Minimum tier: Enterprise. Mark and Redact use email + workspace RBAC; SAML/SCIM require platform commit.
For dashboard OIDC (Okta, Entra) shipped on R2, see SSO & Deployment. This runbook covers Enterprise SAML + SCIM program delivery.
Supported methods (Enterprise)
| Method | Status | Notes |
|---|---|---|
| SAML 2.0 SP | Enterprise program | IdP-initiated and SP-initiated flows |
| SCIM 2.0 provisioning | Enterprise program | /api/scim/v2/Users — bearer from Admin → Security |
| OIDC (dashboard) | Shipped | Generic OIDC when env vars set — pilot path before SAML |
Agent runtimes use workspace API tokens (mask:write, events:write) — separate from human SSO.
SAML setup (stub)
- Open Enterprise onboarding ticket — provide IdP metadata URL or XML.
- Blekline provisions SP entity ID and ACS URL for your deployment (
app.blekline.comor private tenant hostname). - Map attributes:
email→ workspace membershipgroups→ role (owner/admin/member)tenant_id→ workspace isolation (multi-tenant IdPs)
- Invite break-glass admin before enforcing SSO-only login.
- Run login test matrix: new user, returning user, deprovisioned user.
SCIM setup (stub)
- Admin → Security → Issue SCIM token (requires admin 2FA).
- Configure IdP:
- Base URL:
https://app.blekline.com/api/scim/v2 - Bearer:
blw_scim_…(shown once)
- Base URL:
- Map
userName/emails[].valueto workspace email. - Deprovision via
active: falseor DELETE — revokes sessions and membership. - Rate limit: 30 req/min per token.
Operational checklist
- Break-glass local admin documented
- SCIM deprovision tested in staging
- Agent tokens rotated on schedule (independent of SSO)
- Audit trail confirms SCIM create/update/delete events
FastTrack exception
Redact buyers needing SAML before full Enterprise → Enterprise FastTrack private offer. Do not enable SAML on Mark self-serve.