From 8bb7149e74595920eb0af8df62e0c914b822e51d Mon Sep 17 00:00:00 2001
From: Cristian Ramon-Cortes <cristian.ramon-cortes@seqera.io>
Date: Fri, 2 Oct 2026 18:38:14 +0200
Subject: [PATCH 1/7] feat(compute-envs): add Intelligent Compute options to
 cloud platforms

Platform API 1.167.0 added SchedConfig fields that tw never set, so
Intelligent Compute CEs created from the CLI could not choose a
prediction model, NVMe/local-SSD instances, or the AWS backend strategy
and warm pool.

Options are added only where Platform accepts them, matching the
tower-web forms and WithSeqeraSchedulerSupport.validateSchedConfig:
- all cloud platforms: --prediction-model, --nvme-storage;
- aws-cloud only: --backend-strategy and the warm pool options
  (--warm-pool, --warm-pool-size, --warm-pool-scale-to-zero).

diskAllocation is not exposed: nvmeEnabled is Platform's boolean view
over it and its only value is 'nvme'.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../platforms/AwsCloudPlatform.java           | 46 +++++++--
 .../platforms/AzCloudPlatform.java            | 18 ++--
 .../platforms/GoogleCloudPlatform.java        | 18 ++--
 .../platforms/AwsCloudPlatformTest.java       | 98 +++++++++++++++++++
 .../platforms/AzCloudPlatformTest.java        | 72 ++++++++++++++
 .../platforms/GoogleCloudPlatformTest.java    | 72 ++++++++++++++
 6 files changed, 303 insertions(+), 21 deletions(-)

diff --git a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java
index a67a8ae3d..1e937a3e3 100644
--- a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java
+++ b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java
@@ -21,6 +21,7 @@
 import io.seqera.tower.model.AwsCloudConfig;
 import io.seqera.tower.model.ComputeEnvComputeConfig.PlatformEnum;
 import io.seqera.tower.model.SchedConfig;
+import io.seqera.tower.model.SchedConfigPool;
 import picocli.CommandLine.ArgGroup;
 import picocli.CommandLine.Option;
 
@@ -70,13 +71,13 @@ public AwsCloudConfig computeConfig() throws ApiException, IOException {
                 .allowBuckets(allowBuckets);
 
         if (sched != null) {
-            SchedConfig schedConfig = new SchedConfig();
-            if (sched.provisioningModel != null) {
-                schedConfig.provisioningModel(sched.provisioningModel);
-            }
-            if (sched.machineTypes != null) {
-                schedConfig.machineTypes(sched.machineTypes);
-            }
+            SchedConfig schedConfig = new SchedConfig()
+                    .provisioningModel(sched.provisioningModel)
+                    .machineTypes(sched.machineTypes)
+                    .predictionModel(sched.predictionModel)
+                    .nvmeEnabled(sched.nvmeEnabled)
+                    .backendStrategy(sched.backendStrategy)
+                    .pool(sched.warmPool());
             config.schedConfig(schedConfig);
         }
 
@@ -126,6 +127,37 @@ public static class SchedOptions {
 
         @Option(names = {"--sched-machine-types"}, description = "EC2 instance types for compute nodes managed by the Seqera scheduler. Comma-separated list (e.g., m5.xlarge,c5.2xlarge). Leave empty to let the scheduler select the most cost-effective types.", split = ",")
         public List<String> machineTypes;
+
+        @Option(names = {"--prediction-model"}, description = "Model the Seqera scheduler uses to predict task resource requirements. Suggested values: none, qr/v1, qr/v2, qr/v3. If absent, the scheduler default (none) applies.")
+        public String predictionModel;
+
+        @Option(names = {"--nvme-storage"}, description = "Restrict the Seqera scheduler to EC2 instance types that provide local SSD (NVMe) storage for faster I/O.")
+        public Boolean nvmeEnabled;
+
+        @Option(names = {"--backend-strategy"}, description = "Backend the Seqera scheduler uses to run tasks. ECS delegates task execution to AWS ECS; EC2 runs tasks directly on EC2 instances. Valid values: ECS, EC2.")
+        public SchedConfig.BackendStrategyEnum backendStrategy;
+
+        @Option(names = {"--warm-pool"}, description = "Keep a pool of idle VMs ready to absorb incoming tasks with minimal start latency. Requires --warm-pool-size. Only applies with --backend-strategy EC2.")
+        public Boolean warmPoolEnabled;
+
+        @Option(names = {"--warm-pool-size"}, description = "Number of idle VMs to keep in the warm pool. Must be greater than zero.")
+        public Integer warmPoolSize;
+
+        @Option(names = {"--warm-pool-scale-to-zero"}, paramLabel = "<seconds>", description = "Seconds of inactivity after which the warm pool scales to zero. Set to 0 to never scale to zero.")
+        public Integer warmPoolScaleToZeroSecs;
+
+        SchedConfigPool warmPool() {
+            if (warmPoolEnabled == null && warmPoolSize == null && warmPoolScaleToZeroSecs == null) {
+                return null;
+            }
+            if (Boolean.TRUE.equals(warmPoolEnabled) && (warmPoolSize == null || warmPoolSize < 1)) {
+                throw new TowerRuntimeException("Option --warm-pool requires --warm-pool-size greater than zero.");
+            }
+            return new SchedConfigPool()
+                    .enabled(warmPoolEnabled)
+                    .desiredWarm(warmPoolSize)
+                    .scaleToZeroSecs(warmPoolScaleToZeroSecs);
+        }
     }
 
     public static class AdvancedOptions {
diff --git a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AzCloudPlatform.java b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AzCloudPlatform.java
index 75bdd801a..dd4f600aa 100644
--- a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AzCloudPlatform.java
+++ b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AzCloudPlatform.java
@@ -69,13 +69,11 @@ public AzCloudConfig computeConfig() throws ApiException, IOException {
                 .resourceGroup(resourceGroup);
 
         if (sched != null) {
-            SchedConfig schedConfig = new SchedConfig();
-            if (sched.provisioningModel != null) {
-                schedConfig.provisioningModel(sched.provisioningModel);
-            }
-            if (sched.machineTypes != null) {
-                schedConfig.machineTypes(sched.machineTypes);
-            }
+            SchedConfig schedConfig = new SchedConfig()
+                    .provisioningModel(sched.provisioningModel)
+                    .machineTypes(sched.machineTypes)
+                    .predictionModel(sched.predictionModel)
+                    .nvmeEnabled(sched.nvmeEnabled);
             config.schedConfig(schedConfig);
         }
 
@@ -113,6 +111,12 @@ public static class SchedOptions {
 
         @Option(names = {"--sched-machine-types"}, description = "Azure VM sizes for compute nodes managed by the Seqera scheduler. Comma-separated list (e.g., Standard_D4s_v3,Standard_E4s_v3). Leave empty to let the scheduler select the most cost-effective sizes.", split = ",")
         public List<String> machineTypes;
+
+        @Option(names = {"--prediction-model"}, description = "Model the Seqera scheduler uses to predict task resource requirements. Suggested values: none, qr/v1, qr/v2, qr/v3. If absent, the scheduler default (none) applies.")
+        public String predictionModel;
+
+        @Option(names = {"--nvme-storage"}, description = "Restrict the Seqera scheduler to Azure VM sizes that provide local SSD storage for faster I/O.")
+        public Boolean nvmeEnabled;
     }
 
     public static class AdvancedOptions {
diff --git a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/GoogleCloudPlatform.java b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/GoogleCloudPlatform.java
index eeea3031f..fa8321553 100644
--- a/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/GoogleCloudPlatform.java
+++ b/src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/GoogleCloudPlatform.java
@@ -75,13 +75,11 @@ public GoogleCloudConfig computeConfig() throws ApiException, IOException {
                 .zone(zone);
 
         if (sched != null) {
-            SchedConfig schedConfig = new SchedConfig();
-            if (sched.provisioningModel != null) {
-                schedConfig.provisioningModel(sched.provisioningModel);
-            }
-            if (sched.machineTypes != null) {
-                schedConfig.machineTypes(sched.machineTypes);
-            }
+            SchedConfig schedConfig = new SchedConfig()
+                    .provisioningModel(sched.provisioningModel)
+                    .machineTypes(sched.machineTypes)
+                    .predictionModel(sched.predictionModel)
+                    .nvmeEnabled(sched.nvmeEnabled);
             config.schedConfig(schedConfig);
         }
 
@@ -148,6 +146,12 @@ public static class SchedOptions {
 
         @Option(names = {"--sched-machine-types"}, description = "Compute Engine machine types for compute nodes managed by the Seqera scheduler. Comma-separated list (e.g., n2-standard-4,c2-standard-8). Leave empty to let the scheduler select the most cost-effective types.", split = ",")
         public List<String> machineTypes;
+
+        @Option(names = {"--prediction-model"}, description = "Model the Seqera scheduler uses to predict task resource requirements. Suggested values: none, qr/v1, qr/v2, qr/v3. If absent, the scheduler default (none) applies.")
+        public String predictionModel;
+
+        @Option(names = {"--nvme-storage"}, description = "Restrict the Seqera scheduler to Compute Engine machine types that provide local SSD (NVMe) storage for faster I/O.")
+        public Boolean nvmeEnabled;
     }
 
