Connect Amplitude SCIM to ChatGPT: Manage User Access and Invites

If you need to connect Amplitude SCIM to ChatGPT to automate user onboarding, orchestrate identity lifecycles, or manage group permissions, you need a Model Context Protocol (MCP) server. This server translates ChatGPT's function calls into Amplitude's SCIM 2.0 REST API payloads. You can either build, host, and maintain this translation layer yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting Amplitude SCIM to Claude or explore our broader architectural overview on connecting Amplitude SCIM to AI Agents.

Giving a Large Language Model (LLM) read and write access to a strict identity provisioning system like Amplitude SCIM is an engineering challenge. You have to handle complex JSON Patch documents, map flat LLM arguments into nested SCIM schemas, and deal with exact email-based identifier constraints. Every time your identity requirements change, custom server code must be updated and redeployed.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Amplitude SCIM, connect it natively to ChatGPT, and execute complex identity workflows using natural language.

The Engineering Reality of the Amplitude SCIM API

A custom MCP server acts as a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, implementing it against Amplitude's specific SCIM API implementation is exceptionally painful.

If you decide to build a custom MCP server for Amplitude SCIM, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with this API:

Email-as-Identifier Constraints

Unlike most REST APIs that return an opaque UUID or integer upon resource creation, Amplitude's SCIM implementation strictly uses the user's email address as their unique id. This email is also mapped to the userName attribute and is completely case-insensitive. If your LLM attempts to fetch a user by a standard database UUID, the request will fail. Your MCP server must explicitly guide the model to use the email address as the primary identifier for all GET, PUT, PATCH, and DELETE operations targeting users.

The JSON Patch Complexity

Partially updating a user (e.g., deactivating their account) or adding a user to a group requires sending a strict SCIM-compliant JSON Patch request. The LLM must construct an Operations array containing op, path, and value fields. For example, to deactivate a user, the LLM must generate {"op": "replace", "path": "active", "value": false}. Without highly specific JSON Schema definitions injected into the MCP tool description, LLMs will constantly hallucinate these patch payloads, resulting in HTTP 400 Bad Request errors from Amplitude.

Decoupled Group Assignments

When an LLM is asked to "Create a user and add them to the Admins group," standard intuition might lead the model to try and pass a groups array during the user creation payload. In Amplitude SCIM, group creation and assignment are decoupled. The groups array is ignored during user creation. The agent must first create the user, then query the group to get its ID, and finally issue a PATCH request to the group resource to append the new user's email to the members array. Your MCP schemas must dictate this exact operational order.

Step 1: Generate the Amplitude SCIM MCP Server

Truto automatically derives MCP tools from the Amplitude SCIM integration's resource definitions and documentation schemas. Each MCP server is scoped to a single connected tenant account, secured by a cryptographic token embedded in the URL.

You can generate this server via the Truto dashboard or programmatically via the API.

Method A: Via the Truto UI

1. Log in to the Truto dashboard and navigate to Integrated Accounts.
2. Select your connected Amplitude SCIM account.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select your desired configuration filters (e.g., restrict to specific methods or tags) and set an optional expiration date.
6. Click Create and copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4...). Treat this URL as a sensitive credential.

Method B: Via the Truto API

You can generate an MCP server programmatically by sending a POST request to Truto. This is useful for dynamically spinning up agent environments.

curl -X POST https://api.truto.one/integrated-account/<INTEGRATED_ACCOUNT_ID>/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Amplitude SCIM Identity Ops",
    "config": {
      "methods": ["read", "write", "custom"],
      "tags": ["users", "groups"]
    }
  }'

The API validates that tools exist for the requested configuration, generates the hashed token infrastructure, and returns a payload containing the url.

Step 2: Connect the MCP Server to ChatGPT

Once you have your Truto MCP server URL, you must register it with your ChatGPT environment. You can do this visually through the ChatGPT interface or via a manual configuration file if you are using an SSE transport wrapper.

Method A: Via the ChatGPT UI

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Ensure Developer mode is toggled on (this is required to enable MCP connector support).
3. Under the custom connectors section, click Add new server.
4. Name: Enter a descriptive label (e.g., "Amplitude SCIM").
5. Server URL: Paste the url generated by Truto.
6. Click Save. ChatGPT will immediately ping the endpoint, execute the handshake, and list the available Amplitude SCIM tools.

