Connect ServiceNow SCIM to ChatGPT: Manage Identity and Group Sync

If you need to connect ServiceNow SCIM to ChatGPT to automate user provisioning, orchestrate identity lifecycles, or manage complex group synchronization, you need a Model Context Protocol (MCP) server. This server acts as the critical translation layer between ChatGPT's function calling capabilities and ServiceNow's strict SCIM 2.0 implementation. You can either spend weeks building and maintaining this custom middleware, or use a managed infrastructure layer like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting ServiceNow SCIM to Claude or explore our broader architectural overview on connecting ServiceNow SCIM to AI Agents.

Giving a Large Language Model (LLM) read and write access to enterprise identity infrastructure is an unforgiving engineering challenge. You have to handle rigid RFC 7644 PATCH operations, parse custom ServiceNow schema URNs, and manage complex filter queries. Every time ServiceNow adds a custom field to the sys_user table, your custom server code must be updated, redeployed, and tested to ensure the LLM can see the new schema.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for ServiceNow SCIM, connect it natively to ChatGPT, and execute zero-touch identity workflows using natural language.

The Engineering Reality of the ServiceNow SCIM API

Building a custom MCP server means you own the entire API lifecycle and all of its edge cases. The open MCP standard provides a predictable JSON-RPC interface for the LLM, but translating that into valid ServiceNow SCIM requests is highly complex. Here are the specific integration challenges that break standard REST assumptions when working with ServiceNow SCIM.

The Complexity of RFC 7644 PatchOps

ServiceNow does not accept standard flat JSON payloads for partial updates. Updating a user's department or removing them from a group requires a strict SCIM PatchOp array consisting of add, remove, or replace operations targeted at specific attribute paths. LLMs are notoriously bad at spontaneously generating deeply nested, path-based JSON structures. Your MCP server must provide exact, rigorous JSON Schemas that force the model to construct the payload perfectly, otherwise ServiceNow will reject the request with a 400 Bad Request.

Custom Schema Extension URNs

Standard SCIM 2.0 covers basic fields like userName, name.givenName, and emails. However, ServiceNow identity records rely heavily on custom extensions mapped to their internal tables (like Company, CostCenter, and Department). These are accessed using long URNs such as urn:ietf:params:scim:schemas:custom:servicenow:2.0:User. If an LLM needs to query a custom department code, your MCP server must dynamically fetch the ServiceNow instance's schema definitions and inject these exact URNs into the tool descriptions. If you skip this, the LLM will hallucinate invalid field names and the queries will fail.

Strict Rate Limits and the IETF Spec

When building high-volume automation, you will hit ServiceNow's API rate limits. It is critical to understand that Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream ServiceNow API returns an HTTP 429, Truto passes that error directly to the caller. However, Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. The client orchestrating the AI agent is strictly responsible for inspecting these headers and implementing its own retry and backoff logic.

Step 1: Generate a ServiceNow SCIM MCP Server

Truto automatically generates MCP tools dynamically from the integration's OpenAPI specifications and documentation records. You can spin up a dedicated MCP server scoped entirely to a single ServiceNow tenant in two ways.

Method A: Via the Truto UI

This is the fastest approach for manual testing and prompt engineering.

1. Navigate to the Integrated Accounts page in your Truto dashboard and select your connected ServiceNow SCIM account.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (e.g., allow read and write methods, or restrict to specific tags like users and groups).
5. Click Save and copy the generated MCP server URL. It will look like https://api.truto.one/mcp/a1b2c3d4....

Method B: Via the Truto API

For production architectures, you should generate these servers programmatically. Make a POST request to the /integrated-account/:id/mcp endpoint using your Truto API token.

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ServiceNow SCIM Provisioning Server",
    "config": {
      "methods": ["read", "write"],
      "tags": ["users", "groups"]
    }
  }'

The response returns a database record containing the url. This single URL handles routing and token validation. Treat it like a secret.

