Connect Navan SCIM to ChatGPT: Search and Audit User Profiles

If you need to connect Navan SCIM to ChatGPT to automate directory lookups, audit corporate travel profiles, or troubleshoot identity provisioning issues, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's JSON-RPC tool calls and Navan's SCIM 2.0 endpoints. You can either spend weeks building and maintaining this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting Navan SCIM to Claude or explore our broader architectural overview on connecting Navan SCIM to AI Agents.

Giving a Large Language Model (LLM) read access to an enterprise directory is an engineering challenge. You must handle strictly standardized nested SCIM payloads, complex filter query syntax, and massive pagination constraints. Every time your identity provider structure changes or Navan introduces new enterprise extension attributes, a hard-coded custom MCP server risks breaking.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Navan SCIM, connect it natively to ChatGPT, and execute complex directory workflows using natural language.

Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. :::

The Engineering Reality of the Navan SCIM API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, implementing it against a System for Cross-domain Identity Management (SCIM) API presents unique challenges that break standard REST CRUD assumptions.

If you decide to build a custom MCP server for Navan SCIM, you own the entire API lifecycle. Here are the specific integration challenges you will face:

The SCIM 2.0 Filter Syntax Hurdle

Navan adheres strictly to the SCIM 2.0 protocol (RFC 7644) for querying users. Unlike standard REST APIs that might accept simple query parameters like ?email=test@example.com, SCIM requires complex filter expressions. An LLM must correctly construct queries like filter=userName eq "jane.doe@company.com" or filter=emails [type eq "work"].value co "navan". If your MCP server does not provide an explicitly detailed JSON Schema explaining these SCIM operators (eq, co, sw, pr), ChatGPT will hallucinate standard REST parameters, resulting in HTTP 400 Bad Request errors from Navan.

Deeply Nested Enterprise Extension Schemas

SCIM data models are notoriously nested. A user profile is not a flat JSON object; it is divided into core schemas (e.g., urn:ietf:params:scim:schemas:core:2.0:User) and enterprise extensions (e.g., urn:ietf:params:scim:schemas:extension:enterprise:2.0:User). Cost center assignments, manager IDs, and department codes often live deep inside these extension urns. Your MCP tool definitions must parse these nested arrays and objects so the LLM understands exactly where to look for a user's corporate travel policy assignment or approval hierarchy.

Rate Limits and Large Directory Pagination

Corporate directories integrated with Navan often contain tens of thousands of users. You cannot execute a single list command and expect a complete result. SCIM relies on startIndex and count parameters for pagination.

Furthermore, Navan SCIM enforces strict rate limits to protect its infrastructure. Factual note on rate limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When Navan SCIM returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller - your AI agent framework or ChatGPT itself - is entirely responsible for implementing retry and backoff logic. Do not expect the integration layer to absorb these constraints.

How to Generate a Navan SCIM MCP Server with Truto

Truto's architecture eliminates the need to manually map Navan SCIM schemas to MCP JSON-RPC tool definitions. Instead, tool generation is dynamic and documentation-driven. Truto evaluates the available endpoints for the integrated Navan account, cross-references them with stored API schemas, and auto-generates the necessary MCP tools at runtime.

Each MCP server is scoped to a single integrated account (a specific tenant's connected Navan instance). You can create this server through the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

For administrators and non-developers, the UI provides a straightforward configuration path:

1. Navigate to the Integrated Accounts page in your Truto dashboard and select your connected Navan SCIM instance.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Define your configuration parameters. For directory auditing, you might want to restrict access to read-only operations. You can do this by setting the allowed methods to read or selecting specific tags like users.
5. Click Save and copy the generated MCP server URL. It will look like https://api.truto.one/mcp/<secure-token>.

Method 2: Via the Truto API

For platform engineers automating agent provisioning, you can generate MCP servers programmatically. Make an authenticated POST request to the Truto API, passing your specific configuration filters.

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ChatGPT Navan SCIM Auditor",
    "config": {
      "methods": ["read"],
      "tags": ["users"]
    }
  }'

Truto validates that tools exist for your configuration, generates a cryptographic token, provisions edge key-value storage for high-speed routing, and returns the active URL.