     public static class AdvancedOptions {
diff --git a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java
index b35931e29..d352c6403 100644
--- a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java
+++ b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java
@@ -832,4 +832,102 @@ void testAddWithFusionMetricsDisabled(MockServerClient mock) throws IOException
         assertEquals(0, out.exitCode);
         assertEquals(expected.toString(), out.stdOut);
     }
+
+    @Test
+    void testAddWithIntelligentComputeOptions(MockServerClient mock) throws IOException {
+        mock.reset();
+
+        // given
+        mock.when(
+                request()
+                        .withMethod("GET")
+                        .withPath("/credentials")
+                        .withQueryStringParameter("platformId", "aws-cloud"),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"aws\",\"description\":null,\"discriminator\":\"aws\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
+        );
+
+        mock.when(
+                request()
+                        .withMethod("POST")
+                        .withPath("/compute-envs")
+                        .withBody(json("""
+                                {
+                                    "computeEnv": {
+                                        "name": "my-aws-cloud-ic",
+                                        "platform": "aws-cloud",
+                                        "config": {
+                                            "workDir": "s3://my-bucket",
+                                            "region": "us-east-1",
+                                            "fusion2Enabled": true,
+                                            "waveEnabled": true,
+                                            "schedEnabled": true,
+                                            "schedConfig": {
+                                                "predictionModel": "qr/v3",
+                                                "nvmeEnabled": true,
+                                                "backendStrategy": "EC2",
+                                                "pool": {
+                                                    "enabled": true,
+                                                    "desiredWarm": 2,
+                                                    "scaleToZeroSecs": 600
+                                                }
+                                            }
+                                        },
+                                        "credentialsId": "6XfOhoztUq6de3Dw3X9LSb"
+                                    }
+                                }""")),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"computeEnvId\":\"isnEDBLvHDAIteOEF44ow\"}")
+        );
+
+        // when
+        ExecOut out = exec(mock, "compute-envs", "add", "aws-cloud",
+                "-n", "my-aws-cloud-ic",
+                "--work-dir",
+                "s3://my-bucket",
+                "-r",
+                "us-east-1",
+                "--sched-enabled",
+                "--prediction-model",
+                "qr/v3",
+                "--nvme-storage",
+                "--backend-strategy",
+                "EC2",
+                "--warm-pool",
+                "--warm-pool-size",
+                "2",
+                "--warm-pool-scale-to-zero",
+                "600"
+        );
+
+        // then
+        var expected = new ComputeEnvAdded("aws-cloud", "isnEDBLvHDAIteOEF44ow", "my-aws-cloud-ic", null, USER_WORKSPACE_NAME);
+        assertEquals("", out.stdErr);
+        assertEquals(0, out.exitCode);
+        assertEquals(expected.toString(), out.stdOut);
+    }
+
+    @Test
+    void testAddWithWarmPoolWithoutSizeFails(MockServerClient mock) {
+        mock.reset();
+
+        ExecOut out = exec(mock, "compute-envs", "add", "aws-cloud",
+                "-n", "my-aws-cloud-pool",
+                "--work-dir", "s3://my-bucket",
+                "-r", "us-east-1",
+                "--sched-enabled",
+                "--warm-pool"
+        );
+
+        assertTrue(out.stdErr.contains("Option --warm-pool requires --warm-pool-size greater than zero."), "Expected warm pool size error, got: " + out.stdErr);
+        assertEquals(1, out.exitCode);
+    }
 }
diff --git a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AzCloudPlatformTest.java b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AzCloudPlatformTest.java
index 91de216b3..533161451 100644
--- a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AzCloudPlatformTest.java
+++ b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/AzCloudPlatformTest.java
@@ -242,4 +242,76 @@ void testAddWithScheduler(MockServerClient mock) throws IOException {
         assertEquals(0, out.exitCode);
         assertEquals(expected.toString(), out.stdOut);
     }
+
+    @Test
+    void testAddWithIntelligentComputeOptions(MockServerClient mock) throws IOException {
+        mock.reset();
+
+        // given
+        mock.when(
+                request()
+                        .withMethod("GET")
+                        .withPath("/credentials")
+                        .withQueryStringParameter("platformId", "azure-cloud"),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"azure\",\"description\":null,\"discriminator\":\"azure\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
+        );
+
+        mock.when(
+                request()
+                        .withMethod("POST")
+                        .withPath("/compute-envs")
+                        .withBody(json("""
+                                {
+                                    "computeEnv": {
+                                        "name": "my-azure-cloud-ic",
+                                        "platform": "azure-cloud",
+                                        "config": {
+                                            "workDir": "az://my-container",
+                                            "region": "eastus",
+                                            "resourceGroup": "my-resource-group",
+                                            "fusion2Enabled": true,
+                                            "waveEnabled": true,
+                                            "schedEnabled": true,
+                                            "schedConfig": {
+                                                "predictionModel": "qr/v3",
+                                                "nvmeEnabled": true
+                                            }
+                                        },
+                                        "credentialsId": "6XfOhoztUq6de3Dw3X9LSb"
+                                    }
+                                }""")),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"computeEnvId\":\"isnEDBLvHDAIteOEF44ow\"}")
+        );
+
+        // when
+        ExecOut out = exec(mock, "compute-envs", "add", "azure-cloud",
+                "-n", "my-azure-cloud-ic",
+                "--work-dir",
+                "az://my-container",
+                "-r",
+                "eastus",
+                "--resource-group",
+                "my-resource-group",
+                "--sched-enabled",
+                "--prediction-model",
+                "qr/v3",
+                "--nvme-storage"
+        );
+
+        // then
+        var expected = new ComputeEnvAdded("azure-cloud", "isnEDBLvHDAIteOEF44ow", "my-azure-cloud-ic", null, USER_WORKSPACE_NAME);
+        assertEquals("", out.stdErr);
+        assertEquals(0, out.exitCode);
+        assertEquals(expected.toString(), out.stdOut);
+    }
 }
diff --git a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/GoogleCloudPlatformTest.java b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/GoogleCloudPlatformTest.java
index 05b347fc9..904d75422 100644
--- a/src/test/java/io/seqera/tower/cli/computeenvs/platforms/GoogleCloudPlatformTest.java
+++ b/src/test/java/io/seqera/tower/cli/computeenvs/platforms/GoogleCloudPlatformTest.java
@@ -381,4 +381,76 @@ private static void mockCredentials(MockServerClient mock) {
                         .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"google\",\"description\":null,\"discriminator\":\"google\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
         );
     }
+
+    @Test
+    void testAddWithIntelligentComputeOptions(MockServerClient mock) throws IOException {
+        mock.reset();
+
+        // given
+        mock.when(
+                request()
+                        .withMethod("GET")
+                        .withPath("/credentials")
+                        .withQueryStringParameter("platformId", "google-cloud"),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"google\",\"description\":null,\"discriminator\":\"google\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
+        );
+
+        mock.when(
+                request()
+                        .withMethod("POST")
+                        .withPath("/compute-envs")
+                        .withBody(json("""
+                                {
+                                    "computeEnv": {
+                                        "name": "my-google-cloud-ic",
+                                        "platform": "google-cloud",
+                                        "config": {
+                                            "workDir": "gs://my-bucket",
+                                            "region": "us-central1",
+                                            "zone": "us-central1-a",
+                                            "fusion2Enabled": true,
+                                            "waveEnabled": true,
+                                            "schedEnabled": true,
+                                            "schedConfig": {
+                                                "predictionModel": "qr/v3",
+                                                "nvmeEnabled": true
+                                            }
+                                        },
+                                        "credentialsId": "6XfOhoztUq6de3Dw3X9LSb"
+                                    }
+                                }""")),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"computeEnvId\":\"isnEDBLvHDAIteOEF44ow\"}")
+        );
+
+        // when
+        ExecOut out = exec(mock, "compute-envs", "add", "google-cloud",
+                "-n", "my-google-cloud-ic",
+                "--work-dir",
+                "gs://my-bucket",
+                "-r",
+                "us-central1",
+                "-z",
+                "us-central1-a",
+                "--sched-enabled",
+                "--prediction-model",
+                "qr/v3",
+                "--nvme-storage"
+        );
+
+        // then
+        var expected = new ComputeEnvAdded("google-cloud", "isnEDBLvHDAIteOEF44ow", "my-google-cloud-ic", null, USER_WORKSPACE_NAME);
+        assertEquals("", out.stdErr);
+        assertEquals(0, out.exitCode);
+        assertEquals(expected.toString(), out.stdOut);
+    }
 }

From c267715ac2c9931443d4e9ec4fc1ddee0c298387 Mon Sep 17 00:00:00 2001
From: Cristian Ramon-Cortes <cristian.ramon-cortes@seqera.io>
Date: Fri, 2 Oct 2026 18:38:58 +0200
Subject: [PATCH 2/7] feat(organizations): add IdP group and SCIM commands

Platform API 1.167 added the organization IdP group catalog and SCIM
provisioning admin endpoints, which tw did not expose. Without them a
team could not be linked to an IdP group from the CLI, and SCIM tokens
could only be managed in the UI.

Add 'tw organizations idp-groups' (list, add, delete) and
'tw organizations scim' (view, create-token, rotate-token,
revoke-token). Both are gated by the IdP claims mapping feature
(TOWER_IDP_CLAIMS_MAPPING_ENABLED plus an optional org allowlist), which
is on by default in Enterprise and enabled in Seqera Cloud, so the help
text names the requirement instead of calling it enterprise-only.

'idp-groups delete' resolves the group by display name, so the
findIdpGroupByName helper lands here; 'teams --idp-group' reuses it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../tower/cli/commands/AbstractApiCmd.java    |   9 +
 .../tower/cli/commands/OrganizationsCmd.java  |   4 +
 .../commands/organizations/IdpGroupsCmd.java  |  35 ++++
 .../cli/commands/organizations/ScimCmd.java   |  37 ++++
 .../organizations/idpgroups/AddCmd.java       |  44 +++++
 .../organizations/idpgroups/DeleteCmd.java    |  56 ++++++
 .../organizations/idpgroups/ListCmd.java      |  40 +++++
 .../organizations/scim/CreateTokenCmd.java    |  40 +++++
 .../organizations/scim/RevokeTokenCmd.java    |  41 +++++
 .../organizations/scim/RotateTokenCmd.java    |  40 +++++
 .../commands/organizations/scim/ViewCmd.java  |  40 +++++
 .../organizations/IdpGroupAdded.java          |  36 ++++
 .../organizations/IdpGroupDeleted.java        |  35 ++++
 .../organizations/IdpGroupsList.java          |  51 ++++++
 .../organizations/ScimConfigView.java         |  57 +++++++
 .../organizations/ScimTokenCreated.java       |  48 ++++++
 .../organizations/ScimTokenRevoked.java       |  33 ++++
 .../OrganizationIdentityCmdTest.java          | 161 ++++++++++++++++++
 18 files changed, 807 insertions(+)
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/IdpGroupsCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/ScimCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/AddCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/DeleteCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/ListCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/scim/CreateTokenCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/scim/RevokeTokenCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/scim/RotateTokenCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/organizations/scim/ViewCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupAdded.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupDeleted.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupsList.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/organizations/ScimConfigView.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenCreated.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenRevoked.java
 create mode 100644 src/test/java/io/seqera/tower/cli/organizations/OrganizationIdentityCmdTest.java

diff --git a/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java b/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
index 628f90f05..e7b1cc76f 100644
--- a/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
@@ -63,6 +63,7 @@
 import io.seqera.tower.model.ComputeEnvResponseDto;
 import io.seqera.tower.model.Credentials;
 import io.seqera.tower.model.DataStudioQueryAttribute;
+import io.seqera.tower.model.IdpGroupEntry;
 import io.seqera.tower.model.ListComputeEnvsResponseEntry;
 import io.seqera.tower.model.ListPipelineVersionsResponse;
 import io.seqera.tower.model.ListWorkspacesAndOrgResponse;
@@ -548,6 +549,14 @@ protected OrgAndWorkspaceDto findOrganizationByRef(String organizationRef) throw
         return orgAndWorkspaceDbDtoList.stream().findFirst().orElseThrow(() -> new OrganizationNotFoundException(organizationRef));
     }
 
