> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization settings and security

> Org-wide users, teams, groups, identity (SSO, SCIM, domains), API keys, audit logs, and support tokens

This page covers **organization-wide admin** — users, teams, groups, security (SSO, SCIM, domain policies), API keys, and audit. Per-team options (channels, SLAs, labels) live in [Team settings](/sections/documentation/platform/team-settings).

## Organization settings

Access organization settings by clicking your **organization name** at the top of the sidebar, then selecting **Settings**.

<Note>
  Only **Org Admins** can access organization settings.
</Note>

### Users

Manage everyone in your organization:

* View all users and their org roles (Member or Admin)
* Invite new users
* Deactivate users
* Change organization roles

### Teams

Create and manage teams:

* Create new teams with a name and prefix
* View team membership
* Delete teams

### Groups

Organize users into groups for easier management:

* Create groups
* Add/remove users from groups
* Use groups for [assignment rules](/sections/documentation/ticketing/ticket-configuration/assignment), [assignment groups](/sections/documentation/ticketing/ticket-configuration/assignment-groups) on tickets, and access policies

Org groups are managed once for the whole organization. Each team then chooses which groups it uses for ticket ownership and routing.

### Security: SSO, SCIM, and domains

<Note>
  A guided in-product setup for both SCIM and SSO is found within **Organizations → Security**.
</Note>

Serval connects identity providers using SAML 2.0 via [WorkOS](https://workos.com/), including Okta, Google Workspace, Azure AD (Microsoft Entra ID), OneLogin, JumpCloud, PingFederate, and other SAML 2.0 compliant providers.

#### SSO

* Connect and review **SSO** for your identity provider (SAML via WorkOS).
* Confirm **domain verification** and overall **SSO configured** status from the card.
* Use **Require SSO** when everyone must sign in through your IdP.

#### SCIM

SCIM keeps your IdP and Serval in sync for **users** and **groups**, via [WorkOS](https://workos.com/) Directory Sync. Supported providers include Okta, Microsoft Entra ID (Azure AD), Google Workspace, JumpCloud, OneLogin, Rippling, and other SCIM-capable IdPs. What SCIM controls:

* **Creates and deactivates Serval user accounts** as people are added to or removed from your IdP.
* **Imports your IdP's group list** into **Org Settings → Groups**.
* **Sets each user's organization-level role** — Org Admin or Org Member — based on the WorkOS role slug computed for them. The most common pattern is to map a dedicated IdP group (such as `serval-admins`) to the `admin` role in the WorkOS dashboard for the directory connection. See [WorkOS Directory Sync — Roles](https://workos.com/docs/directory-sync/guide/group-roles) for the dashboard steps.

<Tip>
  **SCIM controls identity. Serval controls team assignment.** SCIM keeps your user list in sync and decides who is an Org Admin vs. Org Member. **Team membership and team-level roles** (Manager, Agent, Builder, Viewer, Drafter, etc.) are configured in Serval — most commonly by adding a synced group to a team with a specific role under **Team Settings → Team Members → Add group**. Every member of that group then inherits the chosen role on that team, and adds/removes in your IdP flow through automatically.
</Tip>

#### Domain allowlist and filtering

* Turn **domain filtering** on or off for your organization.
* Add **allowed domains** so only matching email addresses stay in scope when users sync from connected directories and integrations.

##### Enforce domain filter

After allowed domains are saved, **Enforce Domain Filter** appears at the bottom of the domain allowlist card.

1. Click **Check Users** to run a **dry run**. Serval lists which users would be deactivated because their email does not match the allowlist.
2. Review the dialog. The admin running the check is **never** included in deactivation.
3. Confirm to deactivate all non-matching users in one step.

Users deactivated by enforcement remain deactivated while **domain filtering** stays enabled. Reactivation rules follow your domain policy until it changes.

### API keys

Manage programmatic access to Serval:

* Create API keys with specific scopes
* View and revoke existing keys
* See last usage timestamps

### AI Provider Keys

Use **AI Provider Keys** when your organization wants Serval to call supported LLM providers with keys that you own and manage. If no organization key is configured for a provider, Serval uses its platform key. When you add an organization key, Serval uses that key for LLM calls made on behalf of your organization for that provider.

Before configuring a key, create an API key in the provider's console and make sure the provider account has billing, model access, and rate limits that support your expected Serval usage. Serval currently supports organization overrides for **OpenAI** and **Anthropic**.

<Steps>
  <Step title="Open AI Provider Keys">
    Go to **Organization Settings** → **AI Provider Keys**. Only Org Admins can view or manage organization LLM keys.
  </Step>

  <Step title="Add a provider key">
    Choose **Set override** for OpenAI or Anthropic, paste the provider API key, then save. Serval runs a healthcheck before storing the key. If the healthcheck fails, the key is not saved.
  </Step>

  <Step title="Configure a custom endpoint, if needed">
    Leave **API base URL** blank to use the provider's default endpoint. Set it only when traffic should go through a compatible proxy or gateway, such as an OpenAI-compatible gateway. Serval healthchecks the endpoint before saving the override.
  </Step>

  <Step title="Verify the configuration">
    Use **Test now** to run a live healthcheck against the saved key and endpoint. The card shows whether the override is active and displays only the key ending, not the full key.
  </Step>
</Steps>

Keys are encrypted at rest. Updating a key replaces the stored value, and Serval never shows the full key after it is saved.

### Audit logs

View a record of actions taken in your organization:

* Filter by user, action type, or date range
* Export logs for compliance

### Support tokens

Enable time-bound access for Serval support engineers to assist with your tenant:

* **Generate tokens** — Users can create time-limited support tokens from the profile menu (**Get support**).
* **Automatic expiration** — Tokens expire after the configured duration with no manual cleanup required.
* **Full audit trail** — All access performed via support tokens is logged for compliance and transparency.

For steps, security details, and how to revoke access, see [Support → Support tokens](/sections/documentation/platform/support#support-tokens).

***

## Quick reference

| I want to...                | Go to...                                       |
| --------------------------- | ---------------------------------------------- |
| Invite a new user to Serval | **Org Settings** → **Users** → **Invite**      |
| Create a team               | **Org Settings** → **Teams** → **Create Team** |
| Set a default triage team   | **Org Settings** → **Teams**                   |
| Set up SSO                  | **Org Settings** → **Security**                |
| Create an API key           | **Org Settings** → **API Keys**                |
| Bring your own LLM key      | **Org Settings** → **AI Provider Keys**        |
| Add someone to my team      | **Team Settings** → **Team Members**           |
| Configure Slack channels    | **Team Settings** → **Channels**               |
| Set SLA targets             | **Team Settings** → **SLA**                    |
| Create ticket labels        | **Team Settings** → **Labels**                 |

<Note>
  Steps that use **Team Settings** are documented in [Team settings](/sections/documentation/platform/team-settings).
</Note>