Lucid SCIM provisioning (Lucidchart, Lucidspark) from Google Workspace
Provision Lucidchart and Lucidspark users and groups from Google Workspace with the Lucid SCIM API on Enterprise. Which token to use and AnySCIM setup.
- SCIM base URL
https://users.lucid.app/scim/v2- Vendor plan
- Lucid Enterprise
- Authentication
- Bearer token from Admin → App integration → SCIM
- Provisions
- Users, groups or teams, deactivation
Lucid supports SCIM provisioning on Enterprise accounts. A Lucid admin generates a SCIM token in the admin panel, and AnySCIM uses it with https://users.lucid.app/scim/v2 to create Lucidchart and Lucidspark users from Google Workspace, sync Google groups and deactivate people who leave.
Requirements
- An active Lucid Enterprise subscription.
- A Lucid admin to generate the token.
- For automatic licensing, the account setting that lets Lucid purchase licenses automatically when you run out, so Google Workspace can act as the source of truth for who gets a license.
Choose the right Lucid token
Lucid has two SCIM integrations, and the token you generate decides which one AnySCIM talks to:
| Integration | Google groups become | Use it to |
|---|---|---|
| SCIM for admin management | Lucid organizational groups | Provision and license users, and group them for admin purposes |
| SCIM for content access | Lucid teams | Control who can see shared team content |
Most companies start with admin management. If you need both, create two connections in AnySCIM, one per token.
Generate the Lucid SCIM token
- In Lucid, open the Admin panel and go to App integration.
- Open SCIM for admin management (or SCIM for content access).
- Generate a token and copy it. Store it like a password: it can manage every user on the account.
- Check the base URL shown on the same page. It's
https://users.lucid.app/scim/v2for most accounts; accounts in FedRAMP environments use a different one.
Connect Lucid in AnySCIM
- Open Connections → New connection and choose Lucid.
- The base URL is pre-filled with
https://users.lucid.app/scim/v2. Replace it if your token page shows a different one, paste the token and click Test connection. - In Scope, select the people who should have Lucid. Turn on Push group membership to create Lucid groups (or teams, with a content access token) from Google groups.
- Review the dry-run and activate.
How users are synced
- New users in scope get a Lucid account, matched by email (
userName). - Name, title and department changes are pushed with
PATCH. - When a Google user is suspended, AnySCIM sets
active: falseand the user becomes inactive in Lucid. Active and inactive users are both visible in the admin panel. - Users found in Lucid but no longer in scope are left alone by default. In Settings → When a user is deleted you can choose to deactivate or delete them instead.
Troubleshooting
- New users aren't licensed: with the admin management integration, turn on automatic license purchasing so Lucid can license users that Google Workspace provisions.
- Groups end up as teams (or the other way round): the token belongs to the other integration. Generate a token for the integration you want and update the connection.
- 401 on every request: the token was regenerated. Paste the new one into the connection.
FAQ
Which Lucid plan supports SCIM?
Enterprise. The SCIM API is only available on Lucid Enterprise accounts.
Should I use SCIM for admin management or for content access?
Use admin management to provision and license users and sync Google groups to organizational groups. Use content access to sync Google groups to Lucid teams for sharing. You can connect both, each with its own token.
What happens to a Lucid user when they leave?
When their Google account is suspended, AnySCIM sends active: false and the user becomes inactive in Lucid. With automatic licensing on, Google Workspace stays the source of truth for who holds a license.
Try it on your own directory
Connect Google Workspace and preview the first sync in dry-run: nothing is sent until you activate the connection.