+    protected IdpGroupEntry findIdpGroupByName(Long orgId, String displayName) throws ApiException {
+        return orgsApi().listOrganizationIdpGroups(orgId).getGroups()
+                .stream()
+                .filter(group -> Objects.equals(group.getDisplayName(), displayName))
+                .findFirst()
+                .orElseThrow(() -> new TowerException(String.format("IdP group '%s' not found in organization '%d'", displayName, orgId)));
+    }
+
     protected List<Long> findOrCreateLabels(Long wspId, List<Label> labels) throws ApiException {
         if (labels != null && !labels.isEmpty()) {
             LabelsFinder finder = new LabelsFinder(labelsApi());
diff --git a/src/main/java/io/seqera/tower/cli/commands/OrganizationsCmd.java b/src/main/java/io/seqera/tower/cli/commands/OrganizationsCmd.java
index 543a1d04a..5f814203f 100644
--- a/src/main/java/io/seqera/tower/cli/commands/OrganizationsCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/OrganizationsCmd.java
@@ -18,8 +18,10 @@
 
 import io.seqera.tower.cli.commands.organizations.AddCmd;
 import io.seqera.tower.cli.commands.organizations.DeleteCmd;
+import io.seqera.tower.cli.commands.organizations.IdpGroupsCmd;
 import io.seqera.tower.cli.commands.organizations.ListCmd;
 import io.seqera.tower.cli.commands.organizations.QuotasCmd;
+import io.seqera.tower.cli.commands.organizations.ScimCmd;
 import io.seqera.tower.cli.commands.organizations.UpdateCmd;
 import io.seqera.tower.cli.commands.organizations.ViewCmd;
 import picocli.CommandLine;
@@ -34,6 +36,8 @@
                 UpdateCmd.class,
                 ViewCmd.class,
                 QuotasCmd.class,
+                IdpGroupsCmd.class,
+                ScimCmd.class,
         }
 )
 public class OrganizationsCmd extends AbstractRootCmd {
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/IdpGroupsCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/IdpGroupsCmd.java
new file mode 100644
index 000000000..eb5b4f669
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/IdpGroupsCmd.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations;
+
+import io.seqera.tower.cli.commands.AbstractRootCmd;
+import io.seqera.tower.cli.commands.organizations.idpgroups.AddCmd;
+import io.seqera.tower.cli.commands.organizations.idpgroups.DeleteCmd;
+import io.seqera.tower.cli.commands.organizations.idpgroups.ListCmd;
+import picocli.CommandLine.Command;
+
+@Command(
+        name = "idp-groups",
+        description = "Manage the organization IdP group catalog used to link teams to IdP groups. Requires IdP claims mapping to be enabled for the organization.",
+        subcommands = {
+                ListCmd.class,
+                AddCmd.class,
+                DeleteCmd.class,
+        }
+)
+public class IdpGroupsCmd extends AbstractRootCmd {
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/ScimCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/ScimCmd.java
new file mode 100644
index 000000000..020c0cf6b
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/ScimCmd.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations;
+
+import io.seqera.tower.cli.commands.AbstractRootCmd;
+import io.seqera.tower.cli.commands.organizations.scim.CreateTokenCmd;
+import io.seqera.tower.cli.commands.organizations.scim.RevokeTokenCmd;
+import io.seqera.tower.cli.commands.organizations.scim.RotateTokenCmd;
+import io.seqera.tower.cli.commands.organizations.scim.ViewCmd;
+import picocli.CommandLine.Command;
+
+@Command(
+        name = "scim",
+        description = "Manage SCIM provisioning for the organization. Requires IdP claims mapping to be enabled for the organization.",
+        subcommands = {
+                ViewCmd.class,
+                CreateTokenCmd.class,
+                RotateTokenCmd.class,
+                RevokeTokenCmd.class,
+        }
+)
+public class ScimCmd extends AbstractRootCmd {
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/AddCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/AddCmd.java
new file mode 100644
index 000000000..4c6a97212
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/AddCmd.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.idpgroups;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.IdpGroupAdded;
+import io.seqera.tower.model.CreateIdpGroupRequest;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "add",
+        description = "Add an IdP group manually"
+)
+public class AddCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Option(names = {"-n", "--name"}, description = "IdP group name. Must match exactly the value your IdP sends in the groups claim.", required = true)
+    public String name;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new IdpGroupAdded(organizationRef, orgsApi().createOrganizationIdpGroup(orgId, new CreateIdpGroupRequest().displayName(name)));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/DeleteCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/DeleteCmd.java
new file mode 100644
index 000000000..555fd34af
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/DeleteCmd.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.idpgroups;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.IdpGroupDeleted;
+import picocli.CommandLine.ArgGroup;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "delete",
+        description = "Delete a manually added IdP group. Groups pushed by SCIM can't be deleted."
+)
+public class DeleteCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @ArgGroup(multiplicity = "1")
+    GroupRef group;
+
+    static class GroupRef {
+        @Option(names = {"-i", "--id"}, description = "IdP group numeric identifier.")
+        Long id;
+
+        @Option(names = {"-n", "--name"}, description = "IdP group name.")
+        String name;
+    }
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        Long groupId = group.id != null ? group.id : findIdpGroupByName(orgId, group.name).getId();
+
+        orgsApi().deleteOrganizationIdpGroup(orgId, groupId);
+
+        return new IdpGroupDeleted(organizationRef, group.name != null ? group.name : groupId.toString());
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/ListCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/ListCmd.java
new file mode 100644
index 000000000..6f626e3c9
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/idpgroups/ListCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.idpgroups;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.IdpGroupsList;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "list",
+        description = "List IdP groups, both pushed by SCIM and added manually"
+)
+public class ListCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new IdpGroupsList(organizationRef, orgsApi().listOrganizationIdpGroups(orgId).getGroups());
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/scim/CreateTokenCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/CreateTokenCmd.java
new file mode 100644
index 000000000..8d8154122
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/CreateTokenCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.scim;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.ScimTokenCreated;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "create-token",
+        description = "Generate a SCIM bearer token. Revokes the active token, if any. The token is shown only once."
+)
+public class CreateTokenCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new ScimTokenCreated(organizationRef, orgsApi().createOrganizationScimToken(orgId), false);
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RevokeTokenCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RevokeTokenCmd.java
new file mode 100644
index 000000000..d14aafae3
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RevokeTokenCmd.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.scim;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.ScimTokenRevoked;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "revoke-token",
+        description = "Revoke the active SCIM bearer token"
+)
+public class RevokeTokenCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        orgsApi().revokeOrganizationScimToken(orgId);
+        return new ScimTokenRevoked(organizationRef);
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RotateTokenCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RotateTokenCmd.java
new file mode 100644
index 000000000..484717276
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/RotateTokenCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.scim;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.ScimTokenCreated;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "rotate-token",
+        description = "Revoke the active SCIM bearer token and generate a new one. The token is shown only once."
+)
+public class RotateTokenCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new ScimTokenCreated(organizationRef, orgsApi().rotateOrganizationScimToken(orgId), true);
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/organizations/scim/ViewCmd.java b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/ViewCmd.java
new file mode 100644
index 000000000..219feb645
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/organizations/scim/ViewCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.commands.organizations.scim;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.organizations.ScimConfigView;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "view",
+        description = "View SCIM configuration and token status"
+)
+public class ViewCmd extends AbstractApiCmd {
+
+    @Option(names = {"-o", "--organization"}, description = "Organization name or numeric ID. Specify either the unique organization name or the numeric organization ID returned by 'tw organizations list'.", required = true)
+    public String organizationRef;
+
+    @Override
+    protected Response exec() throws ApiException {
+        Long orgId = findOrganizationByRef(organizationRef).getOrgId();
+        return new ScimConfigView(organizationRef, orgsApi().describeOrganizationScimConfig(orgId));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupAdded.java b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupAdded.java
new file mode 100644
index 000000000..999195f26
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupAdded.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.model.IdpGroupEntry;
+
+public class IdpGroupAdded extends Response {
+
+    public final String organizationName;
+    public final IdpGroupEntry group;
+
+    public IdpGroupAdded(String organizationName, IdpGroupEntry group) {
+        this.organizationName = organizationName;
+        this.group = group;
+    }
+
+    @Override
+    public String toString() {
+        return ansi(String.format("%n  @|yellow IdP group '%s' (%d) added to %s organization|@%n", group.getDisplayName(), group.getId(), organizationName));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupDeleted.java b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupDeleted.java
new file mode 100644
index 000000000..a12e703ac
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupDeleted.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+
+public class IdpGroupDeleted extends Response {
+
+    public final String organizationName;
+    public final String group;
+
+    public IdpGroupDeleted(String organizationName, String group) {
+        this.organizationName = organizationName;
+        this.group = group;
+    }
+
+    @Override
+    public String toString() {
+        return ansi(String.format("%n  @|yellow IdP group '%s' deleted at %s organization|@%n", group, organizationName));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupsList.java b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupsList.java
new file mode 100644
index 000000000..664fec8a3
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/IdpGroupsList.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.utils.TableList;
+import io.seqera.tower.model.IdpGroupEntry;
+
+import java.io.PrintWriter;
+import java.util.List;
+
+public class IdpGroupsList extends Response {
+
+    public final String organizationName;
+    public final List<IdpGroupEntry> groups;
+