{
  "id": "mcp_srv_8901xyz",
  "name": "ChatGPT Navan SCIM Auditor",
  "config": { "methods": ["read"], "tags": ["users"] },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890"
}

How to Connect the MCP Server to ChatGPT

Once you have your Truto MCP URL, you can connect it to ChatGPT. Because Truto bakes the routing and authentication directly into the cryptographic token in the URL, ChatGPT requires zero additional OAuth configuration to read from Navan.

Method 1: Via the ChatGPT UI

If you are using ChatGPT Pro, Plus, Business, Enterprise, or Education accounts, you can add custom connectors directly in the interface.

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Ensure Developer mode is enabled.
3. Under the MCP servers / Custom connectors section, click to add a new server.
4. Provide a recognizable name (e.g., "Navan SCIM Directory").
5. Paste the Truto MCP URL (https://api.truto.one/mcp/<token>) into the Server URL field.
6. Click Save.

ChatGPT will immediately ping the endpoint, execute the MCP initialize handshake, and call tools/list to populate its context window with the available Navan operations.

Method 2: Via Manual Config File

If you are configuring a local instance of ChatGPT Desktop, Claude Desktop, or a custom agent framework via configuration files, you will use Server-Sent Events (SSE) via the standard MCP CLI transport.

Add the following JSON block to your client configuration file:

{
  "mcpServers": {
    "navan_scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f67890"
      ]
    }
  }
}

Restart your client. The LLM will now have programmatic access to the Navan SCIM directory tools defined by your Truto configuration.

Hero Tools for Navan SCIM Directory Access

When ChatGPT issues a tools/list request, Truto dynamically parses the Navan SCIM documentation schemas and returns heavily annotated JSON-RPC tool definitions.

Because Truto flattens the input namespace, ChatGPT passes query parameters (like filters) and path parameters (like IDs) in a single unified JSON object. Truto's proxy layer automatically routes these parameters to their correct locations in the outbound HTTP request to Navan.

Here are the critical hero tools your agent will use to orchestrate Navan SCIM workflows.

list_all_navan_scim_users

This is the workhorse tool for querying the enterprise directory. It allows the LLM to search for users based on emails, names, active status, or cost centers using SCIM 2.0 filter syntax. Truto automatically injects pagination hints into the schema (like startIndex and count) so ChatGPT understands how to traverse large corporate directories.

Because Navan SCIM responses can contain extensive enterprise extension data, this tool is typically used to locate a user's primary SCIM ID before pulling their full detailed profile.

"Search the Navan directory for any user with the email 'alex.chen@acmecorp.com'. Use the SCIM filter parameter to narrow the search, and tell me if their account is marked as active."

get_single_navan_scim_user_by_id

Once ChatGPT has identified a user's SCIM ID, it uses this tool to retrieve the absolute, unmodified user resource. This is vital for deep audits, as list endpoints sometimes truncate deeply nested schema extensions for performance reasons.

By fetching the single user, the LLM gains access to the complete urn:ietf:params:scim:schemas:extension:enterprise:2.0:User payload, allowing it to verify specific line-manager assignments, employee numbers, and department cost centers used for Navan travel approvals.

"Fetch the full Navan SCIM profile for user ID '2819c223-534c-4caa-9871-332309192415'. I need you to parse the enterprise extension data and tell me exactly who is listed as this employee's manager."

For a complete list of available operations, including the schemas required for updating or deprovisioning users, view the full inventory on the Navan SCIM integration page.

Workflows in Action

Connecting Navan SCIM to ChatGPT unlocks the ability to perform complex IT and HR audits purely through natural language. Here is how specific personas execute workflows using the auto-generated MCP tools.

Workflow 1: IT Support User Audit

IT administrators frequently need to verify if an employee's identity changes in Okta or Azure AD have successfully propagated to downstream systems like Navan.

"A user reported they cannot log into Navan to book travel. Check if 'sarah.jenkins@acmecorp.com' exists in the Navan SCIM directory. If she does, pull her full profile and verify her active status and assigned cost center."

