Your IdP and your tools can provision your users automatically
Enterprise teams don't manually provision software. When a new analyst joins a trading desk, their access to every system in the stack, email, Bloomberg, compliance tooling, voice, should be live before their first morning. And when they leave, it should all be gone by end of day. That lifecycle is owned by your identity provider, and it should extend to whoot. without any manual steps in between.
Today, it does. whoot. now supports SCIM 2.0 provisioning: the industry standard that Okta, Azure Active Directory, JumpCloud, and every major IdP speaks natively. Connect your directory, map your groups to rooms, and user lifecycle management becomes fully automated. New starters get access and leavers lose it, with no tickets, no manual steps and no lag.
For teams who prefer direct API control, we've also launched the whoot. Management API: a REST interface that gives your ops tooling, internal platforms, and custom scripts direct programmatic access to user and room management. It offers the same capabilities in a simpler format, designed for integrations that don't speak SCIM.
Security is the foundation, not an afterthought. API keys carry granular scopes so each integration gets exactly the access it needs and nothing more. Tokens are shown once at creation: we never store the plaintext. Every request is logged, rate limits are enforced per key, and revocation is instant. This is enterprise-grade access control designed for environments where the cost of a misconfigured credential is real.
Everything you need to automate your stack
SCIM 2.0, a native REST API, granular scopes, and full audit logging, all in one.
- SCIM 2.0 user provisioning
- Full SCIM 2.0 Users endpoint: create, list, retrieve, update, and deactivate
- Filter support for userName, id, and externalId lookups
- Paginated responses with up to 200 results per page
- Group-to-room mapping
- SCIM Groups map directly to whoot. rooms
- Add and remove members via PATCH Operations, diffs applied automatically
- Deactivated users are removed from all rooms immediately
- Native Management API
- Dedicated REST endpoints for user and room member management
- Add or remove users from specific rooms with a single request
- Control transmit permission per room member
- Granular token scopes
- Eight fine-grained scopes: read and write, separately, for users and rooms
- SCIM and native API scopes are independent: mix and match per key
- Least-privilege by design: grant only what each integration needs
- Full audit logging
- Every API request logged: method, path, status code, source IP, and user agent
- Per-key activity dashboard in the admin portal
- Rate-limited requests flagged separately for immediate visibility
- Rate limiting & controls
- 600 requests per minute per API key, configurable per workspace
- HTTP 429 responses include a Retry-After header
- Seat capacity enforced at provisioning time, no silent overprovisioning
Connect your directory and users are provisioned automatically, with your admins still in control.
API access that's locked down by default
The Management API and SCIM endpoints are built for environments where credential security is non-negotiable. API keys carry only the scopes you grant them. Tokens are never stored in plaintext: they're shown once at creation and that's it. Every request is logged, every rate limit is enforced, and revocation is instant, with no propagation delay. If a key is compromised, you kill it, and it's dead on the next request.
- API tokens are shown once at creation and never retrievable again: only a secure hash is stored
- Tokens can carry an expiry date: time-bound credentials by design
- Revocation is immediate: a revoked key is rejected on the next request, no propagation delay
- Eight granular scopes enforce least-privilege access at the API layer
- Every request is logged with method, path, status, source IP, and user agent
- Rate limiting is enforced per API key: 600 requests per minute with Retry-After headers
- Seat capacity is checked at provisioning time: over-quota requests are rejected cleanly