+    public IdpGroupsList(String organizationName, List<IdpGroupEntry> groups) {
+        this.organizationName = organizationName;
+        this.groups = groups;
+    }
+
+    @Override
+    public void toString(PrintWriter out) {
+        out.println(ansi(String.format("%n  @|bold IdP groups for %s organization:|@%n", organizationName)));
+
+        if (groups == null || groups.isEmpty()) {
+            out.println(ansi("    @|yellow No IdP groups found|@"));
+            return;
+        }
+
+        TableList table = new TableList(out, 3, "ID", "Name", "Source");
+        table.setPrefix("    ");
+        groups.forEach(group -> table.addRow(group.getId().toString(), group.getDisplayName(), group.getSource() == null ? null : group.getSource().toString()));
+        table.print();
+        out.println("");
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/ScimConfigView.java b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimConfigView.java
new file mode 100644
index 000000000..4ccd8fa9b
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimConfigView.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.utils.TableList;
+import io.seqera.tower.model.DescribeScimConfigResponse;
+
+import java.io.PrintWriter;
+
+import static io.seqera.tower.cli.utils.FormatHelper.formatDate;
+
+public class ScimConfigView extends Response {
+
+    public final String organizationName;
+    public final DescribeScimConfigResponse scim;
+
+    public ScimConfigView(String organizationName, DescribeScimConfigResponse scim) {
+        this.organizationName = organizationName;
+        this.scim = scim;
+    }
+
+    @Override
+    public Object getJSON() {
+        return scim;
+    }
+
+    @Override
+    public void toString(PrintWriter out) {
+        out.println(ansi(String.format("%n  @|bold SCIM configuration for %s organization:|@%n", organizationName)));
+        TableList table = new TableList(out, 2);
+        table.setPrefix("    ");
+        table.addRow("Endpoint URL", scim.getEndpointUrl());
+        table.addRow("SSO active", String.valueOf(scim.getSsoActive()));
+        table.addRow("Active token", String.valueOf(scim.getHasActiveToken()));
+        table.addRow("Token", scim.getMaskedToken());
+        table.addRow("Token created", formatDate(scim.getTokenCreatedAt()));
+        table.addRow("Token last used", formatDate(scim.getTokenLastUsed()));
+        table.addRow("Groups", scim.getGroupCount() == null ? null : scim.getGroupCount().toString());
+        table.print();
+        out.println("");
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenCreated.java b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenCreated.java
new file mode 100644
index 000000000..8955c1c93
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenCreated.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.model.CreateScimTokenResponse;
+
+public class ScimTokenCreated extends Response {
+
+    public final String organizationName;
+    public final CreateScimTokenResponse scimToken;
+
+    @JsonIgnore
+    private final boolean rotated;
+
+    public ScimTokenCreated(String organizationName, CreateScimTokenResponse scimToken, boolean rotated) {
+        this.organizationName = organizationName;
+        this.scimToken = scimToken;
+        this.rotated = rotated;
+    }
+
+    @Override
+    public Object getJSON() {
+        return scimToken;
+    }
+
+    @Override
+    public String toString() {
+        return rotated
+                ? ansi(String.format("%n  @|yellow SCIM token rotated for %s organization. Copy it now, it won't be shown again:|@%n%n    %s%n%n  SCIM endpoint URL: %s%n", organizationName, scimToken.getToken(), scimToken.getEndpointUrl()))
+                : ansi(String.format("%n  @|yellow SCIM token generated for %s organization. Copy it now, it won't be shown again:|@%n%n    %s%n%n  SCIM endpoint URL: %s%n", organizationName, scimToken.getToken(), scimToken.getEndpointUrl()));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenRevoked.java b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenRevoked.java
new file mode 100644
index 000000000..1706f3446
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/organizations/ScimTokenRevoked.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.responses.organizations;
+
+import io.seqera.tower.cli.responses.Response;
+
+public class ScimTokenRevoked extends Response {
+
+    public final String organizationName;
+
+    public ScimTokenRevoked(String organizationName) {
+        this.organizationName = organizationName;
+    }
+
+    @Override
+    public String toString() {
+        return ansi(String.format("%n  @|yellow SCIM token revoked for %s organization|@%n", organizationName));
+    }
+}
diff --git a/src/test/java/io/seqera/tower/cli/organizations/OrganizationIdentityCmdTest.java b/src/test/java/io/seqera/tower/cli/organizations/OrganizationIdentityCmdTest.java
new file mode 100644
index 000000000..aeed15e0a
--- /dev/null
+++ b/src/test/java/io/seqera/tower/cli/organizations/OrganizationIdentityCmdTest.java
@@ -0,0 +1,161 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.seqera.tower.cli.organizations;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import io.seqera.tower.cli.BaseCmdTest;
+import io.seqera.tower.cli.commands.enums.OutputType;
+import io.seqera.tower.cli.responses.organizations.IdpGroupAdded;
+import io.seqera.tower.cli.responses.organizations.IdpGroupDeleted;
+import io.seqera.tower.cli.responses.organizations.IdpGroupsList;
+import io.seqera.tower.cli.responses.organizations.ScimConfigView;
+import io.seqera.tower.cli.responses.organizations.ScimTokenCreated;
+import io.seqera.tower.cli.responses.organizations.ScimTokenRevoked;
+import io.seqera.tower.model.CreateScimTokenResponse;
+import io.seqera.tower.model.DescribeScimConfigResponse;
+import io.seqera.tower.model.IdpGroupEntry;
+import io.seqera.tower.model.ListIdpGroupsResponse;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+import org.mockserver.client.MockServerClient;
+import org.mockserver.matchers.MatchType;
+import org.mockserver.model.MediaType;
+
+import static io.seqera.tower.cli.utils.JsonHelper.parseJson;
+import static org.mockserver.matchers.Times.exactly;
+import static org.mockserver.model.HttpRequest.request;
+import static org.mockserver.model.HttpResponse.response;
+import static org.mockserver.model.JsonBody.json;
+
+class OrganizationIdentityCmdTest extends BaseCmdTest {
+
+    private static final String ORG_PATH = "/orgs/27736513644467";
+
+    private static final String IDP_GROUPS = """
+            {"groups": [{"id": 5, "displayName": "eng-admins", "source": "SCIM"}, {"id": 6, "displayName": "eng", "source": "MANUAL"}]}
+            """;
+
+    private static final String SCIM_TOKEN = """
+            {"endpointUrl": "https://tower.example/api/scim/v2", "maskedToken": "sqscim_ab...", "token": "sqscim_abcdef"}
+            """;
+
+    @BeforeEach
+    void mockUserWorkspaces(MockServerClient mock) {
+        mock.when(request().withMethod("GET").withPath("/user-info"))
+                .respond(response().withStatusCode(200).withBody(loadResource("user")).withContentType(MediaType.APPLICATION_JSON));
+        mock.when(request().withMethod("GET").withPath("/user/1264/workspaces"))
+                .respond(response().withStatusCode(200).withBody(loadResource("workspaces/workspaces_list")).withContentType(MediaType.APPLICATION_JSON));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testIdpGroupsList(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("GET").withPath(ORG_PATH + "/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "idp-groups", "list", "-o", "organization1");
+
+        assertOutput(format, out, new IdpGroupsList("organization1", parseJson(IDP_GROUPS, ListIdpGroupsResponse.class).getGroups()));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testIdpGroupsAdd(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        String created = "{\"id\": 7, \"displayName\": \"data-team\", \"source\": \"MANUAL\"}";
+        mock.when(
+                request().withMethod("POST").withPath(ORG_PATH + "/idp-groups")
+                        .withBody(json("{\"displayName\": \"data-team\"}", MatchType.STRICT)), exactly(1)
+        ).respond(response().withStatusCode(200).withBody(created).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "idp-groups", "add", "-o", "organization1", "-n", "data-team");
+
+        assertOutput(format, out, new IdpGroupAdded("organization1", parseJson(created, IdpGroupEntry.class)));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testIdpGroupsDeleteByName(OutputType format, MockServerClient mock) {
+        mock.when(request().withMethod("GET").withPath(ORG_PATH + "/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+        mock.when(request().withMethod("DELETE").withPath(ORG_PATH + "/idp-groups/6"), exactly(1))
+                .respond(response().withStatusCode(204));
+
+        ExecOut out = exec(format, mock, "organizations", "idp-groups", "delete", "-o", "organization1", "-n", "eng");
+
+        assertOutput(format, out, new IdpGroupDeleted("organization1", "eng"));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testIdpGroupsDeleteById(OutputType format, MockServerClient mock) {
+        mock.when(request().withMethod("DELETE").withPath(ORG_PATH + "/idp-groups/6"), exactly(1))
+                .respond(response().withStatusCode(204));
+
+        ExecOut out = exec(format, mock, "organizations", "idp-groups", "delete", "-o", "organization1", "-i", "6");
+
+        assertOutput(format, out, new IdpGroupDeleted("organization1", "6"));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testScimView(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        String body = """
+                {"endpointUrl": "https://tower.example/api/scim/v2", "groupCount": 3, "hasActiveToken": true, "maskedToken": "sqscim_ab...",
+                 "ssoActive": true, "tokenCreatedAt": "2026-09-01T10:00:00Z", "tokenLastUsed": null}
+                """;
+        mock.when(request().withMethod("GET").withPath(ORG_PATH + "/scim/config"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(body).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "scim", "view", "-o", "organization1");
+
+        assertOutput(format, out, new ScimConfigView("organization1", parseJson(body, DescribeScimConfigResponse.class)));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testScimCreateToken(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("POST").withPath(ORG_PATH + "/scim/token"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(SCIM_TOKEN).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "scim", "create-token", "-o", "organization1");
+
+        assertOutput(format, out, new ScimTokenCreated("organization1", parseJson(SCIM_TOKEN, CreateScimTokenResponse.class), false));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testScimRotateToken(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("POST").withPath(ORG_PATH + "/scim/token/rotate"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(SCIM_TOKEN).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "organizations", "scim", "rotate-token", "-o", "organization1");
+
+        assertOutput(format, out, new ScimTokenCreated("organization1", parseJson(SCIM_TOKEN, CreateScimTokenResponse.class), true));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testScimRevokeToken(OutputType format, MockServerClient mock) {
+        mock.when(request().withMethod("DELETE").withPath(ORG_PATH + "/scim/token"), exactly(1))
+                .respond(response().withStatusCode(204));
+
+        ExecOut out = exec(format, mock, "organizations", "scim", "revoke-token", "-o", "organization1");
+
+        assertOutput(format, out, new ScimTokenRevoked("organization1"));
+    }
+}

From f418a770d85c9163ceaaa7ba7479be6756ae85c9 Mon Sep 17 00:00:00 2001
From: Cristian Ramon-Cortes <cristian.ramon-cortes@seqera.io>
Date: Fri, 2 Oct 2026 18:39:25 +0200
Subject: [PATCH 3/7] feat(teams): link teams to IdP groups

API 1.167 added linking a team to an IdP group (idpGroupId on the team
create and update requests, idpGroupName on the team response), but tw
could not set or show it.

