Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
Every SCIM error response uses the SCIM error schema urn:ietf:params:scim:api:messages:2.0:Error. Its detail is one sentence, then the code LS-SCIM-nnnn, then a link to that code on this page. Codes are never reused or renumbered.
Every response also has an X-Request-Id header. Give it to Living Security support when you ask about one request.

Authentication

The request did not carry a valid credential for this region.

LS-SCIM-1001

Authentication failed HTTP status 401. scimType: none. Error detail: The request could not be authenticated. Cause: The token is missing, malformed, revoked or expired, or it was sent to another region’s SCIM base URL. Fix: Copy the SCIM base URL from the SCIM card into the identity provider. For a bearer token, rotate the token on the SCIM card if it is lost or expired. For HTTP Basic or OAuth client credentials, contact Living Security support.

Schema and validation

The request body or a value in it is not valid.

LS-SCIM-1101

Invalid request body HTTP status 400. scimType: invalidSyntax. Error detail: The request body is not a valid SCIM JSON object. Cause: The body is not JSON, is not a JSON object, or is nested too deeply. Fix: Send a JSON object that follows RFC 7643 with Content-Type application/scim+json.

LS-SCIM-1102

Core schema missing HTTP status 400. scimType: invalidSyntax. Error detail: The schemas attribute must include {schema}. Cause: The resource’s schemas list does not name the core schema of the resource type. Fix: Include the core schema URN in the schemas attribute of every resource.

LS-SCIM-1103

Required attribute missing HTTP status 400. scimType: invalidValue. Error detail: The required attribute {attribute} is missing. Cause: A required attribute, such as userName for users or displayName for groups, has no value. Fix: Map a source attribute to the required SCIM attribute in the identity provider.

LS-SCIM-1104

Invalid attribute value HTTP status 400. scimType: invalidValue. Error detail: The attribute {attribute} must be {expected}. Cause: An attribute value does not match the type the schema declares. Fix: Change the identity provider’s attribute mapping so the value has the declared type.

LS-SCIM-1105

Immutable attribute changed HTTP status 400. scimType: mutability. Error detail: The attribute {attribute} is immutable and cannot be changed. Cause: The request tried to change an attribute that cannot change after it is set. Fix: Send the stored value of the immutable attribute, or create a new resource.

LS-SCIM-1106

More than one primary value HTTP status 400. scimType: invalidValue. Error detail: The attribute {attribute} has more than one value marked primary. Cause: A multi-valued attribute marks more than one value as primary. Fix: Mark at most one value of the attribute as primary in the identity provider.

LS-SCIM-1107

No usable email HTTP status 400. scimType: invalidValue. Error detail: The user has no usable email address. Cause: The user has no email address the platform can use to sign the person in. Fix: Map a work email to emails[type eq “work”].value in the identity provider.

LS-SCIM-1108

More than one primary email HTTP status 400. scimType: invalidValue. Error detail: The user has more than one email address marked primary. Cause: Two or more emails have primary set to true, so the sign-in email is ambiguous. Fix: Mark exactly one email as primary in the identity provider’s attribute mapping.

LS-SCIM-1109

Resource not found HTTP status 404. scimType: none. Error detail: The requested {resourceType} does not exist. Cause: No resource with this id exists in the organization, or it was deleted. Fix: Re-provision the user or group from the identity provider; it creates the resource again.

LS-SCIM-1110

Request too large HTTP status 413. scimType: none. Error detail: The request body is larger than {limit} bytes. Cause: The request body exceeds the documented size limit. Fix: Send fewer operations or members per request.

LS-SCIM-1111

Attribute sent twice HTTP status 400. scimType: invalidSyntax. Error detail: The body names {attribute} more than once with different letter case. Cause: SCIM attribute names and schema URNs are case-insensitive, and the body repeats one in another letter case. Fix: Send each attribute and extension schema once.

LS-SCIM-1112

Extension too large HTTP status 400. scimType: invalidValue. Error detail: An extension schema exceeds the limit of {limit}. Cause: The body has too many custom extension schemas, a schema with too many attributes, or too long a schema URN. Fix: Send at most 20 custom extension schemas, 200 attributes per schema and 256-character URNs. Attribute names longer than 128 characters are not stored.

LS-SCIM-1113

Extension not allowed here HTTP status 400. scimType: invalidValue. Error detail: The schema {schema} is not an extension of this resource type. Cause: The body carries a schema this resource type does not take, such as the Enterprise User extension on a group. Fix: Send the extension only on the resource type /ResourceTypes lists it for.

LS-SCIM-1114

Too many bulk operations HTTP status 413. scimType: tooMany. Error detail: The bulk request has more than the maxOperations ({limit}) operations. Cause: A /Bulk request carries more operations than ServiceProviderConfig bulk.maxOperations allows. Fix: Split the changes into several /Bulk requests of at most maxOperations operations.

LS-SCIM-1115

Method not allowed HTTP status 405. scimType: none. Error detail: {resource} is read-only; send GET. Cause: The SCIM client sent a write method to a discovery endpoint (/ServiceProviderConfig, /ResourceTypes or /Schemas). These endpoints only describe the service. Fix: Read the discovery endpoints with GET. Create and change users and groups at /Users and /Groups.

