Analytics · Beta
Amplitude SCIM
API integration
Ship Analytics features without building the integration. Full Amplitude SCIM API access via Proxy, normalized data through Unified APIs, and 10+ MCP-ready tools for AI agents — all extensible to your exact use case.
Built for specific customer use cases. Issues are resolved quickly.
Talk to us
Use Cases
Why integrate with Amplitude SCIM
Common scenarios for SaaS companies building Amplitude SCIM integrations for their customers.
Automate employee provisioning into Amplitude on day one
HR and identity platforms can automatically create Amplitude users and assign them to the correct permission groups the moment an employee is onboarded, eliminating manual invite workflows and ensuring immediate access to the right analytics dashboards.
Instant access revocation on employee offboarding
Security and IT automation tools can deactivate Amplitude users in real time when an employee is terminated or changes roles, closing a critical gap where sensitive product analytics data could be exposed to former employees.
Reconcile Amplitude access against your source of truth
SaaS management and compliance platforms can pull the full list of Amplitude users and groups to detect shadow access, orphaned accounts, or permission drift compared to the company's HR directory or identity provider.
Reclaim unused Amplitude Enterprise licenses
SaaS spend management tools can identify inactive Amplitude users by cross-referencing SCIM user data with login activity, then programmatically deactivate stale seats to reduce software costs.
Enable time-bound, just-in-time access to sensitive analytics
Access governance platforms can temporarily add users to privileged Amplitude groups for debugging or ad-hoc analysis, then automatically remove them after a set window to enforce zero standing privileges.
What You Can Build
Ship these features with Truto + Amplitude SCIM
Concrete product features your team can ship faster by leveraging Truto’s Amplitude SCIM integration instead of building from scratch.
One-click Amplitude user deprovisioning
Let IT admins deactivate Amplitude users directly from your platform by toggling the SCIM active flag to false, instantly revoking access to all organization data.
Automated group-based permission mapping
Sync departmental roles from an HR system or IdP into Amplitude permission groups so new hires land in the correct access tier — Viewer, Manager, or Admin — without manual configuration.
Shadow access detection dashboard
Surface a real-time view of all active Amplitude users and their group memberships, flagged against your customer's canonical directory to highlight unmanaged or unauthorized accounts.
SOC 2 access review evidence export
Generate auditor-ready reports mapping every Amplitude user to their permission groups, with historical snapshots proving that access is reviewed and terminated on a defined schedule.
Idle license reclamation workflow
Automatically identify Amplitude users who haven't logged in within a configurable window and offer a one-click flow to deactivate their seats and reclaim Enterprise licenses.
Time-bound privileged access grants
Allow approved users to be added to sensitive Amplitude groups for a fixed duration, with automatic removal enforced by a scheduled job — no standing privileges required.
SuperAI
Amplitude SCIM AI agent tools
Comprehensive AI agent toolset with fine-grained control. Integrates with MCP clients like Cursor and Claude, or frameworks like LangChain.
list_all_amplitude_scim_users
List users in the Amplitude organization via SCIM, including pending (invited) and joined users. Supports SCIM filter, e.g. userName eq "jane@acme.com". Returns: id (email), userName, name, emails, active.
get_single_amplitude_scim_user_by_id
Get an Amplitude user by id; the SCIM id is the user's email (not case sensitive). Returns: id, userName, name, emails, active, groups. Required: id.
create_a_amplitude_scim_user
Invite (create) a user in Amplitude via SCIM; Amplitude emails an invitation. id and userName must be the email and the user must not already exist or be invited. Groups are ignored here; use groups update to add members. Required: schemas, id, userName, name.
update_a_amplitude_scim_user_by_id
Replace an Amplitude user via SCIM PUT (send the full user). Set active false to remove the user from the organization or revoke a pending invite. The email cannot be changed. Required: id (email), schemas, userName, name.
amplitude_scim_users_partial_update
Partially update an Amplitude user via SCIM PATCH, e.g. {"op":"replace","path":"active","value":false} to remove the user. Required: user_id (email), schemas, Operations.
delete_a_amplitude_scim_user_by_id
Delete an Amplitude user via SCIM (revokes a pending invite). Required: id (email).
list_all_amplitude_scim_groups
List Amplitude permission groups via SCIM. Supports SCIM filter. Returns: id, displayName, members (email, display).
get_single_amplitude_scim_group_by_id
Get an Amplitude permission group by numeric id. Returns: id, displayName, members, meta. Required: id.
create_a_amplitude_scim_group
Create an Amplitude permission group via SCIM with optional members (emails). Members not yet in the organization are invited with minimum permissions. Required: schemas, displayName.
update_a_amplitude_scim_group_by_id
Add or remove group members via SCIM PATCH: {"op":"add","path":"members","value":[{"value":"
delete_a_amplitude_scim_group_by_id
Delete an Amplitude permission group. Required: id.