'teams add' and 'teams update' accept --idp-group <display name>,
resolved through the organization's IdP group catalog, and
'teams update --unlink-idp-group' clears the link. 'teams view' shows
the linked IdP group.

The update request's idpGroupId is tri-state: omitted keeps the link,
an explicit null removes it, so --unlink-idp-group sends null and an
update without either option leaves the link untouched.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../tower/cli/commands/teams/AddCmd.java      |  6 ++
 .../tower/cli/commands/teams/UpdateCmd.java   | 18 +++++
 .../tower/cli/responses/teams/TeamView.java   |  1 +
 .../seqera/tower/cli/teams/TeamsCmdTest.java  | 70 ++++++++++++++++++-
 4 files changed, 94 insertions(+), 1 deletion(-)

diff --git a/src/main/java/io/seqera/tower/cli/commands/teams/AddCmd.java b/src/main/java/io/seqera/tower/cli/commands/teams/AddCmd.java
index b45e373ea..c7053dfe2 100644
--- a/src/main/java/io/seqera/tower/cli/commands/teams/AddCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/teams/AddCmd.java
@@ -43,6 +43,9 @@ public class AddCmd extends AbstractTeamsCmd {
     @CommandLine.Option(names = {"-d", "--description"}, description = "Team description. Free-text description providing context about the team's purpose, members, or project scope.")
     public String teamDescription;
 
+    @CommandLine.Option(names = {"--idp-group"}, description = "Link the team to this IdP group (display name, see 'tw organizations idp-groups list'). Team membership is then managed by the IdP.")
+    public String idpGroup;
+
     @CommandLine.Option(names = {"--overwrite"}, description = "Overwrite existing team. If a team with this name already exists in the organization, delete it first before creating the new one. Use with caution as this removes all team members and permissions.", defaultValue = "false")
     public Boolean overwrite;
 
@@ -56,6 +59,9 @@ protected Response exec() throws ApiException, IOException {
 
         CreateTeamRequest request = new CreateTeamRequest();
         request.setTeam(team);
+        if (idpGroup != null) {
+            request.setIdpGroupId(findIdpGroupByName(orgAndWorkspaceDbDto.getOrgId(), idpGroup).getId());
+        }
 
         if(overwrite) tryDeleteTeam(orgAndWorkspaceDbDto.getOrgId(), teamName);
 
diff --git a/src/main/java/io/seqera/tower/cli/commands/teams/UpdateCmd.java b/src/main/java/io/seqera/tower/cli/commands/teams/UpdateCmd.java
index 22da709d9..bb6ef92a6 100644
--- a/src/main/java/io/seqera/tower/cli/commands/teams/UpdateCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/teams/UpdateCmd.java
@@ -21,6 +21,7 @@
 import io.seqera.tower.cli.responses.teams.TeamUpdated;
 import io.seqera.tower.model.TeamDbDto;
 import io.seqera.tower.model.UpdateTeamRequest;
+import picocli.CommandLine.ArgGroup;
 import picocli.CommandLine.Command;
 import picocli.CommandLine.Mixin;
 import picocli.CommandLine.Option;
@@ -43,6 +44,17 @@ public class UpdateCmd extends AbstractTeamsCmd {
     @Option(names = {"-d", "--description"}, description = "New team description.")
     public String description;
 
+    @ArgGroup
+    IdpGroup idpGroup;
+
+    static class IdpGroup {
+        @Option(names = {"--idp-group"}, description = "Link the team to this IdP group (display name, see 'tw organizations idp-groups list'). Team membership is then managed by the IdP.")
+        String name;
+
+        @Option(names = {"--unlink-idp-group"}, description = "Remove the IdP group link so team members can be managed manually again.")
+        boolean unlink;
+    }
+
     @Override
     protected Response exec() throws ApiException {
         Long orgId = findOrganizationByRef(organizationRef).getOrgId();
@@ -54,6 +66,12 @@ protected Response exec() throws ApiException {
                 .description(description != null ? description : team.getDescription())
                 .avatarId(avatarId(team.getAvatarUrl()));
 
+        if (idpGroup != null && idpGroup.unlink) {
+            request.idpGroupId(null);
+        } else if (idpGroup != null) {
+            request.idpGroupId(findIdpGroupByName(orgId, idpGroup.name).getId());
+        }
+
         teamsApi().updateOrganizationTeam(orgId, team.getTeamId(), request);
 
         return new TeamUpdated(organizationRef, request.getName());
diff --git a/src/main/java/io/seqera/tower/cli/responses/teams/TeamView.java b/src/main/java/io/seqera/tower/cli/responses/teams/TeamView.java
index 6bfb7c580..f3d688495 100644
--- a/src/main/java/io/seqera/tower/cli/responses/teams/TeamView.java
+++ b/src/main/java/io/seqera/tower/cli/responses/teams/TeamView.java
@@ -41,6 +41,7 @@ public void toString(PrintWriter out) {
         table.addRow("Name", team.getName());
         table.addRow("Description", team.getDescription());
         table.addRow("Members", team.getMembersCount() == null ? null : team.getMembersCount().toString());
+        table.addRow("IdP group", team.getIdpGroupName());
         table.print();
         out.println("");
     }
diff --git a/src/test/java/io/seqera/tower/cli/teams/TeamsCmdTest.java b/src/test/java/io/seqera/tower/cli/teams/TeamsCmdTest.java
index 28116771a..dee16c986 100644
--- a/src/test/java/io/seqera/tower/cli/teams/TeamsCmdTest.java
+++ b/src/test/java/io/seqera/tower/cli/teams/TeamsCmdTest.java
@@ -375,7 +375,11 @@ void testDeleteTeam(OutputType format, MockServerClient mock) {
 
     private static final String TEAM = """
             {"team": {"teamId": 69076469523589, "name": "team-test-1", "description": "a new team", "membersCount": 2,
-                      "avatarUrl": "https://tower.example/api/avatars/av123"}}
+                      "avatarUrl": "https://tower.example/api/avatars/av123", "idpGroupId": null, "idpGroupName": null}}
+            """;
+
+    private static final String IDP_GROUPS = """
+            {"groups": [{"id": 5, "displayName": "eng-admins", "source": "SCIM"}, {"id": 6, "displayName": "eng", "source": "MANUAL"}]}
             """;
 
     private void mockUserWorkspaces(MockServerClient mock) {
@@ -420,6 +424,70 @@ void testUpdateKeepsUnsetFieldsAndAvatar(OutputType format, MockServerClient moc
         assertOutput(format, out, new TeamUpdated("organization1", "team-renamed"));
     }
 
+    @Test
+    void testUpdateLinksIdpGroup(MockServerClient mock) {
+        mockUserWorkspaces(mock);
+        mockDescribeTeam(mock);
+        mock.when(request().withMethod("GET").withPath("/orgs/27736513644467/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+        mock.when(
+                request().withMethod("PUT").withPath(TEAM_PATH)
+                        .withBody(json("""
+                                {"name": "team-test-1", "description": "a new team", "avatarId": "av123", "idpGroupId": 6}
+                                """, MatchType.STRICT)), exactly(1)
+        ).respond(response().withStatusCode(204));
+
+        ExecOut out = exec(mock, "teams", "update", "-o", "organization1", "-i", "69076469523589", "--idp-group", "eng");
+
+        assertOutput(OutputType.console, out, new TeamUpdated("organization1", "team-test-1"));
+    }
+
+    @Test
+    void testUpdateUnlinksIdpGroup(MockServerClient mock) {
+        mockUserWorkspaces(mock);
+        mockDescribeTeam(mock);
+        mock.when(
+                request().withMethod("PUT").withPath(TEAM_PATH)
+                        .withBody(json("""
+                                {"name": "team-test-1", "description": "a new team", "avatarId": "av123", "idpGroupId": null}
+                                """, MatchType.STRICT)), exactly(1)
+        ).respond(response().withStatusCode(204));
+
+        ExecOut out = exec(mock, "teams", "update", "-o", "organization1", "-i", "69076469523589", "--unlink-idp-group");
+
+        assertOutput(OutputType.console, out, new TeamUpdated("organization1", "team-test-1"));
+    }
+
+    @Test
+    void testUpdateWithUnknownIdpGroup(MockServerClient mock) {
+        mockUserWorkspaces(mock);
+        mockDescribeTeam(mock);
+        mock.when(request().withMethod("GET").withPath("/orgs/27736513644467/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(mock, "teams", "update", "-o", "organization1", "-i", "69076469523589", "--idp-group", "missing");
+
+        assertEquals(errorMessage(out.app, new TowerException("IdP group 'missing' not found in organization '27736513644467'")), out.stdErr);
+        assertEquals(1, out.exitCode);
+    }
+
+    @Test
+    void testAddWithIdpGroup(MockServerClient mock) {
+        mockUserWorkspaces(mock);
+        mock.when(request().withMethod("GET").withPath("/orgs/27736513644467/idp-groups"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(IDP_GROUPS).withContentType(MediaType.APPLICATION_JSON));
+        mock.when(
+                request().withMethod("POST").withPath("/orgs/27736513644467/teams")
+                        .withBody(json("""
+                                {"team": {"name": "team-test"}, "idpGroupId": 5}
+                                """, MatchType.ONLY_MATCHING_FIELDS)), exactly(1)
+        ).respond(response().withStatusCode(200).withBody(loadResource("teams/teams_add")).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(mock, "teams", "add", "-o", "organization1", "-n", "team-test", "--idp-group", "eng-admins");
+
+        assertOutput(OutputType.console, out, new TeamAdded("organization1", "team-test"));
+    }
+
     @ParameterizedTest
     @EnumSource(OutputType.class)
     void testWorkspaces(OutputType format, MockServerClient mock) throws JsonProcessingException {