Step 2: Connect the MCP Server to ChatGPT

Once you have the Truto MCP URL, you must register it with your ChatGPT environment. You can do this through the UI or via a configuration file for local development.

Method A: Via the ChatGPT UI

If you are using ChatGPT Pro, Plus, Business, Enterprise, or Education accounts with Developer mode enabled:

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Ensure Developer mode is toggled on.
3. Under MCP servers / Custom connectors, click Add new server.
4. Provide a recognizable name (e.g., "ServiceNow IT Identity").
5. Paste the Truto MCP URL into the Server URL field.
6. Click Save. ChatGPT will immediately ping the server, perform the initialization handshake, and load the available SCIM tools.

Method B: Via Manual Config File

If you are running a local testing environment, desktop client, or custom agent framework that utilizes the official MCP SDK, you can map the URL using the Server-Sent Events (SSE) transport configuration.

Create an mcp_config.json file:

{
  "mcpServers": {
    "servicenow_scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/YOUR_TRUTO_TOKEN"
      ]
    }
  }
}

Restart your local client, and it will bind to the remote Truto server.

ServiceNow SCIM Hero Tools

Truto automatically maps the ServiceNow SCIM endpoints into JSON-RPC tools with strictly enforced schemas. Here are the highest-leverage tools available for your AI agent.

1. list_all_service_now_scim_users

Queries the User (sys_user) table. This tool supports complex RFC 7644 filter expressions (e.g., userName eq "jdoe") and attribute selection. It handles ServiceNow's specific SCIM pagination under the hood.

"Find the ServiceNow SCIM user record for email 'sarah.connor@example.com' and return their internal sys_id and active status."

2. create_a_service_now_scim_user

Provisions a new user directly into the sys_user table. The AI is prompted via the tool's body_schema to supply the required SCIM core attributes and any environment-specific extension URNs.

"Create a new ServiceNow SCIM user for John Smith. Set his userName to jsmith, active to true, and use jsmith@company.com for his primary email."

3. service_now_scim_users_partial_update

This is the critical PatchOp tool. It modifies specific fields of a user record by ID using a SCIM Patch array. The AI is instructed how to build valid add, remove, and replace operations.

"Update the ServiceNow SCIM user record for sys_id '8d7f...' by replacing their title with 'Senior Engineer' using a SCIM PatchOp."

4. create_a_service_now_scim_group

Creates a new record in the Group (sys_user_group) table. This allows the AI to programmatically spin up new access control groups or department groupings on the fly.

"Create a new ServiceNow SCIM group called 'Cloud Infrastructure Admins' and give it a description indicating it grants AWS production access."

5. service_now_scim_groups_patch

Adds, updates, or removes members from a group. When an AI needs to provision access for a new hire, it uses this tool to inject the user's sys_id into the group's members array via a PatchOp.

"Add user sys_id '8d7f...' to the ServiceNow SCIM group sys_id 'b92a...' by executing a SCIM PatchOp to add a new member."

6. get_single_service_now_scim_schema_by_id

Retrieves the exact schema definition for a given URN. The AI uses this tool to dynamically discover the required data types and custom fields required for a specific ServiceNow tenant before attempting an insert.

"Fetch the SCIM schema definition for urn:ietf:params:scim:schemas:custom:servicenow:2.0:Department so we can see which attributes are required to link a user to a cost center."

To view the complete inventory of tools and their JSON schemas, visit the ServiceNow SCIM integration page.

Workflows in Action

Connecting tools to ChatGPT is only step one. The real power unlocks when ChatGPT orchestrates multi-step IT workflows autonomously.

Scenario 1: Zero-Touch Employee Onboarding

When HR creates a ticket for a new hire, IT admins can simply ask ChatGPT to handle the provisioning logic.

"We have a new hire starting Monday: Alex Vance, Software Engineer. Please create her ServiceNow user account, find the 'Engineering Access' group, and add her to it."

