Connect Navan to Claude: Lookup User Directory and Account Data

If your team needs to connect Navan to Claude to automate user provisioning, audit cost center assignments, or manage traveler profiles, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's function calling capabilities and Navan's REST APIs. You can either build, host, and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses ChatGPT instead of Claude, check out our guide on connecting Navan to ChatGPT. For a broader architectural overview of agentic workflows, explore our guide on connecting Navan to AI Agents.

Giving a Large Language Model (LLM) read and write access to your corporate travel and expense management platform is a significant engineering challenge. You have to handle fragmented API authentication scopes, parse complex SCIM schemas into MCP tool definitions, and deal with strict API rate limits. Every time Navan updates an endpoint or changes a schema definition, you have to update your custom integration code.

This guide breaks down exactly how to use Truto's SuperAI to generate a secure, managed MCP server for Navan, connect it natively to Claude Desktop, and execute complex user directory workflows using natural language.

The Engineering Reality of the Navan API

A custom MCP server is essentially a self-hosted integration layer. While the open MCP standard provides a predictable way for models like Claude to discover tools, the reality of implementing it against Navan's API is painful.

If you decide to build a custom Navan MCP server in-house, here are the specific integration challenges you will face:

The 403 Entitlement Trap and the SCIM API Navan gates its standard user directory endpoints behind specific partner or Travel Management Company (TMC) entitlements. If you generate self-serve Navan API credentials from Travel > Settings > Integrations and attempt to hit the standard /users endpoints, you will receive a blanket HTTP 403 Forbidden error. To programmatically lookup and manage the user directory, you must actually connect via the Navan SCIM integration (navanscim). Your MCP server must be smart enough to route user management tools to the SCIM standard endpoints rather than the standard Navan travel API.

Strict SCIM Schema Validation Because Navan's user management relies heavily on SCIM 2.0 (urn:ietf:params:scim:schemas:core:2.0:User), payloads are deeply nested and strictly validated. An LLM cannot simply guess the JSON structure to update a user's cost center or manager. The LLM must be fed an exact, validated JSON Schema for the payload, otherwise Navan will reject the request with opaque 400 Bad Request errors. A managed MCP server parses these schemas dynamically from API documentation and translates them into rigid MCP tool definitions.

Rate Limiting and IETF Headers Navan enforces strict rate limits on directory sync operations to protect infrastructure. If you slam the API with concurrent agentic loops, you will hit a wall. Note: Truto does not automatically retry, throttle, or absorb rate limit errors. When the upstream Navan API returns an HTTP 429 (Too Many Requests), Truto passes that error directly back to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. Your agent framework is responsible for parsing these headers and applying its own backoff logic.

sequenceDiagram
    participant Claude as Claude Desktop
    participant Truto as Truto MCP Router
    participant Navan as Navan SCIM API

    Claude->>Truto: Call list_all_navan_scim_users
    Truto->>Navan: GET /scim/v2/Users
    Navan-->>Truto: HTTP 429 Too Many Requests
    Truto-->>Claude: JSON-RPC Error (HTTP 429) + IETF Headers
    Note over Claude,Truto: Agent logic must parse<br>ratelimit-reset and<br>apply backoff.

How to Create the Navan MCP Server

Truto scopes every MCP server to a single integrated account. This means the resulting MCP server URL contains a cryptographically hashed token that inherently knows which Navan tenant it is speaking to. You do not need to manage API keys or OAuth tokens on the client side.

You can generate this server via the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

For internal tooling and manual agent testing, the easiest path is the Truto interface.

1. Log into your Truto account and navigate to the integrated account page for your Navan SCIM connection.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (e.g., restrict to read methods only, or set an automatic expiration date).
5. Click Create and copy the generated MCP server URL. It will look something like https://api.truto.one/mcp/a1b2c3d4e5f6....

Method 2: Via the Truto API

If you are building an application that spins up AI agents on behalf of your customers, you must provision MCP servers programmatically.

Make an authenticated POST request to the /integrated-account/:id/mcp endpoint:

curl -X POST https://api.truto.one/integrated-account/YOUR_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Navan Directory AI Agent",
    "config": {
      "methods": ["read", "write"]
    }
  }'

The API provisions the secure routing layer and returns the server metadata:

{
  "id": "mcp_srv_9x8y7z",
  "name": "Navan Directory AI Agent",
  "config": { "methods": ["read", "write"] },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890"
}

Pass this url directly to your Claude client.

How to Connect the MCP Server to Claude

Once you have your Truto MCP server URL, connecting it to Claude requires zero additional code.

Method 1: Via the Claude UI

If your organization uses the enterprise or pro tiers of Claude or ChatGPT with custom connector support:

1. In Claude, navigate to Settings -> Integrations -> Add MCP Server (or in ChatGPT: Settings -> Connectors -> Add).
2. Give the connector a name (e.g., "Navan SCIM Directory").
3. Paste the Truto MCP URL into the Server URL field.
4. Click Add.

Claude will immediately execute an MCP initialize handshake, request the tools/list, and dynamically load all available Navan operations into its context window.

Method 2: Via Manual Configuration File

If you are using Claude Desktop locally for development, you can connect the server by modifying your claude_desktop_config.json file. Because Truto MCP servers speak JSON-RPC over Server-Sent Events (SSE), you will use the official MCP SSE transport module.