From b5ebeefb3a2bb7a3720b8b6606249a495198e3b8 Mon Sep 17 00:00:00 2001
From: Cristian Ramon-Cortes <cristian.ramon-cortes@seqera.io>
Date: Fri, 2 Oct 2026 18:39:54 +0200
Subject: [PATCH 4/7] feat(audit-logs): add audit-logs command

Platform API 1.167.0 added the v2 audit log endpoints (token-paged
list, describe and CSV export) and tw had no way to read them.

tw audit-logs list filters by a date range (--after/--before) and
pages with --max and --page-token; view shows one log; export writes
the CSV to a file (-o) or stdout, optionally with the target state
images (--state). The endpoints are installation-wide and reserved to
root users, which the help says.

view does not offer --state: the SDK (1.200.0 and 1.230.0) cannot
deserialize state images, because its generated oneOf deserializer
ignores the auditImageType discriminator and every image schema
matches.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/main/java/io/seqera/tower/cli/Tower.java  |   2 +
 .../tower/cli/commands/AbstractApiCmd.java    |   5 +
 .../tower/cli/commands/AuditLogsCmd.java      |  35 +++++
 .../auditlogs/AuditLogsFilterOptions.java     |  39 ++++++
 .../cli/commands/auditlogs/ExportCmd.java     |  60 ++++++++
 .../tower/cli/commands/auditlogs/ListCmd.java |  50 +++++++
 .../tower/cli/commands/auditlogs/ViewCmd.java |  40 ++++++
 .../cli/responses/auditlogs/AuditLogView.java |  78 +++++++++++
 .../auditlogs/AuditLogsExported.java          |  46 +++++++
 .../responses/auditlogs/AuditLogsList.java    |  64 +++++++++
 .../tower/cli/auditlogs/AuditLogsCmdTest.java | 128 ++++++++++++++++++
 11 files changed, 547 insertions(+)
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/AuditLogsCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/auditlogs/AuditLogsFilterOptions.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/auditlogs/ListCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/commands/auditlogs/ViewCmd.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogView.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsExported.java
 create mode 100644 src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsList.java
 create mode 100644 src/test/java/io/seqera/tower/cli/auditlogs/AuditLogsCmdTest.java

diff --git a/src/main/java/io/seqera/tower/cli/Tower.java b/src/main/java/io/seqera/tower/cli/Tower.java
index 68c8c9e70..74a922949 100644
--- a/src/main/java/io/seqera/tower/cli/Tower.java
+++ b/src/main/java/io/seqera/tower/cli/Tower.java
@@ -23,6 +23,7 @@
 import io.seqera.tower.cli.commands.AbstractCmd;
 import io.seqera.tower.cli.commands.AccessTokensCmd;
 import io.seqera.tower.cli.commands.ActionsCmd;
+import io.seqera.tower.cli.commands.AuditLogsCmd;
 import io.seqera.tower.cli.commands.CollaboratorsCmd;
 import io.seqera.tower.cli.commands.ComputeEnvsCmd;
 import io.seqera.tower.cli.commands.CredentialsCmd;
@@ -62,6 +63,7 @@
         subcommands = {
                 AccessTokensCmd.class,
                 ActionsCmd.class,
+                AuditLogsCmd.class,
                 CollaboratorsCmd.class,
                 ComputeEnvsCmd.class,
                 CredentialsCmd.class,
diff --git a/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java b/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
index e7b1cc76f..cf52ab0e2 100644
--- a/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/AbstractApiCmd.java
@@ -19,6 +19,7 @@
 import io.seqera.tower.ApiClient;
 import io.seqera.tower.ApiException;
 import io.seqera.tower.api.ActionsApi;
+import io.seqera.tower.api.AdminApi;
 import io.seqera.tower.api.AvatarsApi;
 import io.seqera.tower.api.ComputeEnvsApi;
 import io.seqera.tower.api.CredentialsApi;
@@ -207,6 +208,10 @@ protected ActionsApi actionsApi() throws ApiException {
         return actionsApi == null ? new ActionsApi(apiClient()) : actionsApi;
     }
 