Uniqueness and conflicts

The request conflicts with a stored resource or version.

LS-SCIM-1201

userName already in use HTTP status 409. scimType: uniqueness. Error detail: Another user in this organization already has this userName. Cause: userName is unique per organization, case-insensitive, and another active user has it. Fix: Match existing users on userName in the identity provider, or give this user a different userName.

LS-SCIM-1203

Version mismatch HTTP status 412. scimType: none. Error detail: The resource changed since the version named in the precondition. Cause: The If-Match header or Bulk version does not match the stored resource version. Fix: Read the resource again and retry with its current ETag.

LS-SCIM-1204

Unresolved bulkId HTTP status 409. scimType: invalidValue. Error detail: The operation refers to a bulkId that no successful operation in this request created. Cause: A /Bulk operation names bulkId:<id> for a resource that is not in the request, failed, or forms a cycle that cannot be resolved. Fix: Send the POST that defines each bulkId in the same /Bulk request, and fix the operation it depends on.

Filters, sorting and pagination

A list or search request has a parameter the service cannot use.

LS-SCIM-1301

Invalid filter HTTP status 400. scimType: invalidFilter. Error detail: The filter is not valid: {reason}. Cause: The filter does not follow the RFC 7644 filter grammar or exceeds the size limit. Fix: Correct the filter expression; quote string values with double quotes.

LS-SCIM-1302

Too many results HTTP status 400. scimType: tooMany. Error detail: The request would return more than {limit} results. Cause: The request asks for more resources than one response can carry. Fix: Page through results with startIndex and count, or with a cursor.

LS-SCIM-1303

Invalid cursor HTTP status 400. scimType: invalidCursor. Error detail: The cursor is not valid for this request. Cause: The cursor was altered, belongs to another connection, or was issued for a different filter or sort. Fix: Start the walk again with an empty cursor and the same filter and sort.

LS-SCIM-1304

Filter too complex HTTP status 400. scimType: invalidFilter. Error detail: The filter exceeds the limit of {limit}. Cause: The filter is longer than 4 KiB, nests deeper than 10 levels, or has more than 50 comparisons. Fix: Split the search into simpler filters.

LS-SCIM-1305

Unknown filter attribute HTTP status 400. scimType: invalidFilter. Error detail: The filter names {attribute}, which this resource type does not have. Cause: The filter names an attribute that /Schemas does not list for this resource type. Fix: Use an attribute that /Schemas lists for this resource type.

LS-SCIM-1306

Invalid sort attribute HTTP status 400. scimType: invalidValue. Error detail: The sortBy attribute {attribute} cannot be used to sort. Cause: sortBy names an attribute this resource type does not have, or a complex attribute without a value. Fix: Sort by a single-valued attribute, or a multi-valued attribute that has a primary value.

LS-SCIM-1307

Expired cursor HTTP status 400. scimType: expiredCursor. Error detail: The cursor has expired. Cause: More than cursorTimeout (600 seconds) passed between two page requests of a cursor walk. Fix: Start the walk again with an empty cursor and the same filter and sort, and request each next page within 600 seconds.

PATCH

A PATCH operation cannot be applied.

LS-SCIM-1401

Invalid PATCH path HTTP status 400. scimType: invalidPath. Error detail: The PATCH path for {attribute} is not valid. Cause: The path names an attribute the schema does not define or is not valid path syntax. Fix: Use an attribute path from the published /Schemas document.

LS-SCIM-1402

PATCH target not found HTTP status 400. scimType: noTarget. Error detail: The PATCH path for {attribute} matched no values. Cause: The value filter in the path matched nothing to change or remove. Fix: Read the resource and correct the value filter in the path.

LS-SCIM-1403

Invalid PATCH operation HTTP status 400. scimType: invalidSyntax. Error detail: The PATCH operation {operation} is not supported. Cause: The op is not add, remove or replace, or the operation is malformed. Fix: Use add, remove or replace as described in RFC 7644 section 3.5.2.

LS-SCIM-1404

Invalid PATCH value HTTP status 400. scimType: invalidValue. Error detail: The PATCH value for {attribute} is not valid. Cause: The value is missing or does not match the type of the target attribute. Fix: Send a value of the type the schema declares for the path.

LS-SCIM-1405

Read-only attribute changed HTTP status 400. scimType: mutability. Error detail: The attribute {attribute} is read-only and cannot be changed. Cause: A PATCH operation named a read-only attribute, such as id, meta or groups, as its path. Fix: Remove the operation; the server sets read-only attributes itself.

LS-SCIM-1406

PATCH limit exceeded HTTP status 400. scimType: invalidValue. Error detail: The PATCH request exceeds the limit of {limit}. Cause: The request has more than 1,000 operations or more than 10,000 group member values. Fix: Split the change into several PATCH requests.

