Feature
Directory sync
Sync sources feed the directory. Each sync run upserts users and groups and keeps users who left as inactive tombstones.
An Org configures a sync source. The AD/LDAP source is a real implementation: it binds with a bind DN, searches under a base DN with optional user and group filters, and decodes objectGUID. Workday and SCIM sources exist as stubs.
A sync run upserts synced rows and marks departed users inactive; it never deletes them. Native rows are never touched by a sync.
Runs start from a scheduled, token-gated drain, or when an admin calls POST /api/sync/sources/{id}/run. Each run is recorded, and a directory.synced event goes to webhooks.
More features
All features →- 01
Directory lookups
The LDAP Sync Cache contract: find a directory user by any of five identifiers, search, list, and get groups with nested groups expanded.
- 02
SSH keys lookup
Fetch the public SSH keys of one directory user, or of every member of a directory group, by name.
- 03
Public surface
Publish chosen users and groups to an unauthenticated search, with every personal field removed.