ScimError

SCIM 2.0 error response per RFC 7644 §3.12. The scimType field is set on 400 validation failures and on product-conflict 409s; 401/403/404/500 responses omit it, and the QRM quota-exceeded 409 (reactivation over the organization user quota) carries no scimType. Values emitted by this service:

• invalidValue (400) — a required field is missing, a field value is malformed (e.g. invalid UUID, role downgrade, unknown role id), or the product rejected the submitted data (the detail carries the reason). For Digital Assets Management, role/id/email problems are validated by Inspectorio before reaching the product; a product-side validation rejection that escapes this surfaces as a generic 500 without the retry marker.
• invalidFilter (400) — the filter query parameter is malformed (syntax error, unterminated quote, truncated operator).
• invalidPath (400) — a PATCH path that is not a SCIM User schema attribute (misspelled or miscased, e.g. Roles).
• noTarget (400) — a PATCH value-path that resolves to nothing (e.g. emails[type eq "work"].value, or a remove without a path).
• mutability (400) — a constraint violation (e.g. more than one role for Digital Assets Management, or a request body id conflicting with the URL id).
• invalidSyntax (400) — the request body is not a valid SCIM PatchOp.
• uniqueness (409) — the product reported a conflict for the addressed entity (e.g. duplicate user).

Caveat (PATCH paths): PATCH operations on non-persisted attributes (displayName, externalId) return 200 with no observable change rather than an error — do not rely on a 200 to mean the attribute was modified. An operation changing userName fails the entire request with 400 invalidValue (including batched operations); unknown/miscased paths fail 400 invalidPath.

Note (transient failures): Transient failures in Inspectorio's backend (timeouts, service errors, rate limits, connection failures) surface as 500 with a detail string containing safe to retry — retry the same request. On mutating operations (POST/PUT/PATCH/DELETE) the detail additionally warns mutation may be partially applied. Retry semantics per operation:

• GET/list — idempotent, always safe to retry.
• POST — a retry after a partially-applied create may return 409 uniqueness or resolve to the existing user; reconcile with a GET filtered by userName.
• PUT/PATCH — last-writer-wins; converges on retry.
• DELETE — a retry that finds the user already gone returns 404, which after a prior safe to retry 500 means the deletion completed.

A 500 without the marker is not automatically a permanent failure — some transient conditions surface without it; retry once before escalating.

schemasstring[]required

Example: ["urn:ietf:params:scim:api:messages:2.0:Error"]

scimTypestring

SCIM detail error keyword. Set on validation failures (400) and product conflicts (409 uniqueness); absent on auth/lookup/server errors (401/403/404/500) and on the QRM quota-exceeded 409.

Possible values: [invalidValue, mutability, invalidSyntax, invalidFilter, invalidPath, noTarget, uniqueness]

detailstringrequired

Human-readable error message

statusstringrequired

HTTP status code

Example: 400

ScimError

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "scimType": "invalidValue",
  "detail": "User: [email protected] must have at least one active role in organization",
  "status": "400"
}