ScimPatchOp

SCIM 2.0 PatchOp per RFC 7644 §3.5.2. Send deactivation (active) and role changes as SEPARATE PATCH requests: when combined in one request, the deactivation wins — the role change is silently discarded and the 200 response echoes the OLD roles.

schemasstring[]required

Example: ["urn:ietf:params:scim:api:messages:2.0:PatchOp"]

Operations object[]required

Array [

opstringrequired

The operation to perform

Possible values: [add, remove, replace]

pathstring

Target attribute path. Only top-level active and roles produce changes. Operations on non-persisted attributes (displayName, externalId) return a silent 200 no-op. An operation that changes userName fails the entire request with 400 invalidValue (User with id: <id> not found) — including any other operations batched in the same request (e.g. a deactivation). Unknown or miscased paths (e.g. Roles) fail 400 invalidPath. Value-path filters on roles (e.g. roles[value eq "5"], the shape Entra ID emits for role removal) are supported; value-paths on non-persisted attributes like emails[type eq "work"].value return 400 noTarget.

Example: active

value

New value for the attribute

]

ScimPatchOp

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "roles",
      "value": [
        {
          "value": "<role-id>",
          "display": "Admin"
        }
      ]
    }
  ]
}