Skip to main content
whoot.
Venues & eventsIncident managementMartyn's LawPricingFeatures
Sign inStart free
Venues & eventsIncident managementMartyn's LawPricingFeatures
Sign inStart free

Provision at scale. Manage from code.

SCIM 2.0 provisioning and a Management API for programmatic user and room control. Connect your identity provider, automate onboarding, and manage your workspace from your own tools.

whoot. team · May 2026 · 5 min read

  • SCIM 2.0, compatible with Okta, Azure AD, JumpCloud, and more
  • Granular API key scopes for least-privilege access
  • Tokens shown once at creation and never stored in plaintext
  • Every API request logged for full audit visibility
Sheet 1Product Launch · May 2026 · 5 min read
TimeFromEntryAction
May 2026

whoot. team

Your IdP. Your tools. Your users, provisioned automatically.

Enterprise teams don't manually provision software. When a new analyst joins a trading desk, their access to every system in the stack, email, Bloomberg, compliance tooling, voice, should be live before their first morning. And when they leave, it should all be gone by end of day. That lifecycle is owned by your identity provider, and it should extend to whoot. without any manual steps in between.

Today, it does. whoot. now supports SCIM 2.0 provisioning: the industry standard that Okta, Azure Active Directory, JumpCloud, and every major IdP speaks natively. Connect your directory, map your groups to rooms, and user lifecycle management becomes fully automated. New starters get access. Leavers lose it. No tickets, no manual steps, no lag.

For teams who prefer direct API control, we've also launched the whoot. Management API: a REST interface that gives your ops tooling, internal platforms, and custom scripts direct programmatic access to user and room management. Same capabilities, simpler format, designed for integrations that don't speak SCIM.

Security is the foundation, not an afterthought. API keys carry granular scopes so each integration gets exactly the access it needs and nothing more. Tokens are shown once at creation: we never store the plaintext. Every request is logged. Rate limits are enforced per key. Revocation is instant. This is enterprise-grade access control designed for environments where the cost of a misconfigured credential is real.

Detail

What it does

Everything you need to automate your stack.

SCIM 2.0, a native REST API, granular scopes, and full audit logging, all in one.

SCIM 2.0 User Provisioning
  • Full SCIM 2.0 Users endpoint: create, list, retrieve, update, and deactivate
  • Filter support for userName, id, and externalId lookups
  • Paginated responses with up to 200 results per page
Group-to-Room Mapping
  • SCIM Groups map directly to whoot. rooms
  • Add and remove members via PATCH Operations, diffs applied automatically
  • Deactivated users are removed from all rooms immediately
Native Management API
  • Dedicated REST endpoints for user and room member management
  • Add or remove users from specific rooms with a single request
  • Control transmit permission per room member
Granular Token Scopes
  • Eight fine-grained scopes: read and write, separately, for users and rooms
  • SCIM and native API scopes are independent: mix and match per key
  • Least-privilege by design: grant only what each integration needs
Full Audit Logging
  • Every API request logged: method, path, status code, source IP, and user agent
  • Per-key activity dashboard in the admin portal
  • Rate-limited requests flagged separately for immediate visibility
Rate Limiting & Controls
  • 600 requests per minute per API key, configurable per workspace
  • HTTP 429 responses include a Retry-After header
  • Seat capacity enforced at provisioning time, no silent overprovisioning
Design

How it is built

API access that's locked down by default.

The Management API and SCIM endpoints are built for environments where credential security is non-negotiable. API keys carry only the scopes you grant them. Tokens are never stored in plaintext: they're shown once at creation and that's it. Every request is logged. Every rate limit is enforced. And revocation is instant, with no propagation delay. If a key is compromised, you kill it, and it's dead on the next request.

  • API tokens are shown once at creation and never retrievable again: only a secure hash is stored
  • Tokens can carry an expiry date: time-bound credentials by design
  • Revocation is immediate: a revoked key is rejected on the next request, no propagation delay
  • Eight granular scopes enforce least-privilege access at the API layer
  • Every request is logged with method, path, status, source IP, and user agent
  • Rate limiting is enforced per API key: 600 requests per minute with Retry-After headers
  • Seat capacity is checked at provisioning time: over-quota requests are rejected cleanly
End of sheet 1Back to the top

Connect your directory. Users provision themselves.

You stay in control.

Keep reading

More from the blog

Product Launch

whoot. is now on Android.

The whoot. Android app is live on Google Play. Native Kotlin and Jetpack Compose, push-to-talk straight from the lock screen, and a tablet turret layout for the control room, with the same <150ms voice your team already runs on.

Product Launch · July 2026 · 5 min read

Read the post

Product Launch

Send a text. Get the reply in the room.

Two-way SMS, built into every room. Text anyone from your room's own number and their reply lands straight in the timeline. No app to install, no account to create. Plus branded broadcast, emergency alerts with reply tracking, and a Martyn's Law-ready comms log.

Product Launch · June 2026 · 5 min read

Read the post

Product Launch

Dial-in to any room. From any phone.

Give every whoot. room a real phone number. PSTN callers dial in and join instantly, with no app, no account, and no friction. Flexible auth modes, real-time presence, and full usage visibility.

Product Launch · April 2026 · 5 min read

Read the post

Sheet 2Sign-off
Today

You

Automate provisioning. Eliminate manual work.

SCIM provisioning and the Management API are available on whoot. Business and Enterprise plans.

Signed
Date
Start free trialBook a demo

14 days · full access · no card

whoot.

Push. Talk. Heard. Incident and crowd management for venues, events and operations, built on an always-on voice core.

  • whoot. on LinkedIn (opens in a new tab)
  • whoot. on Instagram (opens in a new tab)

Product

  • Features
  • Incident management
  • Pricing
  • Roadmap
  • Documentation
  • iOS app (opens in a new tab)
  • Android app (opens in a new tab)

Use cases

  • All use cases
  • Venues & events
  • Incident response
  • Financial services
  • Operations teams
  • Trader voice
  • Martyn's law

Company

  • About
  • Case studies
  • Blog
  • Investors
  • Contact
  • System status

Legal

  • Privacy
  • Terms
  • Acceptable use
  • Security
  • Accessibility

© 2026 Eager Lobster Ltd, trading as whoot. Registered in England and Wales, company number 17038042.

Registered office: First Floor, 1 Des Roches Square, Witan Way, Witney, OX28 4BE. Prices exclude VAT and other applicable taxes.

all systems operational