> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wandb.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Automate user and team management

> Automate user and team management at scale in W&B using the SCIM API and the Python SDK API.

This page describes how you can automate user and team management using the [SCIM API](/platform/hosting/iam/scim) and the [Python SDK API](/models/ref/python/public-api).

## SCIM API

Use the W\&B SCIM API to manage your W\&B organization's users and teams at scale using an identity provider (IdP) like Okta or Microsoft Entra.

For more details and examples, see [Authentication](./scim#authentication) on the SCIM reference page.

<Tip>
  W\&B's implementation includes endpoints for assigning roles, as well as creating and managing custom roles, as well as assigning built-in and custom roles. Role endpoints are not part of the official SCIM schema. W\&B adds role endpoints to support automated management of custom roles.
</Tip>

The following sections describe each category of the SCIM API.

### User SCIM API

The [User SCIM API](./scim#user-resource) allows you to create, deactivate, fetch, and list users in a W\&B organization, and to assign predefined or custom roles. For complete request/response examples, use the detailed [SCIM reference](./scim#user-management).

<Note>
  Deactivate a user with `PATCH /scim/Users/{id}` and set `{"active": false}`. Hosting option determines the outcome: Dedicated Cloud and Self-Managed deployments retain the user record, while Multi-tenant Cloud removes the user from the organization. Reactivation is unavailable in Multi-tenant Cloud; re-add the user instead. See [Deactivate user](./scim#deactivate-user) and [Reactivate user](./scim#reactivate-user).
</Note>

### Group SCIM API

The [Group SCIM API](./scim#group-resource) allows for managing W\&B teams, including creating or removing teams in an organization. Use the `PATCH Group` to add or remove users in an existing team.

<Note>
  There is no notion of a `group of users having the same role` within W\&B. A W\&B team closely resembles a group, and allows diverse personas with different roles to work collaboratively on a set of related projects. Teams can consist of different groups of users. Assign each user in a team a role: team admin, member, viewer, or a custom role.

  W\&B maps Group SCIM API endpoints to W\&B teams because of the similarity between groups and W\&B teams.
</Note>

### Custom role API

The [Custom Role SCIM API](./scim#role-resource) allows for managing custom roles, including creating, listing, or updating custom roles in an organization.

<Warning>
  Delete a custom role with caution.

  Delete a custom role within a W\&B organization with the `DELETE Role` endpoint. The predefined role that the custom role inherits is assigned to all users that are assigned the custom role before the operation.

  Update the inherited role for a custom role with the `PUT Role` endpoint. This operation doesn't affect any of the existing, that is, non-inherited custom permissions in the custom role.
</Warning>

## W\&B Python SDK API

Use the [W\&B Python SDK API](/models/ref/python/public-api/api) to manage organization users, teams, and team membership.

* [`User`](/models/ref/python/public-api/user)
* [`Team`](/models/ref/python/public-api/team)
* [`Member`](/models/ref/python/public-api/member)