SCIM Provisioning with Scalekit

Adds automated user lifecycle management (create, update, deactivate) via Scalekit's Directory API and real-time webhooks.

Guardrails

• MUST verify the SCIM webhook signature before processing any event; MUST NOT act on a payload that fails verification.
• MUST make user provisioning idempotent — upsertUser MUST handle duplicate directory events without creating duplicate users.
• MUST deactivate users on user_deleted events; MUST NOT hard-delete unless the codebase already does so explicitly.
• MUST return a 2xx response quickly and offload heavy processing to a queue; MUST NOT block the handler long enough to trigger Scalekit's retry backoff.

Workflow

Copy and track progress: