---
title: "Connect Navan to Claude: Lookup User Directory and Account Data"
slug: connect-navan-to-claude-lookup-user-directory-and-account-data
date: 2026-09-16
author: Sidharth Verma
categories: ["AI & Agents"]
excerpt: A technical guide to connecting Navan to Claude via an MCP server. Bypass Navan's 403 entitlement traps and automate SCIM user directory workflows.
tldr: "Learn how to build a managed MCP server to connect Navan to Claude. We cover bypassing Navan API entitlement traps using SCIM, handling HTTP 429 rate limits natively, and executing multi-step workflows."
canonical: https://truto.one/blog/connect-navan-to-claude-lookup-user-directory-and-account-data/
---

# Connect Navan to Claude: Lookup User Directory and Account Data


If your team needs to connect Navan to Claude to automate user provisioning, audit cost center assignments, or manage traveler profiles, you need a [Model Context Protocol (MCP) server](https://truto.one/what-is-mcp-and-mcp-servers-and-how-do-they-work/). This server acts as the translation layer between Claude's function calling capabilities and Navan's REST APIs. You can either [build, host, and maintain this infrastructure yourself](https://truto.one/how-to-build-mcp-servers-for-ai-agents-2026-hands-on-architecture-guide/), or use a [managed integration platform](https://truto.one/managed-mcp-for-claude-full-saas-api-access-without-security-headaches/) like Truto to dynamically generate a secure, authenticated MCP server URL. 

If your team uses ChatGPT instead of Claude, check out our guide on [connecting Navan to ChatGPT](https://truto.one/connect-navan-to-chatgpt-manage-traveler-profiles-and-accounts/). For a broader architectural overview of agentic workflows, explore our guide on [connecting Navan to AI Agents](https://truto.one/connect-navan-to-ai-agents-access-traveler-identity-and-profiles/).

Giving a Large Language Model (LLM) read and write access to your corporate travel and expense management platform is a significant engineering challenge. You have to handle fragmented API authentication scopes, parse complex SCIM schemas into MCP tool definitions, and deal with strict API rate limits. Every time Navan updates an endpoint or changes a schema definition, you have to update your custom integration code.

This guide breaks down exactly how to use Truto's SuperAI to generate a secure, managed MCP server for Navan, connect it natively to Claude Desktop, and execute complex user directory workflows using natural language.

> Want to give your AI agents secure, authenticated access to Navan and 100+ other SaaS APIs? Let's talk about [managed MCP architecture](https://truto.one/managed-mcp-for-claude-full-saas-api-access-without-security-headaches/).
>
> [Talk to us](https://truto.one/book-a-demo/)

## The Engineering Reality of the Navan API

A [custom MCP server](https://truto.one/how-to-build-mcp-servers-for-ai-agents-2026-hands-on-architecture-guide/) is essentially a self-hosted integration layer. While the open MCP standard provides a predictable way for models like Claude to discover tools, the reality of implementing it against Navan's API is painful. 

If you decide to build a custom Navan MCP server in-house, here are the specific integration challenges you will face:

**The 403 Entitlement Trap and the SCIM API**
Navan gates its standard user directory endpoints behind specific partner or Travel Management Company (TMC) entitlements. If you generate self-serve Navan API credentials from *Travel > Settings > Integrations* and attempt to hit the standard `/users` endpoints, you will receive a blanket HTTP 403 Forbidden error. To programmatically lookup and manage the user directory, you must actually connect via the **Navan SCIM integration** (`navanscim`). Your MCP server must be smart enough to route user management tools to the SCIM standard endpoints rather than the standard Navan travel API. 

**Strict SCIM Schema Validation**
Because Navan's user management relies heavily on SCIM 2.0 (`urn:ietf:params:scim:schemas:core:2.0:User`), payloads are deeply nested and strictly validated. An LLM cannot simply guess the JSON structure to update a user's cost center or manager. The LLM must be fed an exact, validated JSON Schema for the payload, otherwise Navan will reject the request with opaque 400 Bad Request errors. A managed MCP server parses these schemas dynamically from API documentation and translates them into rigid MCP tool definitions.