Why Truto
Why use Truto’s MCP server for Amplitude SCIM
Other MCP servers give you a static tool list for one app. Truto gives you a managed, multi-tenant MCP infrastructure across 1000+ integrations.
Auto-generated, always up to date
Tools are dynamically generated from curated documentation — not hand-coded. As integrations evolve, tools stay current without manual maintenance.
Fine-grained access control
Scope each MCP server to read-only, write-only, specific methods, or tagged tool groups. Expose only what your AI agent needs — nothing more.
Multi-tenant by design
Each MCP server is scoped to a single connected account with its own credentials. The URL itself is the auth token — no shared secrets, no credential leaking across tenants.
Works with every MCP client
Standard JSON-RPC 2.0 protocol. Paste the URL into Claude, ChatGPT, Cursor, or any MCP-compatible agent framework — tools are discovered automatically.
Built-in auth, rate limits, and error handling
Tool calls execute through Truto’s proxy layer with automatic OAuth refresh, rate-limit handling, and normalized error responses. No raw API plumbing in your agent.
Expiring and auditable servers
Create time-limited MCP servers for contractors or automated workflows. Optional dual-auth requires both the URL and a Truto API token for high-security environments.
Unified APIs
Unified APIs for Amplitude SCIM
Skip writing code for every integration. Use Truto’s category-specific Unified APIs out of the box or customize the mappings with AI.
How It Works
From zero to integrated
Start with Amplitude SCIM in a free sandbox, usually ready within one business day. No boilerplate, no maintenance burden.
Link your customer’s Amplitude SCIM account
Use Truto’s frontend SDK to connect your customer’s Amplitude SCIM account. We handle all OAuth and API key flows — you don’t need to create the OAuth app.
We handle authentication
Don’t spend time refreshing access tokens or figuring out secure storage. We handle it and inject credentials into every API request.
Call our API, we call Amplitude SCIM
Truto’s Proxy API is a 1-to-1 mapping of the Amplitude SCIM API. You call us, we call Amplitude SCIM, and pass the response back in the same cycle.
Unified response format
Every response follows a single format across all integrations. We translate Amplitude SCIM’s pagination into unified cursor-based pagination. Data is always in the result attribute.
FAQs
Common questions about Amplitude SCIM on Truto
Authentication, rate limits, data freshness, and everything else you need to know before you integrate.
What authentication method does Amplitude SCIM use?
Amplitude SCIM uses static Bearer token authentication. An organization admin generates a SCIM API token from the Amplitude settings page, and all requests are authenticated by passing this token in the Authorization header.
What are the rate limits for the Amplitude SCIM API?
Amplitude enforces a strict limit of 100 requests per minute per organization. If you're syncing a large directory, you'll need robust pagination and backoff strategies — something Truto's unified API layer can help abstract away.
Does creating a user via SCIM immediately grant them access to Amplitude?
No. A POST to the Users endpoint triggers an invitation email. The user remains in a pending state until they accept the invite and log in. Your integration should account for this intermediate state.
Can I update a user's group membership through the Users endpoint?
No. Amplitude's Users endpoint ignores the groups array on updates. You must use the Groups endpoint to add or remove users from permission groups. This is a common gotcha when building against this API.
Which Amplitude plans support SCIM?
SCIM provisioning is only available on Amplitude's Enterprise plan. Your end users will need an active Enterprise subscription and org-admin privileges to generate a SCIM token.
What Unified APIs does Truto provide for Amplitude SCIM?
Amplitude SCIM is supported through Truto's Unified User Directory API, which exposes standardized Users and Groups resources. This lets you read, create, update, and deactivate users and manage group memberships through a single consistent interface.
Amplitude SCIM
Get Amplitude SCIM integrated into your app
Our team understands what it takes to make a Amplitude SCIM integration successful. A short, crisp 30 minute call with folks who understand the problem.