Add the following to your configuration file (usually located at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
  "mcpServers": {
    "navan-scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f67890"
      ]
    }
  }
}

Restart Claude Desktop. The Navan SCIM tools will now be available in your prompt interface.

Hero Tools for Navan SCIM Directory

Truto automatically derives tool definitions from the underlying integration's REST resources. By connecting the Navan SCIM integration, Claude gains access to the fully compliant user directory endpoints. Here are the highest-leverage tools available for this integration.

list_all_navan_scim_users

Retrieves a paginated list of all provisioned users in the Navan tenant. This is the foundational tool for building employee directories, auditing active travelers, and verifying cost center alignments.

"Fetch a list of all active users in our Navan account. Filter the results to only show users who belong to the Engineering department and output their names, emails, and manager IDs in a markdown table."

get_single_navan_scim_user_by_id

Fetches the complete SCIM profile for a specific user based on their unique Navan SCIM ID. This payload includes nested data like schemas, active status, roles, and enterprise extensions.

"Look up the user profile for the Navan user with ID 'usr_8239abc'. Tell me if their account is currently active, what cost center they are assigned to, and who their designated approver is."

create_a_navan_scim_user

Provisions a new employee in Navan. The tool strictly enforces the SCIM 2.0 schema requirements, meaning the LLM must provide the correct schemas array, userName (email), and name object to successfully create the record.

"We just hired Sarah Jenkins as a Senior Developer in the Engineering group. Provision a new Navan account for her using her email sarah.j@example.com. Ensure she is marked as active and assign her to the standard travel policy."

update_a_navan_scim_user_by_id

Applies a partial update (PATCH) to an existing user's profile. This tool is critical for handling organizational changes, such as department transfers, manager reassignments, or offboarding (setting active: false).

"The user with ID 'usr_1092xyz' has transferred to the Marketing department. Update their Navan profile to reflect the new department name, and change their active cost center to 'MKT-2024'."

list_all_navan_scim_groups

Retrieves the list of SCIM groups within Navan. Groups are typically mapped to cost centers, departments, or travel policy tiers. This tool is used to map user identities to financial reporting categories.

"List all available SCIM groups in our Navan account. Identify which group corresponds to the 'Executive Travel' tier and give me its exact group ID so we can assign new VPs to it."

To view the complete inventory of available endpoints and their exact JSON schema definitions, visit the Navan integration page.

Workflows in Action

Individual tools are useful, but MCP's real power unlocks when Claude strings multiple operations together to execute multi-step workflows.

1. The Cost Center Audit Workflow

IT and Finance teams frequently need to audit travel accounts to ensure departing employees or restructured teams are assigned to valid cost centers.

"Audit our Navan directory. Find any active users who are currently unassigned to a cost center or belong to the deprecated 'Sales-2023' group. Generate a summary report of these users and suggest the correct group based on their job title."

1. Claude calls list_all_navan_scim_groups to find the ID for the deprecated group.
2. Claude calls list_all_navan_scim_users (potentially paginating through results) to pull the employee roster.
3. Claude correlates the user data against the group assignments.
4. Claude outputs a structured summary report directly in the chat window.

2. The Employee Offboarding Sequence

When an employee leaves the company, revoking access to travel booking and corporate cards must happen immediately to prevent rogue spend.

"Initiate offboarding for Michael Scott (michael.s@example.com). Find his Navan user record, disable his account, and verify that he has been removed from the 'Management' SCIM group."

1. Claude calls list_all_navan_scim_users with a search filter for the provided email address to retrieve the user's SCIM ID.
2. Claude calls update_a_navan_scim_user_by_id and passes a SCIM PATCH payload setting active: false.
3. Claude calls get_single_navan_scim_user_by_id to confirm the payload was accepted and the account status reads as disabled.
4. Claude informs the IT admin that the offboarding task is complete.

Security and Access Control

Providing an LLM with write access to your corporate travel directory requires stringent security boundaries. Truto provides four distinct configuration layers to lock down your MCP servers at the token level:

• Method filtering: You can enforce read-only access by configuring the MCP server with config: { methods: ["read"] }. This completely removes create, update, and delete tools from the server payload, physically preventing the LLM from making state changes.
• Tag filtering: Integrations use tags to group related resources. You can configure a server to only expose tools tagged with directory, ensuring the LLM cannot access unrelated financial endpoints.
• Extra authentication (require_api_token_auth): By default, possessing the Truto MCP URL grants access to the tools. If you set require_api_token_auth: true, the client must also pass a valid Truto API token in the Authorization header, enforcing a secondary layer of authentication.
• Automatic expiration (expires_at): You can set an ISO datetime for the server to expire. Truto utilizes Cloudflare KV expirations and Durable Object alarms to physically destroy the MCP token when time is up, making it ideal for temporary contractor access or ephemeral CI/CD agents.

Final Thoughts

Building an AI agent that can reliably parse the Navan SCIM API is an exercise in schema validation and token management. By utilizing an MCP architecture backed by a unified integration platform, you eliminate the need to write custom REST wrappers, manage complex OAuth lifecycles, or manually maintain SCIM schemas.

Your engineers can focus on prompt engineering and agent orchestration, while the MCP server handles the translation between natural language intent and strict enterprise API requirements.