Directory sync

Whether directory sync is on, the base URL to give the directory, the last four characters of its token and when the directory last used it, how many people it synced and where each stands, and the groups it synced with the role each gives. Only the workspace owner, or a member whose role holds workspace:manage, may call it: an access token acting for anybody else is refused with 403 insufficient_authority.

Requires the members:read scope.

Turns directory sync on and returns the token the directory sends as its bearer token. When it is already on, this makes a new token and the old one stops working at once. The token is in this answer only and can never be read again, so store it in the directory straight away. Directory sync comes with the Business and Enterprise plans: on any other plan the call is a 403 plan_required. Only the workspace owner, or a member whose role holds workspace:manage, may call it: an access token acting for anybody else is refused with 403 insufficient_authority. A key limited to particular addresses or domains is refused with 422 capability_unsupported, because the people it changes reach beyond them.

Requires the members:write scope.

Turns directory sync off. Its token stops working at once and the people and groups it synced are forgotten, while everyone who already joined stays a member. Turning it off when it is off changes nothing. Only the workspace owner, or a member whose role holds workspace:manage, may call it: an access token acting for anybody else is refused with 403 insufficient_authority. A key limited to particular addresses or domains is refused with 422 capability_unsupported, because the people it changes reach beyond them.

Requires the members:write scope.

The people the directory synced into the workspace, a page at a time and in the order it sent them, with where each stands: member once they joined, invited while an invitation waits, waiting before one is sent, and inactive when the directory switched them off. Pages are counted from 1 as SCIM pages are: pass startIndex plus the number of people returned for the next one, while that is at most total. Only the workspace owner, or a member whose role holds workspace:manage, may call it: an access token acting for anybody else is refused with 403 insufficient_authority.

Requires the members:read scope.

Chooses the role directory sync gives somebody that none of their groups gives a role. null goes back to the built-in Member role. The owner role cannot be given out this way (422 invalid_parameter), a role that is not in the workspace is a 422 role_not_found, and anybody but the owner can only give a role that holds nothing they lack themselves (403 insufficient_authority). It answers 409 directory_sync_not_connected while directory sync is off. Only the workspace owner, or a member whose role holds workspace:manage, may call it: an access token acting for anybody else is refused with 403 insufficient_authority. A key limited to particular addresses or domains is refused with 422 capability_unsupported, because the people it changes reach beyond them.

Requires the members:write scope.

Chooses the role a group the directory synced gives its people, and moves everyone in it to that role now. null stops the group giving a role, so its people fall back to the default role. The same rules about roles apply as for the default role, a group that is not in the workspace is a 404, and it answers 409 directory_sync_not_connected while directory sync is off. Only the workspace owner, or a member whose role holds workspace:manage, may call it: an access token acting for anybody else is refused with 403 insufficient_authority. A key limited to particular addresses or domains is refused with 422 capability_unsupported, because the people it changes reach beyond them.

Requires the members:write scope.