+    protected AdminApi adminApi() throws ApiException {
+        return new AdminApi(apiClient());
+    }
+
     protected AvatarsApi avatarsApi() throws ApiException {
         return avatarsApi == null ? new AvatarsApi(apiClient()) : avatarsApi;
     }
diff --git a/src/main/java/io/seqera/tower/cli/commands/AuditLogsCmd.java b/src/main/java/io/seqera/tower/cli/commands/AuditLogsCmd.java
new file mode 100644
index 000000000..9b2811486
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/AuditLogsCmd.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands;
+
+import io.seqera.tower.cli.commands.auditlogs.ExportCmd;
+import io.seqera.tower.cli.commands.auditlogs.ListCmd;
+import io.seqera.tower.cli.commands.auditlogs.ViewCmd;
+import picocli.CommandLine.Command;
+
+@Command(
+        name = "audit-logs",
+        description = "Inspect the installation audit logs. Requires a root user (platform administrator).",
+        subcommands = {
+                ListCmd.class,
+                ViewCmd.class,
+                ExportCmd.class,
+        }
+)
+public class AuditLogsCmd extends AbstractRootCmd {
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/AuditLogsFilterOptions.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/AuditLogsFilterOptions.java
new file mode 100644
index 000000000..12c8d8d41
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/AuditLogsFilterOptions.java
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands.auditlogs;
+
+import picocli.CommandLine.ITypeConverter;
+import picocli.CommandLine.Option;
+
+import java.time.OffsetDateTime;
+
+public class AuditLogsFilterOptions {
+
+    @Option(names = {"--after"}, description = "Show only logs on or after this ISO-8601 date-time, e.g. 2026-01-31T00:00:00Z", converter = DateTimeConverter.class)
+    public OffsetDateTime after;
+
+    @Option(names = {"--before"}, description = "Show only logs on or before this ISO-8601 date-time, e.g. 2026-01-31T23:59:59Z", converter = DateTimeConverter.class)
+    public OffsetDateTime before;
+
+    public static class DateTimeConverter implements ITypeConverter<OffsetDateTime> {
+        @Override
+        public OffsetDateTime convert(String value) {
+            return OffsetDateTime.parse(value);
+        }
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java
new file mode 100644
index 000000000..40ef754fb
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands.auditlogs;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogsExported;
+import io.seqera.tower.model.AuditLogV2QueryAttribute;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Mixin;
+import picocli.CommandLine.Option;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.util.List;
+
+@Command(
+        name = "export",
+        description = "Export audit logs as CSV. Fails when too many logs match: narrow the date range. Requires a root user."
+)
+public class ExportCmd extends AbstractApiCmd {
+
+    @Mixin
+    public AuditLogsFilterOptions filter;
+
+    @Option(names = {"--state"}, description = "Include the state of each target before and after the change. Requires the audit state images feature.")
+    public boolean state;
+
+    @Option(names = {"-o", "--output"}, description = "Output CSV file path. Prints the CSV to stdout when omitted.")
+    public Path output;
+
+    @Override
+    protected Response exec() throws ApiException, IOException {
+        File csv = adminApi().exportAuditLogsV2Csv(state ? List.of(AuditLogV2QueryAttribute.state) : null, filter.after, filter.before);
+        if (output == null) {
+            return new AuditLogsExported(null, Files.readString(csv.toPath()));
+        }
+        Files.move(csv.toPath(), output, StandardCopyOption.REPLACE_EXISTING);
+        return new AuditLogsExported(output.toString(), null);
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/ListCmd.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ListCmd.java
new file mode 100644
index 000000000..12fd4b925
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ListCmd.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands.auditlogs;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogsList;
+import io.seqera.tower.model.ListAuditLogV2Response;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Mixin;
+import picocli.CommandLine.Option;
+
+
+@Command(
+        name = "list",
+        description = "List audit logs, newest first. Requires a root user."
+)
+public class ListCmd extends AbstractApiCmd {
+
+    @Mixin
+    public AuditLogsFilterOptions filter;
+
+    @Option(names = {"--max"}, description = "Maximum number of logs per page")
+    public Integer max;
+
+    @Option(names = {"--page-token"}, description = "Token of the page to show, as printed by a previous list with the same filters")
+    public String pageToken;
+
+    @Override
+    protected Response exec() throws ApiException {
+        ListAuditLogV2Response response = adminApi().listAuditLogsV2(null, pageToken, max, filter.after, filter.before);
+        return new AuditLogsList(response.getAuditLogs(), response.getNextPageToken());
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/ViewCmd.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ViewCmd.java
new file mode 100644
index 000000000..f2b87372a
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ViewCmd.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.commands.auditlogs;
+
+import io.seqera.tower.ApiException;
+import io.seqera.tower.cli.commands.AbstractApiCmd;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogView;
+import picocli.CommandLine.Command;
+import picocli.CommandLine.Option;
+
+@Command(
+        name = "view",
+        description = "View an audit log. Requires a root user."
+)
+public class ViewCmd extends AbstractApiCmd {
+
+    @Option(names = {"-i", "--id"}, description = "Audit log identifier", required = true)
+    public Long id;
+
+    @Override
+    protected Response exec() throws ApiException {
+        return new AuditLogView(adminApi().describeAuditLogV2(id, null));
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogView.java b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogView.java
new file mode 100644
index 000000000..d9bfd41a4
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogView.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.responses.auditlogs;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import io.seqera.tower.cli.exceptions.TowerRuntimeException;
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.utils.TableList;
+import io.seqera.tower.model.AuditLogV2ResponseDto;
+import io.seqera.tower.model.AuditLogV2ResponseDtoActor;
+import io.seqera.tower.model.AuditLogV2ResponseDtoClient;
+import io.seqera.tower.model.AuditLogV2ResponseDtoTarget;
+
+import java.io.PrintWriter;
+import java.util.Objects;
+
+import static io.seqera.tower.cli.utils.FormatHelper.formatDate;
+import static io.seqera.tower.cli.utils.JsonHelper.prettyJson;
+
+public class AuditLogView extends Response {
+
+    public final AuditLogV2ResponseDto auditLog;
+
+    public AuditLogView(AuditLogV2ResponseDto auditLog) {
+        this.auditLog = auditLog;
+    }
+
+    @Override
+    public void toString(PrintWriter out) {
+        AuditLogV2ResponseDtoActor actor = auditLog.getActor() == null ? new AuditLogV2ResponseDtoActor() : auditLog.getActor();
+        AuditLogV2ResponseDtoClient client = auditLog.getClient() == null ? new AuditLogV2ResponseDtoClient() : auditLog.getClient();
+        AuditLogV2ResponseDtoTarget target = auditLog.getTarget() == null ? new AuditLogV2ResponseDtoTarget() : auditLog.getTarget();
+
+        out.println(ansi(String.format("%n  @|bold Audit log:|@%n")));
+        TableList table = new TableList(out, 2);
+        table.setPrefix("    ");
+        table.addRow("ID", auditLog.getId());
+        table.addRow("Timestamp", formatDate(auditLog.getTimestamp()));
+        table.addRow("Event", auditLog.getEvent() == null ? "" : auditLog.getEvent().getValue());
+        table.addRow("Correlation ID", Objects.toString(auditLog.getCorrelationId(), ""));
+        table.addRow("Actor", Objects.toString(actor.getUserName(), ""));
+        table.addRow("Actor email", Objects.toString(actor.getEmail(), ""));
+        table.addRow("Actor type", actor.getType() == null ? "" : actor.getType().getValue());
+        table.addRow("Client IP", Objects.toString(client.getIp(), ""));
+        table.addRow("User agent", Objects.toString(client.getUserAgent(), ""));
+        table.addRow("Target type", Objects.toString(target.getType(), ""));
+        table.addRow("Target ID", Objects.toString(target.getId(), ""));
+        table.addRow("Target name", Objects.toString(target.getName(), ""));
+        table.addRow("Organization", target.getOrganization() == null ? "" : Objects.toString(target.getOrganization().getName(), ""));
+        table.addRow("Workspace", target.getWorkspace() == null ? "" : Objects.toString(target.getWorkspace().getName(), ""));
+        table.print();
+
+        if (target.getState() != null) {
+            out.println(ansi(String.format("%n  @|bold Target state:|@%n")));
+            try {
+                out.println(prettyJson(target.getState()));
+            } catch (JsonProcessingException e) {
+                throw new TowerRuntimeException("Unable to format the audit log state: " + e.getMessage());
+            }
+        }
+        out.println("");
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsExported.java b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsExported.java
new file mode 100644
index 000000000..862793640
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsExported.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.responses.auditlogs;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import io.seqera.tower.cli.responses.Response;
+
+import java.util.Map;
+
+public class AuditLogsExported extends Response {
+
+    public final String file;
+
+    @JsonIgnore
+    private final String csv;
+
+    public AuditLogsExported(String file, String csv) {
+        this.file = file;
+        this.csv = csv;
+    }
+
+    @Override
+    public Object getJSON() {
+        return file != null ? this : Map.of("csv", csv);
+    }
+
+    @Override
+    public String toString() {
+        return file != null ? ansi(String.format("%n  @|yellow Audit logs exported to '%s'|@%n", file)) : csv;
+    }
+}
diff --git a/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsList.java b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsList.java
new file mode 100644
index 000000000..b1ec90a26
--- /dev/null
+++ b/src/main/java/io/seqera/tower/cli/responses/auditlogs/AuditLogsList.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.responses.auditlogs;
+
+import io.seqera.tower.cli.responses.Response;
+import io.seqera.tower.cli.utils.TableList;
+import io.seqera.tower.model.AuditLogV2ResponseDto;
+
+import java.io.PrintWriter;
+import java.util.List;
+import java.util.Objects;
+
+import static io.seqera.tower.cli.utils.FormatHelper.formatDate;
+
+public class AuditLogsList extends Response {
+
+    public final List<AuditLogV2ResponseDto> auditLogs;
+    public final String nextPageToken;
+
+    public AuditLogsList(List<AuditLogV2ResponseDto> auditLogs, String nextPageToken) {
+        this.auditLogs = auditLogs;
+        this.nextPageToken = nextPageToken;
+    }
+
+    @Override
+    public void toString(PrintWriter out) {
+        out.println(ansi(String.format("%n  @|bold Audit logs:|@%n")));
+        if (auditLogs == null || auditLogs.isEmpty()) {
+            out.println(ansi("    @|yellow No audit logs found|@"));
+            return;
+        }
+
+        TableList table = new TableList(out, 6, "ID", "Timestamp", "Event", "Actor", "Target type", "Target name");
+        table.setPrefix("    ");
+        auditLogs.forEach(log -> table.addRow(
+                log.getId(),
+                formatDate(log.getTimestamp()),
+                log.getEvent() == null ? "" : log.getEvent().getValue(),
+                log.getActor() == null ? "" : Objects.toString(log.getActor().getUserName(), ""),
+                log.getTarget() == null ? "" : Objects.toString(log.getTarget().getType(), ""),
+                log.getTarget() == null ? "" : Objects.toString(log.getTarget().getName(), "")
+        ));
+        table.print();
+        if (nextPageToken != null) {
+            out.println(String.format("%n  More logs available, use: --page-token %s", nextPageToken));
+        }
+        out.println("");
+    }
+}
diff --git a/src/test/java/io/seqera/tower/cli/auditlogs/AuditLogsCmdTest.java b/src/test/java/io/seqera/tower/cli/auditlogs/AuditLogsCmdTest.java
new file mode 100644
index 000000000..5dd198a1c
--- /dev/null
+++ b/src/test/java/io/seqera/tower/cli/auditlogs/AuditLogsCmdTest.java
@@ -0,0 +1,128 @@
+/*
+ * Copyright 2021-2026, Seqera.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package io.seqera.tower.cli.auditlogs;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import io.seqera.tower.cli.BaseCmdTest;
+import io.seqera.tower.cli.commands.enums.OutputType;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogView;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogsExported;
+import io.seqera.tower.cli.responses.auditlogs.AuditLogsList;
+import io.seqera.tower.model.AuditLogV2ResponseDto;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+import org.mockserver.client.MockServerClient;
+import org.mockserver.model.MediaType;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+import static io.seqera.tower.cli.utils.JsonHelper.parseJson;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockserver.matchers.Times.exactly;
+import static org.mockserver.model.HttpRequest.request;
+import static org.mockserver.model.HttpResponse.response;
+
+class AuditLogsCmdTest extends BaseCmdTest {
+
+    private static final String LOG = """
+            {
+              "id": "1001",
+              "timestamp": "2026-09-01T10:00:00Z",
+              "event": "agent_created",
+              "correlationId": "corr-1",
+              "actor": {"type": "user", "userId": 1264, "userName": "jordi", "email": "jordi@seqera.io"},
+              "client": {"ip": "10.0.0.1", "userAgent": "tw/0.42.0"},
+              "target": {"type": "agent", "id": "agt_1", "name": "fix-failed-runs",
+                         "organization": {"id": 27736513644467, "name": "organization1"},
+                         "workspace": {"id": 75887156211589, "name": "workspace1"}}
+            }
+            """;
+
+    private static final String CSV = "id,timestamp,event\n1001,2026-09-01T10:00:00Z,agent_created\n";
+
+    @BeforeEach
+    void init(MockServerClient mock) {
+        mock.reset();
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testList(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("GET").withPath("/admin/audit-logs-v2")
+                        .withQueryStringParameter("timestampAfterOrEqual", "2026-09-01T00:00:00Z")
+                        .withQueryStringParameter("timestampBeforeOrEqual", "2026-09-30T23:59:59Z")
+                        .withQueryStringParameter("max", "1")
+                        .withQueryStringParameter("nextPageToken", "tok1"), exactly(1))
+                .respond(response().withStatusCode(200).withBody("{\"auditLogs\":[" + LOG + "],\"nextPageToken\":\"tok2\"}").withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "audit-logs", "list", "--after", "2026-09-01T00:00:00Z", "--before", "2026-09-30T23:59:59Z", "--max", "1", "--page-token", "tok1");
+
+        assertOutput(format, out, new AuditLogsList(List.of(parseJson(LOG, AuditLogV2ResponseDto.class)), "tok2"));
+    }
+
+    @Test
+    void testListRejectsInvalidDate(MockServerClient mock) {
+        ExecOut out = exec(mock, "audit-logs", "list", "--after", "yesterday");
+
+        assertEquals(2, out.exitCode);
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testView(OutputType format, MockServerClient mock) throws JsonProcessingException {
+        mock.when(request().withMethod("GET").withPath("/admin/audit-logs-v2/1001"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(LOG).withContentType(MediaType.APPLICATION_JSON));
+
+        ExecOut out = exec(format, mock, "audit-logs", "view", "-i", "1001");
+
+        assertOutput(format, out, new AuditLogView(parseJson(LOG, AuditLogV2ResponseDto.class)));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testExportToStdout(OutputType format, MockServerClient mock) {
+        mock.when(request().withMethod("GET").withPath("/admin/audit-logs-v2/export-csv")
+                        .withQueryStringParameter("timestampAfterOrEqual", "2026-09-01T00:00:00Z"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(CSV).withContentType(MediaType.parse("text/csv"))
+                        .withHeader("Content-Disposition", "attachment; filename=\"audit-logs.csv\""));
+
+        ExecOut out = exec(format, mock, "audit-logs", "export", "--after", "2026-09-01T00:00:00Z");
+
+        assertOutput(format, out, new AuditLogsExported(null, CSV));
+    }
+
+    @ParameterizedTest
+    @EnumSource(OutputType.class)
+    void testExportToFile(OutputType format, MockServerClient mock) throws IOException {
+        mock.when(request().withMethod("GET").withPath("/admin/audit-logs-v2/export-csv")
+                        .withQueryStringParameter("attributes", "state"), exactly(1))
+                .respond(response().withStatusCode(200).withBody(CSV).withContentType(MediaType.parse("text/csv"))
+                        .withHeader("Content-Disposition", "attachment; filename=\"audit-logs.csv\""));
+
+        Path file = tempDir().resolve("export.csv");
+        ExecOut out = exec(format, mock, "audit-logs", "export", "--state", "-o", file.toString());
+
+        assertOutput(format, out, new AuditLogsExported(file.toString(), null));
+        assertEquals(CSV, Files.readString(file));
+    }
+}

