> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM error reference

> Every LS-SCIM error code the Living Security SCIM service returns, with its HTTP status, cause and fix.

> [!NOTE]
>
> **Which SCIM setup applies to you?** These pages describe **Living Security SCIM**. Open the SCIM card in your settings. If the card shows **Set up SCIM**, or its **Mode** row says **Native SCIM**, these pages apply. If **Mode** says **Current SCIM**, your organization still uses the earlier SCIM setup. An admin can move it: see [Move from the earlier SCIM setup](https://docs.livingsecurity.com/features/settings/scim/connection.md#move-from-the-earlier-scim-setup). If the card says SCIM is set up and managed in the setup wizard, use [SCIM Provisioning](https://docs.livingsecurity.com/features/settings/scim.md).

Every SCIM error response uses the SCIM error schema `urn:ietf:params:scim:api:messages:2.0:Error`. Its `detail` is one sentence, then the code `LS-SCIM-nnnn`, then a link to that code on this page. Codes are never reused or renumbered.

```json theme={null}
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "409",
  "scimType": "uniqueness",
  "detail": "Another user in this organization already has this userName. LS-SCIM-1201: https://docs.livingsecurity.com/features/settings/scim/errors#ls-scim-1201"
}
```

Every response also has an `X-Request-Id` header. Give it to Living Security support when you ask about one request.

## Authentication

The request did not carry a valid credential for this region.

### LS-SCIM-1001

**Authentication failed**

HTTP status `401`. `scimType`: none.

Error detail: `The request could not be authenticated.`

**Cause:** The token is missing, malformed, revoked or expired, or it was sent to another region's SCIM base URL.

**Fix:** Copy the SCIM base URL from the SCIM card into the identity provider. For a bearer token, rotate the token on the SCIM card if it is lost or expired. For HTTP Basic or OAuth client credentials, contact Living Security support.

## Schema and validation

The request body or a value in it is not valid.

### LS-SCIM-1101

**Invalid request body**

HTTP status `400`. `scimType`: `invalidSyntax`.

Error detail: `The request body is not a valid SCIM JSON object.`

**Cause:** The body is not JSON, is not a JSON object, or is nested too deeply.

**Fix:** Send a JSON object that follows RFC 7643 with Content-Type application/scim+json.

### LS-SCIM-1102

**Core schema missing**

HTTP status `400`. `scimType`: `invalidSyntax`.

Error detail: `The schemas attribute must include {schema}.`

**Cause:** The resource's schemas list does not name the core schema of the resource type.

**Fix:** Include the core schema URN in the schemas attribute of every resource.

### LS-SCIM-1103

**Required attribute missing**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The required attribute {attribute} is missing.`

**Cause:** A required attribute, such as userName for users or displayName for groups, has no value.

**Fix:** Map a source attribute to the required SCIM attribute in the identity provider.

### LS-SCIM-1104

**Invalid attribute value**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The attribute {attribute} must be {expected}.`

**Cause:** An attribute value does not match the type the schema declares.

**Fix:** Change the identity provider's attribute mapping so the value has the declared type.

### LS-SCIM-1105

**Immutable attribute changed**

HTTP status `400`. `scimType`: `mutability`.

Error detail: `The attribute {attribute} is immutable and cannot be changed.`

**Cause:** The request tried to change an attribute that cannot change after it is set.

**Fix:** Send the stored value of the immutable attribute, or create a new resource.

### LS-SCIM-1106

**More than one primary value**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The attribute {attribute} has more than one value marked primary.`

**Cause:** A multi-valued attribute marks more than one value as primary.

**Fix:** Mark at most one value of the attribute as primary in the identity provider.

### LS-SCIM-1107

**No usable email**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The user has no usable email address.`

**Cause:** The user has no email address the platform can use to sign the person in.

**Fix:** Map a work email to emails\[type eq "work"].value in the identity provider.

### LS-SCIM-1108

**More than one primary email**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The user has more than one email address marked primary.`

**Cause:** Two or more emails have primary set to true, so the sign-in email is ambiguous.

**Fix:** Mark exactly one email as primary in the identity provider's attribute mapping.

### LS-SCIM-1109

**Resource not found**

HTTP status `404`. `scimType`: none.

Error detail: `The requested {resourceType} does not exist.`

**Cause:** No resource with this id exists in the organization, or it was deleted.

**Fix:** Re-provision the user or group from the identity provider; it creates the resource again.

### LS-SCIM-1110

**Request too large**

HTTP status `413`. `scimType`: none.