Method B: Via Manual Config File (SSE Transport)

If you are running a custom desktop agent or prefer managing connectors via configuration files, you can define the server using the @modelcontextprotocol/server-sse CLI wrapper.

{
  "mcpServers": {
    "amplitude-scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/<YOUR_TOKEN_HERE>"
      ]
    }
  }
}

Amplitude SCIM Hero Tools for ChatGPT

Truto dynamically builds MCP tool definitions from Amplitude SCIM's underlying API methods. Because Truto uses a flat input namespace, the LLM passes all arguments as a single JSON object, and the Truto router intelligently splits them into query parameters and body payloads based on the injected schemas.

Here are the highest-leverage tools available for your agent.

List All Amplitude SCIM Users

Tool: list_all_amplitude_scim_users

Fetches a paginated list of users in the Amplitude organization. This tool supports SCIM filtering logic, allowing the agent to locate specific users by attribute (e.g., userName eq "jane@acme.com"). This is crucial for verifying if a user already exists before attempting to invite them.

"Find the Amplitude user record for jane@acme.com to see if she is currently active or just pending an invite."

Get Single Amplitude SCIM User by ID

Tool: get_single_amplitude_scim_user_by_id

Retrieves a specific user's full profile, including their active status and group memberships. The required id argument must be the exact email address of the user.

"Get the full profile and group memberships for the user whose ID is mark.smith@company.com."

Create an Amplitude SCIM User

Tool: create_a_amplitude_scim_user

Invites a new user to the Amplitude organization. Amplitude handles sending the actual invitation email. The agent must provide the schemas array, the userName (which must be an email), and the name object. Remember, any groups provided in this payload are ignored - group assignments require a separate tool call.

"Invite new employee sarah.connor@acme.com to Amplitude SCIM. Set her formatted name as Sarah Connor."

Update an Amplitude SCIM User (Full Replace)

Tool: update_a_amplitude_scim_user_by_id

Executes a SCIM PUT request to replace the entire user object. This is often used to revoke a pending invite or completely overwrite a profile. To remove a user from the organization entirely, the agent sets active to false in this payload.

"Revoke access for david@acme.com by updating his user profile and setting his active status to false."

Partial Update an Amplitude SCIM User

Tool: amplitude_scim_users_partial_update

Executes a SCIM PATCH request. This is the most efficient way to toggle a single attribute without needing to read and rewrite the entire user object. The LLM must supply the user_id (email) and the Operations array.

"Patch the user record for engineering-lead@acme.com and replace their title attribute with 'VP of Engineering'."

List All Amplitude SCIM Groups

Tool: list_all_amplitude_scim_groups

Fetches all permission groups available in the Amplitude workspace. The agent uses this to find the correct numeric id for a group based on its displayName before attempting to add members.

"List all SCIM groups and find the internal numeric ID for the group named 'Data Scientists'."

Update an Amplitude SCIM Group by ID

Tool: update_a_amplitude_scim_group_by_id

Adds or removes members from a permission group using SCIM PATCH operations. To add a user, the agent passes an operation like {"op": "add", "path": "members", "value": [{"value": "email@acme.com"}]}.

"Add sarah.connor@acme.com to the 'Data Scientists' group using the group ID 40592."

To view the complete inventory of available SCIM operations and exact schema requirements, visit the Amplitude SCIM integration page.

Workflows in Action

When ChatGPT connects to the Amplitude SCIM MCP server, it transitions from a passive chat interface to an active identity orchestrator. Here is how complex workflows play out in production.

Scenario 1: Onboarding a New Data Engineer

An IT administrator wants to provision a new hire in Amplitude and assign them to the correct data science group.

"Invite our new hire, alex.chen@acme.com (Alex Chen), to Amplitude. Once invited, find the 'Data Engineers' group and add him to it."