1. ChatGPT calls list_all_navan_scim_users passing {"filter": "userName eq 'sarah.jenkins@acmecorp.com'"}.
2. Truto proxies the request to Navan and returns the SCIM list response. ChatGPT parses the output and identifies Sarah's unique SCIM ID.
3. ChatGPT calls get_single_navan_scim_user_by_id passing {"id": "sarah_scim_id_123"}.
4. ChatGPT reads the nested JSON response, identifies the active boolean, and extracts the cost center from the enterprise extension node.
5. The LLM replies to the IT admin: "Sarah Jenkins exists in Navan, but her account is currently marked as inactive (active: false). Her cost center is assigned as 'MKTG-400'."

Workflow 2: HR Directory Sync Validation

HR teams or system integration engineers need to ensure that organizational hierarchy changes are reflecting correctly across all enterprise tools, including travel platforms.

"We recently moved the Engineering department to a new cost center. Query the Navan SCIM directory for users in the Engineering department. Page through the results if necessary, and list any active users who still have the old cost center 'ENG-100'."

1. ChatGPT calls list_all_navan_scim_users passing {"filter": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department eq 'Engineering' and active eq true", "count": 50, "startIndex": 1}.
2. Truto routes the request. ChatGPT evaluates the response and extracts the users matching the criteria.
3. If totalResults exceeds 50, ChatGPT calls list_all_navan_scim_users again with {"startIndex": 51}.
4. ChatGPT processes the combined dataset, parsing the cost center fields.
5. The LLM outputs a formatted table of any active engineering users still assigned to the legacy cost center.

sequenceDiagram
    participant User as ChatGPT User
    participant LLM as ChatGPT
    participant MCP as Truto MCP Server
    participant Upstream as "Upstream API (Navan)"
    
    User->>LLM: "Find active engineers with cost center ENG-100"
    
    rect rgb(235, 232, 226)
    Note over LLM,Upstream: SCIM Directory Lookup
    LLM->>MCP: Call list_all_navan_scim_users (filter: department eq Engineering)
    MCP->>Upstream: GET /Users?filter=...&startIndex=1&count=50
    Upstream-->>MCP: HTTP
    end```

## Security and Access Control

Exposing an enterprise directory to an LLM requires strict governance. Truto's MCP tokens execute against an isolated `mcp_token` database record, allowing you to heavily restrict what the AI agent can do.

*   **Method Filtering (`config.methods`):** By defining `["read"]` during token creation, you guarantee the MCP server will only ever expose `list` and `get` operations. The LLM physically cannot access write operations like `create`, `update`, or `delete`.
*   **Tag Filtering (`config.tags`):** If Navan SCIM had multiple distinct resource groupings, you could restrict the server to only tools tagged with `users`, ignoring groups or schema discovery endpoints.
*   **Secondary Authentication (`require_api_token_auth`):** For [zero-trust environments](/zero-data-retention-mcp-servers-building-soc-2-gdpr-compliant-ai-agents/), setting this to `true` deploys conditional middleware. Possession of the MCP URL is no longer enough; the client must also inject a valid Truto API token in the `Authorization` header on every JSON-RPC request.
*   **Automated Token Expiration (`expires_at`):** You can generate ephemeral MCP servers by passing a TTL timestamp. Truto utilizes distributed scheduling primitives to automatically terminate edge storage and database records at the exact second of expiration, ensuring contractor or temporary LLM access is instantly revoked.

## Moving Faster with Managed MCP Infrastructure

The SCIM protocol is powerful but unforgiving. Forcing an LLM to blindly navigate complex filter syntax, handle HTTP 429 rate limit backoffs, and parse deeply nested extension objects without a dedicated translation layer will result in continuous hallucinations and broken agent workflows.

By leveraging Truto to generate a documentation-driven Navan SCIM MCP server, you offload the entire infrastructure burden. Truto flattens the input schemas, standardizes the API operations, and handles the JSON-RPC lifecycle securely at the edge. Your engineers can focus on building sophisticated directory auditing workflows, while Truto ensures the LLM always has the exact context it needs to interact with Navan successfully.