Error detail: `The request body is larger than {limit} bytes.`

**Cause:** The request body exceeds the documented size limit.

**Fix:** Send fewer operations or members per request.

### LS-SCIM-1111

**Attribute sent twice**

HTTP status `400`. `scimType`: `invalidSyntax`.

Error detail: `The body names {attribute} more than once with different letter case.`

**Cause:** SCIM attribute names and schema URNs are case-insensitive, and the body repeats one in another letter case.

**Fix:** Send each attribute and extension schema once.

### LS-SCIM-1112

**Extension too large**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `An extension schema exceeds the limit of {limit}.`

**Cause:** The body has too many custom extension schemas, a schema with too many attributes, or too long a schema URN.

**Fix:** Send at most 20 custom extension schemas, 200 attributes per schema and 256-character URNs. Attribute names longer than 128 characters are not stored.

### LS-SCIM-1113

**Extension not allowed here**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The schema {schema} is not an extension of this resource type.`

**Cause:** The body carries a schema this resource type does not take, such as the Enterprise User extension on a group.

**Fix:** Send the extension only on the resource type /ResourceTypes lists it for.

### LS-SCIM-1114

**Too many bulk operations**

HTTP status `413`. `scimType`: `tooMany`.

Error detail: `The bulk request has more than the maxOperations ({limit}) operations.`

**Cause:** A /Bulk request carries more operations than ServiceProviderConfig bulk.maxOperations allows.

**Fix:** Split the changes into several /Bulk requests of at most maxOperations operations.

### LS-SCIM-1115

**Method not allowed**

HTTP status `405`. `scimType`: none.

Error detail: `{resource} is read-only; send GET.`

**Cause:** The SCIM client sent a write method to a discovery endpoint (/ServiceProviderConfig, /ResourceTypes or /Schemas). These endpoints only describe the service.

**Fix:** Read the discovery endpoints with GET. Create and change users and groups at /Users and /Groups.

## Uniqueness and conflicts

The request conflicts with a stored resource or version.

### LS-SCIM-1201

**userName already in use**

HTTP status `409`. `scimType`: `uniqueness`.

Error detail: `Another user in this organization already has this userName.`

**Cause:** userName is unique per organization, case-insensitive, and another active user has it.

**Fix:** Match existing users on userName in the identity provider, or give this user a different userName.

### LS-SCIM-1203

**Version mismatch**

HTTP status `412`. `scimType`: none.

Error detail: `The resource changed since the version named in the precondition.`

**Cause:** The If-Match header or Bulk version does not match the stored resource version.

**Fix:** Read the resource again and retry with its current ETag.

### LS-SCIM-1204

**Unresolved bulkId**

HTTP status `409`. `scimType`: `invalidValue`.

Error detail: `The operation refers to a bulkId that no successful operation in this request created.`

**Cause:** A /Bulk operation names bulkId:\<id> for a resource that is not in the request, failed, or forms a cycle that cannot be resolved.

**Fix:** Send the POST that defines each bulkId in the same /Bulk request, and fix the operation it depends on.

## Filters, sorting and pagination

A list or search request has a parameter the service cannot use.

### LS-SCIM-1301

**Invalid filter**

HTTP status `400`. `scimType`: `invalidFilter`.

Error detail: `The filter is not valid: {reason}.`

**Cause:** The filter does not follow the RFC 7644 filter grammar or exceeds the size limit.

**Fix:** Correct the filter expression; quote string values with double quotes.

### LS-SCIM-1302

**Too many results**

HTTP status `400`. `scimType`: `tooMany`.

Error detail: `The request would return more than {limit} results.`

**Cause:** The request asks for more resources than one response can carry.

**Fix:** Page through results with startIndex and count, or with a cursor.

### LS-SCIM-1303

**Invalid cursor**

HTTP status `400`. `scimType`: `invalidCursor`.

Error detail: `The cursor is not valid for this request.`

**Cause:** The cursor was altered, belongs to another connection, or was issued for a different filter or sort.

**Fix:** Start the walk again with an empty cursor and the same filter and sort.

### LS-SCIM-1304

**Filter too complex**

HTTP status `400`. `scimType`: `invalidFilter`.

