Skip to main content
navan-entity-management Manage Navan users, departments, cost centers, and approval chains via API and SCIM provisioning.
Use when onboarding departments, integrating identity providers, or auditing user access.
Trigger with "navan entity management", "navan user management", "navan SCIM setup".
跳到安装 Skills Marketplace 发现并探索由社区构建的 Agent Skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill navan-entity-management命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
下载 Zip 下载中... 同仓库更多 Skills Implement user sign-up and sign-in flows with Clerk.
Use when building authentication UI, customizing sign-in experience,
or implementing OAuth social login.
Trigger with phrases like "clerk sign-in", "clerk sign-up",
"clerk login flow", "clerk OAuth", "clerk social login".
Implement session management and middleware with Clerk.
Use when managing user sessions, configuring route protection,
or implementing token refresh and custom JWT templates.
Trigger with phrases like "clerk session", "clerk middleware",
"clerk route protection", "clerk token", "clerk JWT".
Configure enterprise SSO, role-based access control, and organization management.
Use when implementing SSO integration, configuring role-based permissions,
or setting up organization-level controls.
Trigger with phrases like "clerk SSO", "clerk RBAC",
"clerk enterprise", "clerk roles", "clerk permissions", "clerk organizations".
jeremylongshore
jeremylongshore/claude-code-plugins-plus-skills
打开 GitHub 仓库 name navan-entity-management description Manage Navan users, departments, cost centers, and approval chains via API and SCIM provisioning.
Use when onboarding departments, integrating identity providers, or auditing user access.
Trigger with "navan entity management", "navan user management", "navan SCIM setup".
allowed-tools Read, Write, Edit, Bash(npm:*), Bash(curl:*), Grep version 1.7.0 license MIT author Jeremy Longshore <jeremy@intentsolutions.io> tags ["saas","navan","travel"] compatibility Designed for Claude Code
Navan — Entity Management
Overview
This skill covers organizational entity management in Navan: users, departments, cost centers, and approval chains. Navan supports two approaches for user lifecycle management — the REST API with GET /get_users for querying and auditing, and SCIM 2.0 provisioning for automated sync with identity providers like Okta, Entra ID (Azure AD), and OneLogin. Travel policies are assigned at the department level, and approval chains support multi-level routing based on expense thresholds and trip types. This skill is essential for organizations managing 100+ travelers.
Prerequisites
Navan account with admin-level API credentials (see navan-install-auth)
OAuth 2.0 token with admin scope
For SCIM: Okta, Entra ID, or OneLogin with SCIM 2.0 support
For SSO: SAML 2.0 or Google Workspace configured in Navan Admin
Environment variables: NAVAN_CLIENT_ID, NAVAN_CLIENT_SECRET, NAVAN_BASE_URL
Instructions
Step 1: Authenticate and Retrieve Booking Data
const tokenRes = await fetch (`${process.env.NAVAN_BASE_URL} /ta-auth/oauth/token` , {
method : 'POST' ,
headers : { 'Content-Type' : 'application/x-www-form-urlencoded' },
body : new URLSearchParams ({
grant_type : 'client_credentials' ,
client_id : process.env .NAVAN_CLIENT_ID !,
client_secret : process.env .NAVAN_CLIENT_SECRET !,
}),
});
const { access_token } = await tokenRes.json ();
const headers = { Authorization : `Bearer ${access_token} ` };
const
await
fetch
`${process.env.NAVAN_BASE_URL} /v1/bookings?page=0&size=50`
const
data
await
json
const
new
Map
map
(b : any
traveler_email
values
forEach
(user : any
console
log
`${user.email} | Role: ${user.role} | Dept: ${user.department} `
console
log
` Cost Center: ${user.cost_center} | Manager: ${user.manager_email} `
console
log
` Travel Policy: ${user.travel_policy_name} `
Step 2: Audit User Access and Roles
interface UserAudit {
email : string ;
role : string ;
department : string ;
hasManagerAssigned : boolean ;
hasCostCenter : boolean ;
hasTravelPolicy : boolean ;
}
const audit : UserAudit [] = users.map ((u : any ({
email : u.email ,
role : u.role ,
department : u.department ?? 'UNASSIGNED' ,
hasManagerAssigned : Boolean (u.manager_email ),
hasCostCenter : Boolean (u.cost_center ),
hasTravelPolicy : Boolean (u.travel_policy_name ),
}));
const incomplete = audit.filter (
u =>hasManagerAssigned || !u.hasCostCenter || !u.hasTravelPolicy
);
console .log (`\nUsers with incomplete setup: ${incomplete.length} /${audit.length} ` );
incomplete.forEach (u =>const missing = [];
if (!u.hasManagerAssigned ) missing.push ('manager' );
if (!u.hasCostCenter ) missing.push ('cost_center' );
if (!u.hasTravelPolicy ) missing.push ('travel_policy' );
console .log (` ${u.email} : missing ${missing.join(', ' )} ` );
});
Step 3: Configure SCIM Provisioning (Okta) SCIM 2.0 enables automated user lifecycle management. Configure in the Navan admin console:
