Connect Superblocks to ChatGPT: Manage SCIM Users and Group Access

If you need to connect Superblocks to ChatGPT to automate identity provisioning, manage System for Cross-domain Identity Management (SCIM) workflows, or orchestrate role-based access control, you need a Model Context Protocol (MCP) server. This infrastructure acts as the secure translation layer between ChatGPT's JSON-RPC tool calls and the Superblocks REST API. You can either spend weeks building and maintaining this custom integration layer yourself, or use a managed platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting Superblocks to Claude or explore our broader architectural overview on connecting Superblocks to AI Agents.

Giving a Large Language Model (LLM) read and write access to a strict identity provider interface like Superblocks SCIM is a significant engineering challenge. You must handle rigid URN-based data schemas, complex partial update payloads, and strict rate limits. Every time an LLM attempts an operation, your server must enforce schema validation to prevent hallucinations from causing destructive state changes in your identity directory.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Superblocks, connect it natively to ChatGPT, and execute complex identity management workflows using natural language.

Stop writing boilerplate SCIM integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. :::

The Engineering Reality of the Superblocks SCIM API

A custom MCP server is a self-hosted API gateway that maps an LLM's intent to specific HTTP requests. While Anthropic's open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against a vendor's SCIM implementation is highly complex.

If you decide to build a custom MCP server for Superblocks, you own the entire integration lifecycle. Here are the specific engineering challenges that break standard CRUD assumptions when working with Superblocks SCIM:

Rigid URN Schemas and Nested Data Models

The Superblocks SCIM API adheres to RFC 7643 and RFC 7644. This means endpoints do not accept flat, standard JSON payloads. If an LLM tries to create a user by sending {"email": "engineer@company.com", "name": "Jane"}, the request will fail immediately. Superblocks requires explicit schema declarations, such as "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], and highly nested objects for attributes like emails and names. To expose this to ChatGPT, your MCP server must generate massive, highly constrained JSON Schema definitions so the LLM understands exactly how to format the SCIM payload. If your schema generation is flawed, the LLM will hallucinate invalid payloads.

Complex PATCH Operations

Managing group memberships or deactivating users in Superblocks requires the SCIM PATCH method. A SCIM PATCH request expects an array of Operations with specific op (add, remove, replace), path, and value fields. Instructing an LLM to reliably generate these exact operational arrays is notoriously difficult. Your custom server must tightly constrain the input schema to enforce the urn:ietf:params:scim:api:messages:2.0:PatchOp format, or risk the LLM attempting standard REST PUT operations that the API will reject.

Rate Limits and 429 Handling

Superblocks enforces rate limits to protect identity infrastructure from abuse. If an AI agent attempts to iterate over hundreds of SCIM users in a tight loop, the Superblocks API will reject the requests with an HTTP 429 Too Many Requests status. Truto does not automatically retry, throttle, or apply backoff on rate limit errors. Instead, when the upstream API returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized IETF headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset). The caller - your MCP client or AI agent framework - is entirely responsible for reading these headers and implementing the appropriate exponential backoff strategy.

The Managed MCP Architecture

Instead of forcing your engineering team to build custom schema parsers and maintain token infrastructure, Truto provides a managed MCP architecture that derives tools dynamically.

Tools are never hard-coded or cached. When ChatGPT connects to your Truto MCP server and issues a tools/list request, Truto dynamically derives the tool definitions directly from the underlying Superblocks API documentation and resource configurations. A tool only appears if it has a complete documentation record, acting as a strict quality gate. Truto automatically injects pagination instructions (like cursor handling) and parses the rigid SCIM YAML schemas into LLM-friendly JSON Schema requirements.

flowchart TD
    Client["ChatGPT Client<br>(MCP Client)"]
    Router["Truto MCP Router<br>(JSON-RPC 2.0)"]
    Generation["Tool Generation<br>(Dynamic Schema Parsing)"]
    Proxy["Proxy API Execution<br>(SCIM Standard)"]
    Superblocks["Superblocks API<br>(Identity Provider)"]

    Client -->|"tools/list"| Router
    Router --> Generation
    Generation -->|"Filtered by tags/methods"| Router
    Router -->|"Tool JSON Schema"| Client

    Client -->|"tools/call"| Router
    Router --> Proxy
    Proxy -->|"Mapped SCIM Payload"| Superblocks
    Superblocks -->|"Raw Response"| Proxy
    Proxy -->|"JSON-RPC Result"| Client

When a tool is invoked, Truto's proxy execution layer translates the flat JSON-RPC arguments into the required SCIM query parameters and deeply nested request bodies, applying the necessary authentication headers securely at the edge.