1. create_a_service_now_scim_user: ChatGPT constructs the SCIM JSON payload, setting the userName to avance, setting active to true, and filling out the display names.
2. list_all_service_now_scim_groups: ChatGPT queries the groups endpoint with a filter expression displayName eq "Engineering Access" to retrieve the group's sys_id.
3. service_now_scim_groups_patch: ChatGPT executes a PATCH request against the group, generating an add operation that appends Alex's new user id to the members array.

The IT admin receives a confirmation message containing the new user's sys_id and verification that group membership was successfully applied.

sequenceDiagram
    participant Admin as IT Admin
    participant ChatGPT as ChatGPT
    participant Truto as Truto MCP
    participant SNOW as ServiceNow SCIM

    Admin->>ChatGPT: Provision new hire Alex Vance
    ChatGPT->>Truto: Call create_a_service_now_scim_user
    Truto->>SNOW: POST /scim/v2/Users
    SNOW-->>Truto: 201 Created (ID: abc-123)
    Truto-->>ChatGPT: Return new User ID
    ChatGPT->>Truto: Call list_all_service_now_scim_groups (filter: Engineering)
    Truto->>SNOW: GET /scim/v2/Groups?filter=displayName eq "Engineering"
    SNOW-->>Truto: 200 OK (Group ID: def-456)
    Truto-->>ChatGPT: Return Group ID
    ChatGPT->>Truto: Call service_now_scim_groups_patch (Add member abc-123)
    Truto->>SNOW: PATCH /scim/v2/Groups/def-456
    SNOW-->>Truto: 200 OK
    Truto-->>ChatGPT: Return success
    ChatGPT->>Admin: Provisioning complete.

Scenario 2: Automated Offboarding and Revocation

Security incidents require immediate offboarding. Instead of clicking through the ServiceNow UI, an admin can issue a single command to sever access.

"David Bowman is leaving the company immediately. Find his SCIM record by email dbowman@example.com and disable his account."

1. list_all_service_now_scim_users: ChatGPT queries the user database with the filter emails.value eq "dbowman@example.com".
2. service_now_scim_users_partial_update: ChatGPT isolates the user's sys_id and constructs a SCIM replace PatchOp, explicitly setting the active attribute to false.
3. get_single_service_now_scim_user_by_id: ChatGPT performs a final read to audit the user object, confirming the active flag is false and reviewing any persistent group memberships that might require manual cleanup.

Security and Access Control

Exposing your enterprise ServiceNow SCIM API to an LLM requires rigorous governance. Truto's MCP servers are designed with strict access boundaries enforced at the infrastructure level.

• Method Filtering: You can configure the MCP token (config.methods: ["read"]) to drop all mutation tools (create, update, delete, patch). If ChatGPT attempts an update, the tool simply will not exist in the client payload.
• Tag Filtering: By passing config.tags: ["users"], you can prevent the LLM from discovering tools related to groups, locations, or cost_centers, heavily restricting the blast radius of the agent.
• Require API Token Auth: Setting require_api_token_auth: true means the unguessable MCP URL is not enough to execute tools. The calling client must also pass a valid Truto API token in the Authorization header, preventing leaked URLs from being abused.
• Time-to-Live Expiration: For temporary access (e.g., an automated contractor offboarding script), you can pass an expires_at ISO datetime. Truto automatically destroys the token in Cloudflare KV when the clock runs out.

Moving Beyond Basic IT Tickets

Connecting ServiceNow SCIM to ChatGPT fundamentally changes how IT departments operate. You stop building brittle scripts to handle specific SCIM PatchOps and start deploying AI agents that understand the intent of your identity workflows.

By utilizing a documentation-driven tool generator like Truto, your MCP infrastructure instantly adapts to ServiceNow's complex schemas. When your organization spins up a new Cost Center table or extends the user schema, your AI agent automatically discovers the changes without a single line of code being rewritten.