Skip to content

Directory Sync

Automatic user and group provisioning

Quickly enable SCIM provisioning from all major corporate directory providers with a single integration.

Add Directory Sync to your appRead the docs
Directory Sync
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Directory Sync

Streamline user activation, deactivation, and groups

1

Connect the directory

Your customer's IT admin connects Okta, Entra ID, Rippling, BambooHR or whatever they run, from the Admin Portal and without your support team in the loop.

2

Read normalized data

Users, groups and memberships arrive in one shape, whatever the provider called them. Custom attributes are mapped once and then just show up.

3

React to webhook events

Someone joins, changes team or leaves. Your app hears about it in seconds and grants or revokes access without anyone filing a ticket.

Your app's gateway into enterprise HR

Integrate into the systems that enterprises are already using

Paycux integrates corporate directories and HRIS systems to power the user lifecycle management of your app. With a single integration, automatically provision and deprovision users, groups and access controls.

  • SCIM 2.0 provisioning from the major corporate directory providers
  • HRIS integrations for the systems that own the org chart
  • Groups and memberships you can map straight onto your own roles
  • Deprovisioning that lands the moment the directory says someone left
Your app's gateway into enterprise HR
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Webhooks

Real-time updates with webhooks

Receive events to stay up to date any time a change is made to a directory sync connection, instead of polling for a diff you hope you have not missed.

  • dsync.user.created and dsync.user.updated when a person is added or changed
  • dsync.user.deleted when a user is removed from the directory
  • dsync.group.created, dsync.group.updated and group membership changes
  • dsync.activated and dsync.deactivated for the connection itself
Webhooks
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Effortlessly integrate with directory users and groups

Seamless user lifecycle management, for both sides

Keep your app in sync with your customer's employee directory, without asking their IT team to learn anything new.

Normalized dataAccess attributes in a standardized format from dozens of HRIS and directory providers.
Attribute mappingMap the custom attributes you need to pull in from various directory providers.
Advanced use casesFetch and manipulate data from different entities such as directories, groups and users.
Real-time updates with webhooksReceive events to stay up to date any time a change is made to a directory sync connection.
Groups that become rolesTurn directory groups into the roles your app already understands, so access follows the org chart.
Deprovisioning on day oneAn offboarded employee loses access to your product at the same moment they lose access to everything else.

SDKs

List a directory's users in a few lines

The same objects, the same field names, whichever directory your customer happens to run.

1// Get a list of all users
2// from an existing Directory
3import Paycux from '@paycux/node';
4 
5const paycux = new Paycux('sk_example_123456');
6 
7const users = await paycux.directorySync.listUsers({
8  directory: 'directory_01ECAZ',
9});

Transparent pricing

Priced by connection

Integrate corporate directories and HRIS systems to power the user lifecycle management of your app. You pay for live directory connections, and the rate per connection drops as their number grows.

See full pricingTalk to an expert
First 15 connectionsContact us
16-30 connectionsVolume pricing
31-100 connectionsVolume pricing
Webhook events and API callsIncluded
Custom enterprise planContract-based

Questions

Frequently asked

Which directories and HRIS systems can my customers connect?

Any provider that speaks SCIM 2.0, which covers Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud and ADFS, plus HRIS systems such as BambooHR and Rippling. You build against one API and the provider becomes a dashboard detail.

What is the difference between Directory Sync and SSO?

SSO answers who is signing in right now. Directory Sync answers who should exist at all. Most enterprise customers eventually want both: sign-in through their identity provider and accounts that appear and disappear with employment.

Do I have to poll for changes?

No. Subscribe to webhook events and you are told when a user or group changes. The list endpoints are there for backfills and reconciliation, not for the steady state.

How do custom attributes work?

Every directory names things differently. Map the attributes you care about once, in the dashboard or by letting the customer's IT admin do it in the Admin Portal, and they arrive under your names from then on.

What happens when an employee leaves?

The directory marks them inactive or removes them, Paycux emits a deletion or update event, and your app revokes access immediately. That gap between offboarding and losing access is what security reviews ask about.

Keep exploring

The rest of the platform

User ManagementComplete auth and user management platform
Enterprise SSOUnified SSO for any identity provider
RadarRealtime protection against bots, fraud and abuse
AuthKitCustomisable UI for every authentication type
Role-Based Access ControlPowerful and flexible permissions for your users
MCP AuthSecure auth for MCP servers

Let their directory do the onboarding

Connect once, and every join, move and leave in your customer's company shows up in your app without a support ticket.

Get startedTalk to an expert