Error detail: `The filter exceeds the limit of {limit}.`

**Cause:** The filter is longer than 4 KiB, nests deeper than 10 levels, or has more than 50 comparisons.

**Fix:** Split the search into simpler filters.

### LS-SCIM-1305

**Unknown filter attribute**

HTTP status `400`. `scimType`: `invalidFilter`.

Error detail: `The filter names {attribute}, which this resource type does not have.`

**Cause:** The filter names an attribute that /Schemas does not list for this resource type.

**Fix:** Use an attribute that /Schemas lists for this resource type.

### LS-SCIM-1306

**Invalid sort attribute**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The sortBy attribute {attribute} cannot be used to sort.`

**Cause:** sortBy names an attribute this resource type does not have, or a complex attribute without a value.

**Fix:** Sort by a single-valued attribute, or a multi-valued attribute that has a primary value.

### LS-SCIM-1307

**Expired cursor**

HTTP status `400`. `scimType`: `expiredCursor`.

Error detail: `The cursor has expired.`

**Cause:** More than cursorTimeout (600 seconds) passed between two page requests of a cursor walk.

**Fix:** Start the walk again with an empty cursor and the same filter and sort, and request each next page within 600 seconds.

## PATCH

A PATCH operation cannot be applied.

### LS-SCIM-1401

**Invalid PATCH path**

HTTP status `400`. `scimType`: `invalidPath`.

Error detail: `The PATCH path for {attribute} is not valid.`

**Cause:** The path names an attribute the schema does not define or is not valid path syntax.

**Fix:** Use an attribute path from the published /Schemas document.

### LS-SCIM-1402

**PATCH target not found**

HTTP status `400`. `scimType`: `noTarget`.

Error detail: `The PATCH path for {attribute} matched no values.`

**Cause:** The value filter in the path matched nothing to change or remove.

**Fix:** Read the resource and correct the value filter in the path.

### LS-SCIM-1403

**Invalid PATCH operation**

HTTP status `400`. `scimType`: `invalidSyntax`.

Error detail: `The PATCH operation {operation} is not supported.`

**Cause:** The op is not add, remove or replace, or the operation is malformed.

**Fix:** Use add, remove or replace as described in RFC 7644 section 3.5.2.

### LS-SCIM-1404

**Invalid PATCH value**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The PATCH value for {attribute} is not valid.`

**Cause:** The value is missing or does not match the type of the target attribute.

**Fix:** Send a value of the type the schema declares for the path.

### LS-SCIM-1405

**Read-only attribute changed**

HTTP status `400`. `scimType`: `mutability`.

Error detail: `The attribute {attribute} is read-only and cannot be changed.`

**Cause:** A PATCH operation named a read-only attribute, such as id, meta or groups, as its path.

**Fix:** Remove the operation; the server sets read-only attributes itself.

### LS-SCIM-1406

**PATCH limit exceeded**

HTTP status `400`. `scimType`: `invalidValue`.

Error detail: `The PATCH request exceeds the limit of {limit}.`

**Cause:** The request has more than 1,000 operations or more than 10,000 group member values.

**Fix:** Split the change into several PATCH requests.

### LS-SCIM-1407

**PATCH remove without a path**

HTTP status `400`. `scimType`: `noTarget`.

Error detail: `A PATCH remove operation needs a path.`

**Cause:** A remove operation did not say which attribute to remove.

**Fix:** Set path on every remove operation, as RFC 7644 section 3.5.2.2 requires.

## Held changes

These are not errors. The request succeeds and the identity provider sees a 2xx response. The change is saved but waits until an administrator acts or the cause is gone. Held changes show on the SCIM card.

### LS-SCIM-1501

**Held: last owner**

The request succeeds. The change is held.

**Cause:** Deactivating or changing this person would leave the organization with no owner.

**Fix:** Make another person an owner, then provision this person again from the identity provider.

### LS-SCIM-1502

**Held: excluded from sync**

The request succeeds. The change is held.

**Cause:** An administrator excluded this person from directory sync.

**Fix:** Remove the exclusion on the person's record if the identity provider should manage them.

### LS-SCIM-1503

**Held: ambiguous person**

The request succeeds. The change is held.

**Cause:** The user's identifiers match more than one existing person record.

**Fix:** Merge or correct the duplicate person records, then provision this person again from the identity provider.

### LS-SCIM-1504

**Held: mass deactivation**

Reserved. The SCIM service does not return this code yet.

### LS-SCIM-1505

**Held: preview**

Reserved. The SCIM service does not return this code yet.

## Rate and availability

The service limited, paused or could not finish the request. Retry after the `Retry-After` time when the response has one.

