The distinction matters because DELETE removes all role bindings and group memberships — re-provisioning the user starts from scratch.Manual Groups
You can also create groups manually without an identity provider:- In Settings → Groups, click Add manual group at the bottom of the table
- Enter a group name
- Optionally add role bindings and members in the creation dialog
- Click Create group
Manual groups are not synced with any identity provider. Membership must be managed from within LangWatch.
SCIM Group Endpoints
LangWatch supports the following SCIM group operations:| Endpoint | Methods |
|---|---|
/api/scim/v2/Groups | GET, POST |
/api/scim/v2/Groups/{id} | GET, PUT, PATCH, DELETE |
Supported PATCH Operations
| Operation | Example | Effect |
|---|---|---|
add members | Add users to group | Users inherit group’s roles |
remove members | Remove users from group | Roles revoked for removed users |
replace displayName | Rename the group | Group name updated in LangWatch |
replace members | Full member replacement | Adds new, removes old members |
Supported Filter
Groups can be filtered bydisplayName using a case-insensitive eq filter:
Troubleshooting
Groups are not appearing in LangWatch- Confirm that group push (SCIM provisioning of groups) is enabled in your IdP’s application settings
- Check your IdP’s provisioning logs for errors on the Groups endpoint
- Verify your bearer token has not been revoked
- Open the group in Settings → Groups and check the Access granted section
- If empty, add at least one role binding to the group
- Confirm the user appears in the group’s Members list
- The user may be in multiple groups — check all group memberships in your IdP
- Direct role bindings on the user (from Settings → Members) also apply and are combined with group bindings
- Ensure your IdP is configured to push group membership changes (not just user changes)
- Check provisioning logs for any errors on the PATCH groups endpoint
For additional help, contact us at support@langwatch.ai.