How to Generate the Superblocks MCP Server

Truto MCP servers are fully self-contained. The server URL contains a cryptographically hashed token that authenticates the connection and dictates exactly which tools the LLM can access. You can generate this server via the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

Navigate to the integrated account page for your connected Superblocks instance in the Truto dashboard.
Click the MCP Servers tab.
Click Create MCP Server.
Configure the server name, allowed methods (e.g., limit to read or write), and tool tags.
Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the API

You can dynamically generate MCP servers for your automated environments using the Truto REST API. The token is generated securely, hashed via HMAC, and stored in a distributed key-value store at the edge for low-latency validation.

Request:

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Superblocks SCIM Admin Server",
    "config": {
      "methods": ["read", "write", "custom"]
    }
  }'

Response:

{
  "id": "mcp_12345abcde",
  "name": "Superblocks SCIM Admin Server",
  "config": {
    "methods": ["read", "write", "custom"]
  },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

How to Connect the MCP Server to ChatGPT

Once you have the Truto MCP server URL, connecting it to ChatGPT takes seconds. The URL acts as the definitive connection endpoint, requiring no additional local routing infrastructure.

Method A: Via the ChatGPT UI (Custom Connectors)

Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
Enable the Developer mode toggle to reveal MCP support.
Under the custom connectors section, click Add new server.
Enter a recognizable name (e.g., "Superblocks SCIM").
Paste the Truto MCP URL into the Server URL field.
Click Save. ChatGPT will immediately handshake with the Truto router and list the available Superblocks tools.

Method B: Via Manual Config File (SSE Transport)

If you are running custom agent frameworks or headless testing environments, you can configure the MCP server using standard JSON configuration utilizing Server-Sent Events (SSE).

{
  "mcpServers": {
    "superblocks-scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Superblocks MCP Hero Tools

Truto automatically generates descriptive, context-aware tools from the Superblocks SCIM documentation. Below are the highest-leverage operations for identity automation.

list_all_superblocks_scim_users

Fetches a paginated list of SCIM users in your Superblocks organization. The underlying proxy API automatically appends pagination schemas instructing the LLM to pass back unaltered cursors for subsequent requests.

"Audit our Superblocks directory. List all active users and summarize their current organizational roles."

create_a_superblocks_scim_user

Provisions a new SCIM user. The LLM handles the URN schema injection automatically based on Truto's JSON Schema mapping. It requires standard attributes like emails and displayName.

"Onboard Sarah Jenkins as a new engineer. Create her Superblocks SCIM user profile using sarah.jenkins@company.com and return her provisioned ID."

superblocks_scim_users_partial_update

Executes a SCIM PATCH operation to modify specific user attributes or deactivate an account. This is the required method for securely deactivating a user without deleting their historical audit data.

"Deactivate the SCIM user with ID 8f7d9a21-bc34. Set their active status to false immediately using a partial update."

list_all_superblocks_scim_groups

Retrieves the directory of SCIM groups and their current member rosters. Crucial for auditing access control lists and understanding role-based permissions.

"Retrieve all SCIM groups in Superblocks. Cross-reference the members of the 'Production-Admins' group and list their display names."

superblocks_scim_groups_partial_update

Modifies group membership using the SCIM PATCH specification. Use this tool to programmatically assign or unassign users from specific operational groups.

"Add the user ID 4a5b6c7d to the 'Data-Engineering' SCIM group. Ensure you use the correct PATCH operation for group modification."

create_a_superblocks_scim_bulk

Submits a bulk SCIM request to perform multiple operations (POST, PUT, PATCH, DELETE) in a single API call. This is highly efficient for large-scale directory migrations or mass onboarding events.

"We just acquired a small startup. Take this JSON array of 15 new employees and execute a bulk SCIM creation request to provision all of them in Superblocks simultaneously."

To view the complete inventory of available Superblocks tools, endpoints, and SCIM schema requirements, visit the Superblocks integration page.

Workflows in Action

When you give ChatGPT direct access to these MCP tools, you transition from manual administrative clicks to intent-driven identity orchestration. Here are two real-world operational workflows.