From 75ea45f26828e723504d63d4673e3079afee9df1 Mon Sep 17 00:00:00 2001
From: Cristian Ramon-Cortes <cristian.ramon-cortes@seqera.io>
Date: Fri, 2 Oct 2026 18:39:54 +0200
Subject: [PATCH 5/7] fix(audit-logs): delete the downloaded CSV after export

The SDK downloads the export into a temp file. Printing it to stdout left that file behind, and
it holds installation-wide audit data (actor emails, client IPs, state images). Delete it in every
path.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../tower/cli/commands/auditlogs/ExportCmd.java  | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java
index 40ef754fb..96be58c7c 100644
--- a/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java
+++ b/src/main/java/io/seqera/tower/cli/commands/auditlogs/ExportCmd.java
@@ -26,7 +26,6 @@
 import picocli.CommandLine.Mixin;
 import picocli.CommandLine.Option;
 
-import java.io.File;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -50,11 +49,16 @@ public class ExportCmd extends AbstractApiCmd {
 
     @Override
     protected Response exec() throws ApiException, IOException {
-        File csv = adminApi().exportAuditLogsV2Csv(state ? List.of(AuditLogV2QueryAttribute.state) : null, filter.after, filter.before);
-        if (output == null) {
-            return new AuditLogsExported(null, Files.readString(csv.toPath()));
+        // The SDK downloads into a temp file; it holds installation-wide audit data, so never leave it behind
+        Path csv = adminApi().exportAuditLogsV2Csv(state ? List.of(AuditLogV2QueryAttribute.state) : null, filter.after, filter.before).toPath();
+        try {
+            if (output == null) {
+                return new AuditLogsExported(null, Files.readString(csv));
+            }
+            Files.move(csv, output, StandardCopyOption.REPLACE_EXISTING);
+            return new AuditLogsExported(output.toString(), null);
+        } finally {
+            Files.deleteIfExists(csv);
         }
-        Files.move(csv.toPath(), output, StandardCopyOption.REPLACE_EXISTING);
-        return new AuditLogsExported(output.toString(), null);
     }
 }

From c67403e7f1b616c71652828e053625c99d6bf235 Mon Sep 17 00:00:00 2001
From: Cristian Ramon-Cortes <cristian.ramon-cortes@seqera.io>
Date: Fri, 2 Oct 2026 18:40:15 +0200
Subject: [PATCH 6/7] docs: document the commands and options added for API
 1.167

Add the audit-logs section, the organization IdP group and SCIM
commands, the teams IdP group options, and the Intelligent Compute
options of the cloud compute environments. Examples use bash code
blocks without a prompt (markdownlint MD014).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 USAGE.md | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/USAGE.md b/USAGE.md
index d6c1af6fa..31f38bb11 100644
--- a/USAGE.md
+++ b/USAGE.md
@@ -722,9 +722,11 @@ tw roles permissions -o my-org
 tw roles add -o my-org -n launcher -d "Launch only" -p <permission>,<permission>
 ```
 
-### Teams and quotas
+### Teams, IdP groups and SCIM
 
-- `tw teams view|update|workspaces`: view a team, update its name or description, and list its workspaces.
+- `tw teams view|update|workspaces`: view a team, update its name, description or linked IdP group (`--idp-group`, `--unlink-idp-group`), and list its workspaces.
+- `tw organizations idp-groups list|add|delete`: manage the identity provider groups available to the organization.
+- `tw organizations scim view|create-token|rotate-token|revoke-token`: manage SCIM provisioning.
 - `tw organizations quotas` and `tw members roles -u <user>`: view organization quotas and a member's workspace roles.
 
 ## Personal access
@@ -754,10 +756,19 @@ tw managed-identities add -o my-org -n hpc1 -p slurm -H login.hpc.example.com
 tw managed-identities credentials -o my-org -n hpc1 add -l my_linux_user -k ~/.ssh/id_rsa
 ```
 
+## Audit logs
+
+Run `tw audit-logs -h` to view the supported operations: `list`, `view`, and `export`. These commands require a root user.
+
+```bash
+tw audit-logs export --after 2026-09-01T00:00:00Z --before 2026-09-30T23:59:59Z -o september.csv
+```
+
 ## Other additions
 
 - `tw compute-envs enable|disable`: enable or disable a compute environment.
 - `tw compute-envs add`:
+  - Intelligent Compute options on `aws-cloud`, `azure-cloud`, and `google-cloud`. Run `tw compute-envs add <platform> -h` for the options each platform supports.
   - AWS Batch: CloudWatch log group and DRAGEN options.
   - AWS Cloud: `--log-group`. Google Cloud: `--project-id`.
   - HPC platforms: `--propagate-head-job-options`.

From d66f8af81dbf31f685f822e08ff8ff831e95d2cb Mon Sep 17 00:00:00 2001
From: Cristian Ramon-Cortes <cristian.ramon-cortes@seqera.io>
Date: Fri, 2 Oct 2026 18:40:35 +0200
Subject: [PATCH 7/7] build(native): register reflection metadata for the API
 1.167 commands

The native binary needs reflection entries for every picocli command,
option group and JSON response class. Add those of the audit-logs,
organizations idp-groups and scim commands and of the teams IdP group
option group, copied from the reflection config generated for the full
catch-up.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 conf/reflect-config.json | 173 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 173 insertions(+)

diff --git a/conf/reflect-config.json b/conf/reflect-config.json
index d55fccd0a..0bc736cba 100644
--- a/conf/reflect-config.json
+++ b/conf/reflect-config.json
@@ -166,6 +166,12 @@
   "allDeclaredMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.AuditLogsCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.CollaboratorsCmd",
   "allDeclaredFields":true,
@@ -403,6 +409,40 @@
   "allDeclaredMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.AuditLogsFilterOptions",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"after"}, {"name":"before"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.AuditLogsFilterOptions$DateTimeConverter",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.ExportCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"filter"}, {"name":"output"}, {"name":"state"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.ListCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"filter"}, {"name":"max"}, {"name":"pageToken"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.auditlogs.ViewCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"id"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.collaborators.AbstractCollaboratorsCmd",
   "allDeclaredFields":true,
@@ -1664,6 +1704,12 @@
   "allDeclaredMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.organizations.IdpGroupsCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.organizations.ListCmd",
   "allDeclaredFields":true,
@@ -1695,6 +1741,12 @@
   "fields":[{"name":"organizationRefOptions"}],
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.organizations.ScimCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.organizations.UpdateCmd",
   "allDeclaredFields":true,
@@ -1707,6 +1759,62 @@
   "allDeclaredMethods":true,
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.organizations.idpgroups.AddCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"name"}, {"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.idpgroups.DeleteCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"group"}, {"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.idpgroups.DeleteCmd$GroupRef",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"id"}, {"name":"name"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.idpgroups.ListCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.scim.CreateTokenCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.scim.RevokeTokenCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.scim.RotateTokenCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"io.seqera.tower.cli.commands.organizations.scim.ViewCmd",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"organizationRef"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.participants.AbstractParticipantsCmd",
   "allDeclaredFields":true,
@@ -2326,6 +2434,13 @@
   "fields":[{"name":"description"}, {"name":"idpGroup"}, {"name":"newName"}, {"name":"organizationRef"}, {"name":"ref"}],
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
+{
+  "name":"io.seqera.tower.cli.commands.teams.UpdateCmd$IdpGroup",
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true,
+  "fields":[{"name":"name"}, {"name":"unlink"}],
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
 {
   "name":"io.seqera.tower.cli.commands.teams.ViewCmd",
   "queryAllDeclaredMethods":true,
@@ -2531,6 +2646,24 @@
   "allDeclaredMethods":true,
   "allDeclaredConstructors":true
 },
+{
+  "name":"io.seqera.tower.cli.responses.auditlogs.AuditLogView",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.auditlogs.AuditLogsExported",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.auditlogs.AuditLogsList",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
 {
   "name":"io.seqera.tower.cli.responses.collaborators.CollaboratorsList",
   "allDeclaredFields":true,
@@ -2848,6 +2981,24 @@
   "allDeclaredMethods":true,
   "allDeclaredConstructors":true
 },
+{
+  "name":"io.seqera.tower.cli.responses.organizations.IdpGroupAdded",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.organizations.IdpGroupDeleted",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.organizations.IdpGroupsList",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
 {
   "name":"io.seqera.tower.cli.responses.organizations.OrganizationQuotasView",
   "allDeclaredFields":true,
@@ -2890,6 +3041,28 @@
   "queryAllDeclaredMethods":true,
   "queryAllDeclaredConstructors":true
 },
+{
+  "name":"io.seqera.tower.cli.responses.organizations.ScimConfigView",
+  "allDeclaredFields":true,
+  "allDeclaredMethods":true,
+  "allDeclaredConstructors":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.organizations.ScimTokenCreated",
+  "allDeclaredFields":true,
+  "allDeclaredMethods":true,
+  "allDeclaredConstructors":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
+{
+  "name":"io.seqera.tower.cli.responses.organizations.ScimTokenRevoked",
+  "allDeclaredFields":true,
+  "queryAllDeclaredMethods":true,
+  "queryAllDeclaredConstructors":true
+},
 {
   "name":"io.seqera.tower.cli.responses.participants.ParticipantAdded",
   "allDeclaredFields":true,