Execution Steps:

1. Check for existing user: ChatGPT calls list_all_amplitude_scim_users with the filter userName eq "alex.chen@acme.com" to ensure no overlapping invites exist.
2. Create the user: ChatGPT calls create_a_amplitude_scim_user passing the required SCIM schemas, userName, and formatted name.
3. Locate the group: ChatGPT calls list_all_amplitude_scim_groups to find the exact numeric ID belonging to "Data Engineers".
4. Assign membership: ChatGPT calls update_a_amplitude_scim_group_by_id, targeting the retrieved group ID and passing a PATCH operation to add alex.chen@acme.com to the members array.

Result: The user receives an automated invite from Amplitude and is successfully enrolled in the correct permission group.

sequenceDiagram
    participant Admin as IT Admin
    participant Agent as ChatGPT
    participant Truto as Truto MCP Server
    participant Upstream as "Amplitude API"
    Admin->>Agent: "Invite alex.chen@acme.com and add to Data Engineers."
    Agent->>Truto: call: create_a_amplitude_scim_user
    Truto->>Upstream: POST /Users
    Upstream-->>Truto: 201 Created (User Object)
    Truto-->>Agent: User profile returned
    Agent->>Truto: call: list_all_amplitude_scim_groups
    Truto->>Upstream: GET /Groups
    Upstream-->>Truto: 200 OK (Groups Array)
    Truto-->>Agent: Group ID extracted
    Agent->>Truto: call: update_a_amplitude_scim_group_by_id
    Truto->>Upstream: PATCH /Groups/{groupId}
    Upstream-->>Truto: 204 No Content
    Truto-->>Agent: Group updated successfully
    Agent-->>Admin: "Alex has been invited and added to the group."

Scenario 2: Emergency Offboarding

A security engineer needs to immediately revoke access for a departing contractor.

"Immediately remove access for contractor-alpha@acme.com from Amplitude."

Execution Steps:

1. Verify user existence: ChatGPT calls get_single_amplitude_scim_user_by_id using contractor-alpha@acme.com to confirm the user exists and is currently active.
2. Revoke access: ChatGPT calls amplitude_scim_users_partial_update, passing an Operations payload to replace the active attribute with false.
3. Confirm deletion: ChatGPT parses the successful HTTP response and informs the security engineer that the user's session and invite access have been terminated.

Result: The contractor's access is instantly revoked without the security engineer needing to log into the Amplitude console.

Handling Rate Limits and API Errors

It is critical to understand how the MCP server handles upstream API limits. Truto operates as a transparent proxy layer for tool execution.

If ChatGPT executes a massive batch of SCIM operations and hits Amplitude's rate limits, the upstream API will return an HTTP 429 Too Many Requests. Truto does not retry, throttle, or apply backoff on rate limit errors. Instead, Truto passes that 429 error directly back to ChatGPT.

To help your client handle this gracefully, Truto normalizes the upstream rate limit information into standardized HTTP headers per the IETF specification:

• ratelimit-limit: The total allowed requests in the current window.
• ratelimit-remaining: The number of requests left.
• ratelimit-reset: The timestamp when the limit resets.

It is entirely the responsibility of the calling client (or the LLM framework's internal logic) to read these headers, apply exponential backoff, and retry the tool execution.

Security and Access Control

Exposing an identity provisioning API to an LLM requires strict boundary control. Truto provides four distinct mechanisms to secure your MCP server configuration:

• Method Filtering: Use config.methods to restrict the server to only read operations (GET requests) or write operations. If you only want ChatGPT to audit users without making changes, filter for ["read"].
• Tag Filtering: Use config.tags to limit the server's scope to specific resources. You can configure the server to only expose ["users"] while hiding the groups endpoints entirely.
• Time-to-Live (TTL): Pass an ISO datetime string to expires_at during server creation. Once the timestamp is reached, the internal edge-based alarm triggers, automatically tearing down the server and revoking the URL.
• Extra Authentication: By setting require_api_token_auth: true, possession of the MCP URL is no longer sufficient. The connecting client must also supply a valid Truto API token in the Authorization header to invoke any tools.

Moving Forward

Connecting Amplitude SCIM to ChatGPT transforms manual identity management into an agentic, natural-language process. By leveraging a managed MCP server, you avoid the heavy lifting of maintaining JSON schemas, handling pagination tokens, and building custom OAuth flows. Your agents interact securely with normalized tools, and your engineering team stays focused on core product logic rather than identity integration boilerplate.