Workflow 1: Rapid Security Offboarding

When an employee departs or an account is compromised, IT admins must revoke access instantly across all platforms. Doing this via natural language ensures speed and accuracy.

"Initiate offboarding for david.miller@company.com. Find his Superblocks SCIM user ID, check which groups he belongs to, deactivate his account, and remove him from all active groups."

The agent calls list_all_superblocks_scim_users passing a filter for the specific email to retrieve David's id and current groups array.
The agent calls superblocks_scim_users_partial_update with a PATCH payload setting "active": false to suspend the account.
The agent loops through the identified groups and calls superblocks_scim_groups_partial_update for each, sending a remove operation to strip the user ID from the group.

Result: The IT admin receives a confirmation that David's account has been successfully disabled and isolated from all privileged groups within seconds, without opening a single dashboard.

Workflow 2: Department-Wide Provisioning

DevOps teams frequently need to provision entire cohorts of users and assign them to baseline security groups.

"We have three new data scientists starting today. Create SCIM users for alice.d@company.com, bob.e@company.com, and charlie.f@company.com. Once created, add all three to the 'Analytics-Read-Only' group."

The agent calls create_a_superblocks_scim_bulk compiling a bulk operations array to create the three users in a single network request. It parses the response to extract their newly generated id values.
The agent calls list_all_superblocks_scim_groups to resolve the internal ID for the 'Analytics-Read-Only' group.
The agent calls superblocks_scim_groups_partial_update targeting the group ID, submitting a PATCH payload that appends the three new user IDs to the members array.

Result: The DevOps engineer avoids writing a custom Python script or battling with raw JSON URN schemas. The users are created and permissioned perfectly.

sequenceDiagram
    participant Admin as IT Admin
    participant AI as ChatGPT
    participant Server as Truto MCP Server
    participant SCIM as Superblocks API

    Admin->>AI: "Offboard david.miller@company.com"
    AI->>Server: tools/call (list_all_superblocks_scim_users)
    Server->>SCIM: GET /scim/v2/Users?filter=userName eq ...
    SCIM-->>Server: User record (ID: 1234, groups: [Admin])
    Server-->>AI: Tool result

    AI->>Server: tools/call (superblocks_scim_users_partial_update)
    Server->>SCIM: PATCH /scim/v2/Users/1234<br>{"op": "replace", "path": "active", "value": false}
    SCIM-->>Server: 200 OK
    Server-->>AI: Tool result

    AI->>Server: tools/call (superblocks_scim_groups_partial_update)
    Server->>SCIM: PATCH /scim/v2/Groups/Admin<br>{"op": "remove", "path": "members[value eq 1234]"}
    SCIM-->>Server: 200 OK
    Server-->>AI: Tool result

    AI-->>Admin: "David Miller has been deactivated and removed from the Admin group."

Security and Access Control

Identity directories hold the keys to your organization's kingdom. Exposing them to an LLM requires zero-trust security controls. Truto MCP servers enforce security at the edge via database-backed token configurations.

Method Filtering: Restrict an MCP server to read-only operations by passing "methods": ["read"] during creation. This ensures the LLM can query users and groups but cannot execute POST, PATCH, or DELETE operations, neutralizing the risk of hallucinated identity deletions.
Tag Filtering: Limit the server's scope to specific API areas. By passing "tags": ["directory"], you ensure the agent only accesses user profile data and cannot touch broader application configurations or custom custom resources.
Additional API Authentication (require_api_token_auth): For maximum security, enable this flag. It forces the MCP client to pass a valid Truto API token in the Authorization header alongside the connection URL. This means URL possession alone is useless without organizational authentication.
Automatic Expiration (expires_at): Generate ephemeral servers for temporary audit tasks. Setting an ISO datetime ensures the server token is automatically evicted from the edge key-value store and hard-deleted from the database when the alarm fires, leaving no stale access vectors.

Stop Writing SCIM Integration Boilerplate

Building an MCP server for Superblocks SCIM requires parsing RFC 7644 requirements, normalizing partial update payloads, handling pagination cursors, and implementing rate limit backoffs based on 429 headers. It is a massive distraction from building actual AI product value.

Truto abstracts the entire API lifecycle. By leveraging dynamic, documentation-driven tool generation and edge-secured token validation, Truto gives your AI agents instant, strictly schema-validated access to Superblocks identity infrastructure.

Ready to automate your SCIM workflows with ChatGPT? Let Truto handle the infrastructure.