# Lucid SCIM provisioning (Lucidchart, Lucidspark) from Google Workspace

> Provision Lucidchart and Lucidspark users and groups from Google Workspace with the Lucid SCIM API on Enterprise. Which token to use and AnySCIM setup.

**Lucid supports SCIM provisioning on Enterprise accounts.** A Lucid admin generates a SCIM token in the admin panel, and AnySCIM uses it with `https://users.lucid.app/scim/v2` to create Lucidchart and Lucidspark users from Google Workspace, sync Google groups and deactivate people who leave.

## Requirements

- An active **Lucid Enterprise** subscription.
- A Lucid **admin** to generate the token.
- For automatic licensing, the account setting that lets Lucid **purchase licenses automatically** when you run out, so Google Workspace can act as the source of truth for who gets a license.

## Choose the right Lucid token

Lucid has two SCIM integrations, and the token you generate decides which one AnySCIM talks to:

| Integration | Google groups become | Use it to |
| --- | --- | --- |
| **SCIM for admin management** | Lucid organizational groups | Provision and license users, and group them for admin purposes |
| **SCIM for content access** | Lucid teams | Control who can see shared team content |

Most companies start with **admin management**. If you need both, create two connections in AnySCIM, one per token.

## Generate the Lucid SCIM token

1. In Lucid, open the **Admin** panel and go to **App integration**.
2. Open **SCIM for admin management** (or **SCIM for content access**).
3. Generate a token and copy it. Store it like a password: it can manage every user on the account.
4. Check the base URL shown on the same page. It's `https://users.lucid.app/scim/v2` for most accounts; accounts in FedRAMP environments use a different one.

## Connect Lucid in AnySCIM

1. Open **Connections → New connection** and choose **Lucid**.
2. The base URL is pre-filled with `https://users.lucid.app/scim/v2`. Replace it if your token page shows a different one, paste the token and click **Test connection**.
3. In **Scope**, select the people who should have Lucid. Turn on **Push group membership** to create Lucid groups (or teams, with a content access token) from Google groups.
4. Review the dry-run and activate.

## How users are synced

- New users in scope get a Lucid account, matched by email (`userName`).
- Name, title and department changes are pushed with `PATCH`.
- When a Google user is suspended, AnySCIM sets `active: false` and the user becomes inactive in Lucid. Active and inactive users are both visible in the admin panel.
- Users found in Lucid but no longer in scope are left alone by default. In **Settings → When a user is deleted** you can choose to deactivate or delete them instead.

## Troubleshooting

- **New users aren't licensed:** with the admin management integration, turn on automatic license purchasing so Lucid can license users that Google Workspace provisions.
- **Groups end up as teams (or the other way round):** the token belongs to the other integration. Generate a token for the integration you want and update the connection.
- **401 on every request:** the token was regenerated. Paste the new one into the connection.

## FAQ

### Which Lucid plan supports SCIM?

Enterprise. The SCIM API is only available on Lucid Enterprise accounts.

### Should I use SCIM for admin management or for content access?

Use **admin management** to provision and license users and sync Google groups to organizational groups. Use **content access** to sync Google groups to Lucid teams for sharing. You can connect both, each with its own token.

### What happens to a Lucid user when they leave?

When their Google account is suspended, AnySCIM sends `active: false` and the user becomes inactive in Lucid. With automatic licensing on, Google Workspace stays the source of truth for who holds a license.