TrustInsider
English
Analyse your brand

User manual

Manage Enterprise access and APIs

Enterprise and access covers identity, groups and provisioning; API and MCP covers reading published results. The screen’s required plan, role and enablement apply: seeing a panel does not mean you can create access.

Section 1

Check the access scope

Groups and roles, corporate identity and machine access serve different purposes. Telling them apart before you start avoids using a credential for the wrong purpose, such as an identity token to read results.

Do not use a SCIM token as a results API credential. SCIM manages identities; API and MCP tokens have read-only scopes over authorised publications.

  1. Open Enterprise and access and read your role and any plan or availability restrictions.
  2. Follow the groups-and-roles signpost for companies, groups and members.
  3. Open identity for corporate login and API and MCP for external systems reading results.
Access scope of a group: linked companies and brands and the table of roles and permissions set by the server (fictional brand, demo data)
Demo data · Ilmarde Audio

Section 2

Configure and test corporate login

The OIDC panel shows the callback address and fields for connecting your identity provider. It also tells you when corporate login can become mandatory, so enforcement never starts before a successful login.

A connection test is not a successful user login. The screen prevents enforcement until the required first login exists. Never share secrets in chat, tickets or documents.

  1. Register the displayed callback with your provider and enter the HTTPS issuer, client ID and secret only in the private form.
  2. Save the configuration and run the test; read its outcome and last-test time.
  3. Verify a successful SSO login before making corporate login mandatory, then apply the state after reading its conditions.
OIDC identity provider setup: the callback address to register, issuer, client ID, client secret and the verified-email exception (fictional brand, demo data)
Demo data · Ilmarde Audio

Section 3

Verify the declared domains

Adding a domain creates a verification request, not completed proof of ownership. The panel shows the record to publish and the confirmation status, which matters before you treat the domain as verified.

A listed domain is not necessarily verified. Removal requires the panel’s confirmation and checking the refreshed status.

  1. Enter the domain and read the TXT name and value returned by the panel.
  2. Ask the DNS administrator to publish the record in the correct zone.
  3. Use Verify and check the status and confirmation time; if pending, recheck the record before retrying.
Verified domains: the TXT record to add to DNS, its value, the domain status and the commands to verify or remove it (fictional brand, demo data)
Demo data · Ilmarde Audio

Section 4

Prepare the SCIM provisioning

The panel separates the SCIM address, tokens and provisioned-user summary. You can see which users arrive from your identity system and with which credentials, without confusing them with read tokens.

A created token does not prove provisioning has succeeded. The full value is not displayed again in the list: if lost, revoke it and create a new authorised credential.

  1. Check the displayed address and create a SCIM token with a suitable name and expiry when allowed.
  2. Store the value shown once in a secret manager and configure the authorised identity system.
  3. Review users and last use; revoke unused tokens with the required confirmation.
  4. Provisioning manages users, not group synchronisation, and grants read access within the plan’s capacity. Deactivating an active user also signs out their sessions; deleting the SCIM resource does not delete their account or accounting records.
SCIM 2.0 provisioning: the SCIM address to set in your provider, the managed members and the tokens with prefix, creation date and last use (fictional brand, demo data)
Demo data · Ilmarde Audio

Section 5

Publish resources and restrict the read token

With the Enterprise plan, API and MCP expose only results published by the owner, until their expiry. Here you choose what to publish and limit each token by brand, scopes and duration.

The token does not write or start collections. A scope does not automatically publish all workspace data; expired or unauthorised content does not become readable just because a token exists.

  1. In the publication form, choose brand and resource, enter required identifiers or dates and read the expiry before confirming.
  2. Create a token with a name, read scopes, brands, quota and expiry within the form’s limits.
  3. Store it in your secret manager and follow the screen’s REST or MCP instructions; check publications and last use.
Resources published for external systems: for each brand the resource, its publications, the latest, the first expiry and how long they stay readable (fictional brand, demo data)
Demo data · Ilmarde Audio

Section 6

Check webhooks, revocations and errors

Webhooks, included in the Enterprise plan, have their own destination, events and brands; their signing secret is separate from the read token. From here you follow deliveries and revoke unused access instead of creating new credentials whenever in doubt.

If plan, session, enablement or signing prevents the operation, use the displayed reason to address it. Do not bypass it by expanding scopes or blindly repeating creation.

  1. Select the webhook’s necessary events and brands and enter the authorised HTTPS destination.
  2. Store the secret shown once and check delivery outcomes and failures in the summary.
  3. Revoke unused access; after an uncertain outcome, reread the state before creating another credential.
Webhook table: destination, event, brand, last delivery, consecutive errors, status and the command to revoke it (fictional brand, demo data)
Demo data · Ilmarde Audio

Related paths

Definitions, FAQs, guides and methodology: from here you reach the material you need to read the results and explain them to your team in the same words.

From question to action

Learn how to use TrustInsider: choose the brand and the questions, read the collected answers, update your content and compare the results.

Read

Find the right answer

Help with access, credits, collections, integrations and data: guides, FAQs, the site assistant and support requests from your workspace.

Read
Apply the method to your brand