**Rate Limiting and IETF Headers**
Navan enforces strict rate limits on directory sync operations to protect infrastructure. If you slam the API with concurrent agentic loops, you will hit a wall. *Note: Truto does not automatically retry, throttle, or absorb rate limit errors.* When the upstream Navan API returns an HTTP 429 (Too Many Requests), Truto passes that error directly back to the caller. Truto normalizes the upstream rate limit information into standardized headers (`ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset`) per the IETF specification. Your agent framework is responsible for parsing these headers and applying its own backoff logic.

```mermaid
sequenceDiagram
    participant Claude as Claude Desktop
    participant Truto as Truto MCP Router
    participant Navan as Navan SCIM API

    Claude->>Truto: Call list_all_navan_scim_users
    Truto->>Navan: GET /scim/v2/Users
    Navan-->>Truto: HTTP 429 Too Many Requests
    Truto-->>Claude: JSON-RPC Error (HTTP 429) + IETF Headers
    Note over Claude,Truto: Agent logic must parse<br>ratelimit-reset and<br>apply backoff.
```

## How to Create the Navan MCP Server

Truto scopes every MCP server to a single integrated account. This means the resulting MCP server URL contains a cryptographically hashed token that inherently knows which Navan tenant it is speaking to. You do not need to manage API keys or OAuth tokens on the client side.

You can generate this server via the Truto UI or programmatically via the API.

### Method 1: Via the Truto UI

For internal tooling and manual agent testing, the easiest path is the Truto interface.

1. Log into your Truto account and navigate to the integrated account page for your Navan SCIM connection.
2. Click the **MCP Servers** tab.
3. Click **Create MCP Server**.
4. Select your desired configuration (e.g., restrict to `read` methods only, or set an automatic expiration date).
5. Click Create and **copy the generated MCP server URL**. It will look something like `https://api.truto.one/mcp/a1b2c3d4e5f6...`.

### Method 2: Via the Truto API

If you are building an application that spins up AI agents on behalf of your customers, you must provision MCP servers programmatically.

Make an authenticated `POST` request to the `/integrated-account/:id/mcp` endpoint:

```bash
curl -X POST https://api.truto.one/integrated-account/YOUR_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Navan Directory AI Agent",
    "config": {
      "methods": ["read", "write"]
    }
  }'
```

The API provisions the secure routing layer and returns the server metadata:

```json
{
  "id": "mcp_srv_9x8y7z",
  "name": "Navan Directory AI Agent",
  "config": { "methods": ["read", "write"] },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890"
}
```

Pass this `url` directly to your Claude client.

## How to Connect the MCP Server to Claude

Once you have your Truto MCP server URL, connecting it to Claude requires zero additional code. 

### Method 1: Via the Claude UI

If your organization uses the enterprise or pro tiers of Claude or ChatGPT with custom connector support:

1. In Claude, navigate to **Settings -> Integrations -> Add MCP Server** (or in ChatGPT: Settings -> Connectors -> Add).
2. Give the connector a name (e.g., "Navan SCIM Directory").
3. Paste the Truto MCP URL into the Server URL field.
4. Click **Add**.

Claude will immediately execute an MCP `initialize` handshake, request the `tools/list`, and dynamically load all available Navan operations into its context window.

### Method 2: Via Manual Configuration File

If you are using Claude Desktop locally for development, you can connect the server by modifying your `claude_desktop_config.json` file. Because Truto MCP servers speak JSON-RPC over Server-Sent Events (SSE), you will use the official MCP SSE transport module.

Add the following to your configuration file (usually located at `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):

```json
{
  "mcpServers": {
    "navan-scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f67890"
      ]
    }
  }
}
```

Restart Claude Desktop. The Navan SCIM tools will now be available in your prompt interface.

## Hero Tools for Navan SCIM Directory

Truto automatically derives tool definitions from the underlying integration's REST resources. By connecting the Navan SCIM integration, Claude gains access to the fully compliant user directory endpoints. Here are the highest-leverage tools available for this integration.

### list_all_navan_scim_users

Retrieves a paginated list of all provisioned users in the Navan tenant. This is the foundational tool for building employee directories, auditing active travelers, and verifying cost center alignments.

> "Fetch a list of all active users in our Navan account. Filter the results to only show users who belong to the Engineering department and output their names, emails, and manager IDs in a markdown table."

### get_single_navan_scim_user_by_id

Fetches the complete SCIM profile for a specific user based on their unique Navan SCIM ID. This payload includes nested data like schemas, active status, roles, and enterprise extensions.

> "Look up the user profile for the Navan user with ID 'usr_8239abc'. Tell me if their account is currently active, what cost center they are assigned to, and who their designated approver is."

