SCIM & Organization-Key Scoped API Routes

Where is this feature available?

• Hobby
  • Not Available
• Core
  • Not Available
• Pro
  • Not Available
• Enterprise
  • Available
• Self Hosted
  • Enterprise Edition

Via organization-scoped API keys, you can administer projects, users, and project/organization memberships (see RBAC docs).

Langfuse is open and meant to be extended via custom workflows and integrations. You can use these endpoints to automate project and user management on your Langfuse organization.

This documentation covers organization management APIs, SCIM-compliant user provisioning endpoints, and includes a comprehensive guide for setting up Okta authentication and user provisioning with Langfuse.

Authentication

Authenticate with the API using Basic Auth. Organization scoped API keys can be created via the Instance Management API or in the Organization Settings within the Langfuse UI.

Example:

curl -u public-key:secret-key https://cloud.langfuse.com/api/public/projects/{projectId}/apiKeys

Organization Management

All applicable endpoints are marked with (requires organization-scoped API key). Those include the following routes:

• POST /api/public/projects
• PUT /api/public/projects/{projectId}
• DELETE /api/public/projects/{projectId}
• GET /api/public/projects/{projectId}/apiKeys
• POST /api/public/projects/{projectId}/apiKeys
• DELETE /api/public/projects/{projectId}/apiKeys/{apiKeyId}
• PUT /api/public/organizations/memberships
• GET /api/public/organizations/memberships
• PUT /api/public/projects/{projectId}/memberships
• DELETE /api/public/projects/{projectId}/memberships

See API Reference for more details.

User Management via SCIM

In addition, we implement the following SCIM compliant endpoints. Use /api/public/scim as the base URI for them.

To create a new user within Langfuse, you can use the SCIM-style endpoints and POST /Users. This will create a new user if the email does not exist yet. Then it will add the user to the organization with role NONE (unless a roles attribute is provided, see Okta guide below).

Afterward, the role can be updated using the membership endpoints either on an organization or a project level (see above).

SCIM Vendor Guides

Okta

This guide covers how to set up Okta user provisioning for Langfuse.

Okta requires two separate applications. Okta does not support enabling SCIM on a custom OIDC app. Configure:

1. An OIDC application for SSO — see Authentication and SSO → Okta
2. A separate SAML application for SCIM provisioning — steps below

The SSO settings on the SCIM/SAML application do not need to work; Langfuse uses the OIDC app for authentication.

Langfuse supports the SCIM 2.0 protocol for user provisioning.

Troubleshooting

• Users are provisioned with NONE/VIEWER permissions instead of their intended role: This usually happens if the roles attribute has an attribute type Group instead of Personal.
• User lost their role after enabling SCIM: During initial SCIM setup, if a user is deprovisioned and re-provisioned, their organization role is overwritten with the value from the SCIM roles attribute. If no role is configured in the IdP, the default is NONE. To fix this, ensure the correct role (including OWNER for organization owners) is set in the IdP profile before provisioning.