Directory Provisioning (planned)

Before you begin

• Read this page as a roadmap, not as an integration guide: nothing on it provisions users from a directory.
• What exists today: identities per realm, organisations with owner, admin and member roles, single-use invites and an audit ledger.
• If you need memberships now, use invites: your application delivers a single-use token and the invitee accepts it with a verified e-mail address.

Install

There is nothing to install. Paycux is a plain HTTPS JSON API, so every example on this page uses curl. Console routes send the dashboard session cookie, end-user routes send the application's realm access token as a bearer credential, and agent routes send the short-lived agent token. The routes that exist today are listed on What exists today.

1# Console routes carry the dashboard session cookie set by sign-in
2curl https://api.paycux.com/v1/auth/session \
3  -H "Cookie: __Host-paycux_session=<session>"
4 
5# End-user routes carry the application's realm access token
6curl https://api.paycux.com/v1/<end-user route> \
7  -H "Authorization: Bearer <realm access token>"

Configure

There is nothing directory-specific to configure. The values below are the ones every end-user request already carries; a planned directory connection would be scoped the same way.

1PAYCUX_API_BASE_URL=https://api.paycux.com
2PAYCUX_PROJECT_ID=<project id>
3PAYCUX_ENVIRONMENT_ID=<environment id>
4PAYCUX_REALM_ID=<realm id>

Then, in the dashboard:

1. 1Open the environment's Organisations tab to see the organisations your end users created, with member and pending invite counts.
2. 2Open an organisation to review members and invites with masked e-mail addresses. Owners and admins can revoke a pending invite.
3. 3There is no directory, SCIM token or group mapping screen. Those are planned and cannot be enabled.

Implement

There is no provisioning endpoint to call. The requests below are the membership routes that exist today; a planned SCIM connection would write to the same organisation memberships.

1curl -X POST https://api.paycux.com/v1/billing/organizations \
2  -H "Authorization: Bearer <realm access token>" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "projectId": "a1000000-0000-4000-8000-000000000002",
6    "environmentId": "a1000000-0000-4000-8000-000000000003",
7    "realmId": "a1000000-0000-4000-8000-000000000004",
8    "displayName": "Example Robotics"
9  }'
10 
11HTTP 201
12{
13  "billingAccountId": "c2b1a0f9-8e7d-4c6b-9a5f-4e3d2c1b0a99",
14  "kind": "organization",
15  "role": "owner"
16}

1curl -X POST https://api.paycux.com/v1/billing/organizations/c2b1a0f9-8e7d-4c6b-9a5f-4e3d2c1b0a99/invites \
2  -H "Authorization: Bearer <realm access token>" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "projectId": "a1000000-0000-4000-8000-000000000002",
6    "environmentId": "a1000000-0000-4000-8000-000000000003",
7    "realmId": "a1000000-0000-4000-8000-000000000004",
8    "email": "[email protected]",
9    "role": "member"
10  }'
11 
12HTTP 201
13{
14  "inviteId": "e4d3c2b1-a098-4f7e-8d6c-5b4a39281706",
15  "token": "<single-use token, returned once>",
16  "role": "member",
17  "expiresAt": "2026-10-19T09:14:03.220Z"
18}

1curl "https://api.paycux.com/v1/billing/organizations/c2b1a0f9-8e7d-4c6b-9a5f-4e3d2c1b0a99/members?projectId=a1000000-0000-4000-8000-000000000002&environmentId=a1000000-0000-4000-8000-000000000003&realmId=a1000000-0000-4000-8000-000000000004" \
2  -H "Authorization: Bearer <realm access token>"
3 
4HTTP 200
5{
6  "billingAccountId": "c2b1a0f9-8e7d-4c6b-9a5f-4e3d2c1b0a99",
7  "role": "owner",
8  "members": [
9    {
10      "identityId": "7a6b5c4d-3e2f-4a1b-9c0d-8e7f6a5b4c3d",
11      "role": "owner",
12      "status": "active",
13      "joinedAt": "2026-10-12T09:14:03.220Z"
14    }
15  ],
16  "invites": [
17    {
18      "inviteId": "e4d3c2b1-a098-4f7e-8d6c-5b4a39281706",
19      "email": "c***@robotics.example",
20      "role": "member",
21      "expiresAt": "2026-10-19T09:14:03.220Z"
22    }
23  ]
24}

Verify

You can verify the foundation today, not the provisioning.

1. 1Invite and accept with two test identities and confirm GET /v1/billing/organizations/:billingAccountId/members lists both with their roles.
2. 2Revoke a pending invite and confirm that accepting with its token answers 409.
3. 3Confirm the audit ledger carries organization_invite.created, organization_member.joined and organization_invite.revoked for those steps.

Reference

Request and response shapes for each of these live in the API reference. Paths are relative to https://api.paycux.com.

Next steps