LS-SCIM-1407

PATCH remove without a path HTTP status 400. scimType: noTarget. Error detail: A PATCH remove operation needs a path. Cause: A remove operation did not say which attribute to remove. Fix: Set path on every remove operation, as RFC 7644 section 3.5.2.2 requires.

Held changes

These are not errors. The request succeeds and the identity provider sees a 2xx response. The change is saved but waits until an administrator acts or the cause is gone. Held changes show on the SCIM card.

LS-SCIM-1501

Held: last owner The request succeeds. The change is held. Cause: Deactivating or changing this person would leave the organization with no owner. Fix: Make another person an owner, then provision this person again from the identity provider.

LS-SCIM-1502

Held: excluded from sync The request succeeds. The change is held. Cause: An administrator excluded this person from directory sync. Fix: Remove the exclusion on the person’s record if the identity provider should manage them.

LS-SCIM-1503

Held: ambiguous person The request succeeds. The change is held. Cause: The user’s identifiers match more than one existing person record. Fix: Merge or correct the duplicate person records, then provision this person again from the identity provider.

LS-SCIM-1504

Held: mass deactivation Reserved. The SCIM service does not return this code yet.

LS-SCIM-1505

Held: preview Reserved. The SCIM service does not return this code yet.

Rate and availability

The service limited, paused or could not finish the request. Retry after the Retry-After time when the response has one.

LS-SCIM-1601

Rate limited HTTP status 429. scimType: none. Error detail: Too many requests; retry after the Retry-After interval. Cause: The connection or organization sent requests faster than the documented rate limit. Fix: No action is needed; identity providers retry automatically after the Retry-After interval.

LS-SCIM-1602

Changes paused HTTP status 503. scimType: none. Error detail: Changes are paused; retry after the Retry-After interval. Cause: SCIM writes are paused while the platform catches up or during maintenance. Reads still work. Fix: No action is needed; identity providers retry automatically after the Retry-After interval.

LS-SCIM-1603

Not supported HTTP status 501. scimType: none. Error detail: The {operation} operation is not supported. Cause: The endpoint or operation is not offered, for example GET /Bulk. Fix: Use the operations the ServiceProviderConfig document lists as supported.

LS-SCIM-1604

Internal error HTTP status 500. scimType: none. Error detail: The request failed because of an internal error. Cause: An unexpected error occurred while processing the request. Fix: Retry the request. If it keeps failing, contact Living Security Support with the X-Request-Id.

LS-SCIM-1605

/Me not available HTTP status 501. scimType: none. Error detail: /Me is not available: a SCIM connection, not a user, sends these requests. Cause: RFC 7644 § 3.11 resolves /Me to the authenticated user. The SCIM client authenticates as a connection, so there is no user to resolve. Fix: Read or change the user at /Users/{id} instead.

LS-SCIM-1606

Request timed out HTTP status 503. scimType: none. Error detail: The request did not finish within the time limit; retry after the Retry-After interval. Cause: The platform did not answer within 15 seconds (60 seconds for /Bulk), for example while a database or the sign-in provider was slow. Fix: No action is needed; identity providers retry automatically after the Retry-After interval. If it keeps happening, contact Living Security Support with the X-Request-Id.

Mapping check findings

These are not request errors. The mapping check reports them when it reads an attribute-mapping export from your identity provider.

LS-SCIM-1701

Mapping export not readable Cause: The pasted text is not a Microsoft Entra ID provisioning schema export, or it has no mapping for users. Fix: In the Entra enterprise application, open Provisioning > Mappings > Show advanced options > Review your schema here, download the schema and paste the whole file.

LS-SCIM-1702

Wrong matching attribute Cause: The mapping with matching precedence 1 targets an attribute the platform does not use to find an existing user, so every cycle can create duplicates. Fix: Edit the userName mapping, set Match objects using this attribute to Yes with matching precedence 1, and turn matching off for the other mapping.

LS-SCIM-1703

userName source differs from sign-in Cause: The SCIM userName and the single sign-on NameID come from different source attributes, so a provisioned person cannot sign in as themselves. Fix: Map userName from the same source attribute as the NameID claim in the single sign-on configuration, usually userPrincipalName.

LS-SCIM-1704

active does not follow deletion Cause: active is mapped from a constant, another attribute or a different expression, so a person removed in Entra is not deactivated. Fix: Map active with the expression Switch([IsSoftDeleted], , “False”, “True”, “True”, “False”).

LS-SCIM-1705

Work email not mapped Cause: No mapping targets emails[type eq “work”].value, so a person can be activated without the email the platform uses for training and notices. Fix: Add a mapping from mail (or userPrincipalName) to emails[type eq “work”].value.

LS-SCIM-1706

Manager not mapped Cause: No mapping targets the enterprise extension manager, or the manager source is mapped to another attribute, so reporting lines are lost. Fix: Map the manager source attribute to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager.

LS-SCIM-1707

Mapping to an undeclared attribute Cause: The mapping targets an attribute or extension the platform does not declare, so the value is stored on the SCIM user but never reaches the person. Fix: Map the source to a declared core, enterprise or Living Security extension attribute, or remove the mapping.