Connect Indeed SCIM to ChatGPT: Automate User Lifecycle Management

If you need to connect Indeed SCIM to ChatGPT to automate user provisioning, offboarding, and employer organization management, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's tool calls and Indeed's SCIM REST API. You can either spend weeks building and maintaining this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting Indeed SCIM to Claude or explore our broader architectural overview on connecting Indeed SCIM to AI Agents.

Giving a Large Language Model (LLM) read and write access to an enterprise identity system is a massive engineering challenge. You have to handle OAuth 2.0 token lifecycles, map massive JSON schemas to MCP tool definitions, and deal with Indeed's specific SCIM implementations. Every time an endpoint updates or requires a specific data extension, you have to update your server code, redeploy, and test the integration. This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Indeed SCIM, connect it natively to ChatGPT, and execute complex identity workflows using natural language.

The Engineering Reality of the Indeed SCIM API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against Indeed's SCIM API is painful. You are not just integrating a simple REST API - you are dealing with the rigid System for Cross-domain Identity Management (SCIM 2.0) specification mixed with vendor-specific nuances.

If you decide to build a custom MCP server for Indeed SCIM, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with Indeed SCIM:

The SCIM Schema and Custom Extensions

SCIM 2.0 requires highly specific, nested JSON structures. You cannot just send a flat JSON object with { "first_name": "John", "email": "john@example.com" }. The LLM must generate a payload that strictly adheres to the core user schema (urn:ietf:params:scim:schemas:core:2.0:User) while also injecting Indeed's specific extensions, such as urn:ietf:params:scim:schemas:extension:indeed:2.0:EmployerOrg for organizational mapping. If your MCP server does not strictly validate and type-hint these massive schemas to the LLM, ChatGPT will hallucinate flat structures and the API will reject the payload with a 400 Bad Request.

Destructive Updates (Full Overwrites)

The Indeed SCIM API requires full object replacements for user updates. If you want to update a user's title, you cannot simply send a partial PATCH request with the new title. You must send a full PUT request containing every existing value on the account. If the LLM omits an attribute or an empty array, that data is wiped from the Indeed system. Your MCP server or the LLM must first perform a GET request, merge the changes into the existing payload, and then send the full object back.

Asynchronous Deletions

When offboarding a user, deleting an account by their encrypted ID triggers an asynchronous process on Indeed's end. The user is immediately removed from any employer organizations, but the actual deletion process can take up to 30 minutes to propagate entirely. Your LLM must be instructed not to repeatedly poll or assume the user record will instantly vanish from secondary read queries.

Rate Limits and 429 Handling

Identity systems enforce strict API rate limits to prevent abuse. When building an MCP server, you must account for this. Note that Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Indeed API returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. The caller - in this case, the LLM agent or framework handling the tool call - is strictly responsible for implementing retry and backoff logic.

The Managed MCP Approach

Instead of forcing your engineering team to build a custom application that handles authentication, schema validation, and tool generation, Truto provides a managed infrastructure layer. Truto turns your connected Indeed SCIM integration into an MCP-compatible JSON-RPC endpoint dynamically.

When you use Truto, the MCP tools are generated dynamically from the integration's internal configuration and documentation records. You do not write tool definitions by hand. Truto reads the query and body schemas, injects necessary descriptions, and outputs an MCP protocol-compliant server URL.

Step 1: Create the MCP Server

You can generate the MCP server for Indeed SCIM using either the Truto UI or the API.

Method A: Via the Truto UI

1. Navigate to the integrated account page for your connected Indeed SCIM instance in the Truto dashboard.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (e.g., allowed methods, tags, expiration).
5. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3...).

Method B: Via the API You can automate the creation of MCP servers by making a POST request to the Truto API. This is ideal if you are embedding agentic features inside your own application.

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Indeed SCIM Provisioning Server",
    "config": {
      "methods": ["read", "write"]
    }
  }'

The response will contain the secure URL you need to connect the client.

Step 2: Connect the MCP Server to ChatGPT

Once you have your Truto MCP server URL, connecting it to your LLM framework takes seconds.

Method A: Via the ChatGPT UI

1. Open ChatGPT and navigate to Settings.
2. Select Apps, then click Advanced settings.
3. Enable Developer mode (MCP support requires this feature flag).
4. Under MCP servers or Custom connectors, click Add.
5. Enter a name (e.g., "Indeed SCIM") and paste the Truto MCP URL into the Server URL field.
6. Click Save. ChatGPT will immediately handshake with the server and list the available Indeed SCIM tools.

Method B: Via Local Configuration File If you are using a custom local agent, LangChain, or Claude Desktop alongside standard MCP testing flows, you can configure the connection manually using Server-Sent Events (SSE). Since Truto hosts the server, you point the client to the URL rather than running a local script.

{
  "mcpServers": {
    "indeed_scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/YOUR_TRUTO_TOKEN"
      ]
    }
  }
}

Indeed SCIM Hero Tools

Once connected, Truto exposes standard proxy methods mapped directly to Indeed's SCIM specifications. Here are the most critical operations your AI agent can perform.

List All Indeed SCIM Users

Tool name: list_all_indeed_scim_users

This tool retrieves user accounts based on strict filtering criteria. Indeed SCIM requires the filter query parameter to locate users by externalId or userName (email). Because of Indeed's specific implementation, this endpoint returns a maximum of one user. If multiple users match a query somehow, the API throws an error.

"Check if an Indeed account exists for john.doe@company.com using the list users tool. Pass the filter parameter exactly as userName eq 'john.doe@company.com'."