### create_a_navan_scim_user

Provisions a new employee in Navan. The tool strictly enforces the SCIM 2.0 schema requirements, meaning the LLM must provide the correct `schemas` array, `userName` (email), and `name` object to successfully create the record.

> "We just hired Sarah Jenkins as a Senior Developer in the Engineering group. Provision a new Navan account for her using her email sarah.j@example.com. Ensure she is marked as active and assign her to the standard travel policy."

### update_a_navan_scim_user_by_id

Applies a partial update (PATCH) to an existing user's profile. This tool is critical for handling organizational changes, such as department transfers, manager reassignments, or offboarding (setting `active: false`).

> "The user with ID 'usr_1092xyz' has transferred to the Marketing department. Update their Navan profile to reflect the new department name, and change their active cost center to 'MKT-2024'."

### list_all_navan_scim_groups

Retrieves the list of SCIM groups within Navan. Groups are typically mapped to cost centers, departments, or travel policy tiers. This tool is used to map user identities to financial reporting categories.

> "List all available SCIM groups in our Navan account. Identify which group corresponds to the 'Executive Travel' tier and give me its exact group ID so we can assign new VPs to it."

To view the complete inventory of available endpoints and their exact JSON schema definitions, visit the [Navan integration page](https://truto.one/integrations/detail/navan).

## Workflows in Action

Individual tools are useful, but MCP's real power unlocks when Claude strings multiple operations together to execute multi-step workflows. 

### 1. The Cost Center Audit Workflow

IT and Finance teams frequently need to audit travel accounts to ensure departing employees or restructured teams are assigned to valid cost centers.

> "Audit our Navan directory. Find any active users who are currently unassigned to a cost center or belong to the deprecated 'Sales-2023' group. Generate a summary report of these users and suggest the correct group based on their job title."

1. Claude calls `list_all_navan_scim_groups` to find the ID for the deprecated group.
2. Claude calls `list_all_navan_scim_users` (potentially paginating through results) to pull the employee roster.
3. Claude correlates the user data against the group assignments.
4. Claude outputs a structured summary report directly in the chat window.

### 2. The Employee Offboarding Sequence

When an employee leaves the company, revoking access to travel booking and corporate cards must happen immediately to prevent rogue spend.

> "Initiate offboarding for Michael Scott (michael.s@example.com). Find his Navan user record, disable his account, and verify that he has been removed from the 'Management' SCIM group."

1. Claude calls `list_all_navan_scim_users` with a search filter for the provided email address to retrieve the user's SCIM ID.
2. Claude calls `update_a_navan_scim_user_by_id` and passes a SCIM PATCH payload setting `active: false`.
3. Claude calls `get_single_navan_scim_user_by_id` to confirm the payload was accepted and the account status reads as disabled.
4. Claude informs the IT admin that the offboarding task is complete.

## Security and Access Control

Providing an LLM with write access to your corporate travel directory requires stringent security boundaries. Truto provides four distinct configuration layers to lock down your MCP servers at the token level:

*   **Method filtering:** You can enforce read-only access by configuring the MCP server with `config: { methods: ["read"] }`. This completely removes `create`, `update`, and `delete` tools from the server payload, physically preventing the LLM from making state changes.
*   **Tag filtering:** Integrations use tags to group related resources. You can configure a server to only expose tools tagged with `directory`, ensuring the LLM cannot access unrelated financial endpoints.
*   **Extra authentication (`require_api_token_auth`):** By default, possessing the Truto MCP URL grants access to the tools. If you set `require_api_token_auth: true`, the client must also pass a valid Truto API token in the `Authorization` header, enforcing a secondary layer of authentication.
*   **Automatic expiration (`expires_at`):** You can set an ISO datetime for the server to expire. Truto utilizes Cloudflare KV expirations and Durable Object alarms to physically destroy the MCP token when time is up, making it ideal for temporary contractor access or ephemeral CI/CD agents.

## Final Thoughts

Building an AI agent that can reliably parse the Navan SCIM API is an exercise in schema validation and token management. By utilizing an MCP architecture backed by a unified integration platform, you eliminate the need to write custom REST wrappers, manage complex OAuth lifecycles, or manually maintain SCIM schemas.

Your engineers can focus on prompt engineering and agent orchestration, while the MCP server handles the translation between natural language intent and strict enterprise API requirements. 

> Ready to connect your AI agents to Navan and 100+ other SaaS APIs? Let's talk about managed MCP architecture.
>
> [Talk to us](https://truto.one/book-a-demo/)