Navigate to Admin > Travel admin > Settings > Identity Provider
Select "SCIM 2.0" as the provisioning method
Copy the SCIM endpoint URL and bearer token
Add the Navan application from the OIN catalog
Configure provisioning with the SCIM endpoint URL
Enable: Create Users, Update User Attributes, Deactivate Users
Map attributes: userName, email, department, costCenter, manager
curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer ${NAVAN_SCIM_TOKEN} " \
"${NAVAN_SCIM_URL} /Users?count=1"
Step 4: Configure SCIM Provisioning (Entra ID) For Microsoft Entra ID (formerly Azure AD):
In Entra ID portal, add Navan as an Enterprise Application
Under Provisioning, set mode to "Automatic"
Enter the Navan SCIM tenant URL and secret token
Map attributes: userPrincipalName -> userName, department, companyName
Enable provisioning and set scope to "Sync only assigned users"
Step 5: Department and Cost Center Structure
const byDepartment : Record <string , any []> = {};
users.forEach ((u : any {
const dept = u.department ?? 'Unassigned' ;
if (!byDepartment[dept]) byDepartment[dept] = [];
byDepartment[dept].push (u);
});
console .log ('\nDepartment Summary:' );
Object .entries (byDepartment)
.sort ((a, b ) => b[1 ].length - a[1 ].length )
.forEach (([dept, members] ) => {
const costCenters = [...new Set (members.map ((m : any m.cost_center ))];
console .log (` ${dept} : ${members.length} users, cost centers: ${costCenters.join(', ' )} ` );
});
Step 6: Approval Chain Configuration
interface ApprovalChain {
department : string ;
levels : {
threshold : number ;
approverRole : string ;
approverEmail : string ;
}[];
}
const approvalChains : ApprovalChain [] = [
{
department : 'Engineering' ,
levels : [
{ threshold : 500 , approverRole : 'manager' , approverEmail : 'eng-mgr@company.com' },
{ threshold : 2000 , approverRole : 'director' , approverEmail : 'eng-dir@company.com' },
{ threshold : Infinity , approverRole : 'vp' , approverEmail : 'vp-eng@company.com' },
],
},
{
department : 'Sales' ,
levels : [
{ threshold : 1000 , approverRole : 'manager' , approverEmail : 'sales-mgr@company.com' },
{ threshold : 5000 , approverRole : 'director' , approverEmail : 'sales-dir@company.com' },
{ threshold : Infinity , approverRole : 'cro' , approverEmail : 'cro@company.com' },
],
},
];
function routeForApproval (dept : string , amount : number string {
const chain = approvalChains.find (c =>department === dept);
if (!chain) return 'finance@company.com' ;
const level = chain.levels .find (l =>threshold );
return level?.approverEmail ?? 'cfo@company.com' ;
}
Output Successful execution produces:
Complete user roster with roles, departments, cost centers, and policy assignments
Access audit report identifying users with incomplete configuration
SCIM provisioning configuration for Okta or Entra ID
Department hierarchy with cost center mappings
Approval chain definitions with threshold-based routing
Error Handling Error HTTP Code Cause Solution Unauthorized 401 Expired or invalid bearer token Re-authenticate via POST /ta-auth/oauth/token Forbidden 403 Non-admin credentials used Verify admin-level API credentials Rate Limited 429 Too many requests Implement exponential backoff (start at 1s) SCIM Auth Failed 401 Invalid SCIM bearer token Regenerate token in Navan Admin > Identity Provider SCIM Mapping Error 400 Missing required attribute Verify userName and email mappings in IdP Server Error 500 Navan platform issue Retry with backoff; check Navan status page
Examples Python — User audit with CSV export:
import requests
import csv
import os
base_url = os.environ.get('NAVAN_BASE_URL' , 'https://api.navan.com' )
auth = requests.post(f'{base_url} /ta-auth/oauth/token' , data={
'grant_type' : 'client_credentials' ,
'client_id' : os.environ['NAVAN_CLIENT_ID' ],
'client_secret' : os.environ['NAVAN_CLIENT_SECRET' ],
})
headers = {'Authorization' : f'Bearer {auth.json()["access_token" ]} ' }
resp = requests.get(f'{base_url} /v1/bookings' , params={'page' : 0 , 'size' : 50 }, headers=headers).json()
bookings = resp['data' ]
users = list ({b.get('traveler_email' ): b for b in bookings}.values())
with open ('navan-user-audit.csv' , 'w' , newline='' ) as f:
writer = csv.DictWriter(f, fieldnames=[
'email' , 'role' , 'department' , 'cost_center' , 'manager' , 'policy'
])
writer.writeheader()
for u in users:
writer.writerow({
'email' : u.get('email' ),
'role' : u.get('role' ),
'department' : u.get('department' , '' ),
'cost_center' : u.get('cost_center' , '' ),
'manager' : u.get('manager_email' , '' ),
'policy' : u.get('travel_policy_name' , '' ),
})
print (f'Exported {len (users)} users to navan-user-audit.csv' )
Resources
Next Steps After configuring entities, proceed to navan-core-workflow-a for travel booking workflows or navan-enterprise-rbac for role-based access control.