Get Single Indeed SCIM User by ID

Tool name: get_single_indeed_scim_user_by_id

Retrieves the complete SCIM user object using the encrypted Indeed account ID. This is a critical prerequisite tool before executing updates, as you must retrieve the current user state to prevent destructive overwrites. It returns the core schema data along with all associated employer organization extensions.

"Fetch the complete Indeed SCIM profile for user ID 'abc-123-def' so we can verify their current employer organization mapping."

Create an Indeed SCIM User

Tool name: create_a_indeed_scim_user

Provisions a new user in Indeed SCIM. The LLM must construct a payload that includes the SCIM schemas array, userName, name (givenName, familyName), and exactly one primary object in the emails array. You can also pass the urn:ietf:params:scim:schemas:extension:indeed:2.0:EmployerOrg block to link them to an employer profile.

"Provision a new Indeed SCIM account for Jane Smith. Her username is jane.smith@company.com, external ID is emp-789. Ensure she is assigned to the 'Engineering' employer organization ID."

Update an Indeed SCIM User by ID

Tool name: update_a_indeed_scim_user_by_id

Replaces the user object. Because this is a full overwrite, you must instruct the LLM to provide the complete, current user payload merged with any changes. Any omitted attributes will be deleted.

"I need to update John's title to 'Senior Engineer'. First, fetch his current profile using his ID. Then, use the update tool to overwrite his profile, making sure to include all of his existing data plus the new title."

Delete an Indeed SCIM User by ID

Tool name: delete_a_indeed_scim_user_by_id

Initiates the asynchronous offboarding process. The user is stripped of their employer organization roles immediately, with full deletion following shortly after. It requires the encrypted account ID and returns a 204 No Content on success.

"Initiate the offboarding process for user ID 'xyz-987'. Call the delete tool and confirm once the 204 response is received."

To view the full inventory of tools and complete JSON schema definitions for this integration, check out the Indeed SCIM integration page.

Workflows in Action

By chaining these tools together, ChatGPT can act as an autonomous identity provider agent. Here is how a real-world workflow executes.

Scenario 1: Emergency Offboarding

When an employee is terminated, an IT admin needs to severe their access immediately across all vendor portals.

"Offboard jane.doe@company.com from Indeed immediately. Find her account and delete it."

Step-by-step execution:

1. ChatGPT calls list_all_indeed_scim_users passing filter: "userName eq 'jane.doe@company.com'".
2. The Truto MCP server executes the proxy call and returns the SCIM user payload, revealing the encrypted ID usr-555.
3. ChatGPT calls delete_a_indeed_scim_user_by_id passing id: "usr-555".
4. Truto executes the DELETE request. Indeed returns a 204 No Content response.
5. ChatGPT replies to the user: "Jane Doe's account has been located and the deletion process has been initiated. Her access to employer organizations has been revoked immediately."

sequenceDiagram
  participant User as User Prompt
  participant ChatGPT as ChatGPT
  participant MCP as Truto MCP Server
  participant Indeed as Indeed SCIM API

  User->>ChatGPT: "Offboard jane.doe@company.com"
  ChatGPT->>MCP: Call list_all_indeed_scim_users
  MCP->>Indeed: GET /Users?filter=userName eq 'jane...' 
  Indeed-->>MCP: Returns SCIM User Object
  MCP-->>ChatGPT: Returns User ID (usr-555)
  ChatGPT->>MCP: Call delete_a_indeed_scim_user_by_id
  MCP->>Indeed: DELETE /Users/usr-555
  Indeed-->>MCP: 204 No Content
  MCP-->>ChatGPT: Success execution result
  ChatGPT-->>User: "Account deletion initiated."

Scenario 2: Safe Profile Updates

Because updates require full payloads, the LLM must autonomously manage state retrieval.

"Update Mike's last name to 'Johnson-Smith'. His email is mike@company.com."

Step-by-step execution:

1. ChatGPT calls list_all_indeed_scim_users to find Mike's encrypted ID.
2. To ensure no data is lost during the full overwrite, ChatGPT calls get_single_indeed_scim_user_by_id to fetch the complete SCIM document, including arrays like emails and the EmployerOrg extension.
3. ChatGPT modifies the name.familyName property in memory.
4. ChatGPT calls update_a_indeed_scim_user_by_id passing the entire modified JSON object.
5. Truto proxies the PUT request. Indeed replaces the object and returns the updated user.
6. ChatGPT replies: "Mike's last name has been updated successfully, and all other organizational data was preserved."

Security and Access Control

Exposing an identity management API to an AI model requires strict governance. Truto MCP servers provide several security layers baked into the token generation process:

• Method Filtering (config.methods): You can restrict an MCP server to safe operations. Setting methods: ["read"] ensures ChatGPT can only list and get users, physically preventing the LLM from executing creates, updates, or deletes, even if hallucinated.
• Tag Filtering (config.tags): You can scope the MCP server to only expose tools tied to specific functional tags defined in the integration configuration.
• Extra Authentication (require_api_token_auth): By default, possessing the MCP URL grants access. Enabling this flag forces the client to also pass a valid Truto API token in the Authorization header, meaning the URL alone is useless if leaked.
• Temporary Access (expires_at): You can issue short-lived MCP servers by passing an ISO datetime. Once expired, Truto automatically cleans up the database records and Cloudflare KV entries, permanently deadlining the server URL.

Automate Identity with Truto

Building a custom integration layer that perfectly handles the SCIM 2.0 specification, full overwrite logic, and dynamic MCP schema mapping is a drain on engineering resources. Truto handles the boilerplate, securely authenticates the connections, and dynamically translates Indeed SCIM documentation into strict AI agent tools.

Whether you are building internal IT automation bots or customer-facing identity management agents, leveraging managed MCP infrastructure ensures your tools stay updated, secure, and highly available.