### LS-SCIM-1601

**Rate limited**

HTTP status `429`. `scimType`: none.

Error detail: `Too many requests; retry after the Retry-After interval.`

**Cause:** The connection or organization sent requests faster than the documented rate limit.

**Fix:** No action is needed; identity providers retry automatically after the Retry-After interval.

### LS-SCIM-1602

**Changes paused**

HTTP status `503`. `scimType`: none.

Error detail: `Changes are paused; retry after the Retry-After interval.`

**Cause:** SCIM writes are paused while the platform catches up or during maintenance. Reads still work.

**Fix:** No action is needed; identity providers retry automatically after the Retry-After interval.

### LS-SCIM-1603

**Not supported**

HTTP status `501`. `scimType`: none.

Error detail: `The {operation} operation is not supported.`

**Cause:** The endpoint or operation is not offered, for example GET /Bulk.

**Fix:** Use the operations the ServiceProviderConfig document lists as supported.

### LS-SCIM-1604

**Internal error**

HTTP status `500`. `scimType`: none.

Error detail: `The request failed because of an internal error.`

**Cause:** An unexpected error occurred while processing the request.

**Fix:** Retry the request. If it keeps failing, contact Living Security Support with the X-Request-Id.

### LS-SCIM-1605

**/Me not available**

HTTP status `501`. `scimType`: none.

Error detail: `/Me is not available: a SCIM connection, not a user, sends these requests.`

**Cause:** RFC 7644 § 3.11 resolves /Me to the authenticated user. The SCIM client authenticates as a connection, so there is no user to resolve.

**Fix:** Read or change the user at /Users/\{id} instead.

### LS-SCIM-1606

**Request timed out**

HTTP status `503`. `scimType`: none.

Error detail: `The request did not finish within the time limit; retry after the Retry-After interval.`

**Cause:** The platform did not answer within 15 seconds (60 seconds for /Bulk), for example while a database or the sign-in provider was slow.

**Fix:** No action is needed; identity providers retry automatically after the Retry-After interval. If it keeps happening, contact Living Security Support with the X-Request-Id.

## Mapping check findings

These are not request errors. The mapping check reports them when it reads an attribute-mapping export from your identity provider.

### LS-SCIM-1701

**Mapping export not readable**

**Cause:** The pasted text is not a Microsoft Entra ID provisioning schema export, or it has no mapping for users.

**Fix:** In the Entra enterprise application, open Provisioning > Mappings > Show advanced options > Review your schema here, download the schema and paste the whole file.

### LS-SCIM-1702

**Wrong matching attribute**

**Cause:** The mapping with matching precedence 1 targets an attribute the platform does not use to find an existing user, so every cycle can create duplicates.

**Fix:** Edit the userName mapping, set Match objects using this attribute to Yes with matching precedence 1, and turn matching off for the other mapping.

### LS-SCIM-1703

**userName source differs from sign-in**

**Cause:** The SCIM userName and the single sign-on NameID come from different source attributes, so a provisioned person cannot sign in as themselves.

**Fix:** Map userName from the same source attribute as the NameID claim in the single sign-on configuration, usually userPrincipalName.

### LS-SCIM-1704

**active does not follow deletion**

**Cause:** active is mapped from a constant, another attribute or a different expression, so a person removed in Entra is not deactivated.

**Fix:** Map active with the expression Switch(\[IsSoftDeleted], , "False", "True", "True", "False").

### LS-SCIM-1705

**Work email not mapped**

**Cause:** No mapping targets emails\[type eq "work"].value, so a person can be activated without the email the platform uses for training and notices.

**Fix:** Add a mapping from mail (or userPrincipalName) to emails\[type eq "work"].value.

### LS-SCIM-1706

**Manager not mapped**

**Cause:** No mapping targets the enterprise extension manager, or the manager source is mapped to another attribute, so reporting lines are lost.

**Fix:** Map the manager source attribute to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager.

### LS-SCIM-1707

**Mapping to an undeclared attribute**

**Cause:** The mapping targets an attribute or extension the platform does not declare, so the value is stored on the SCIM user but never reaches the person.

**Fix:** Map the source to a declared core, enterprise or Living Security extension attribute, or remove the mapping.


## Related topics

- [SCIM API reference and limits](https://docs.livingsecurity.com/features/settings/scim/api-reference.md)
- [SCIM attribute reference](https://docs.livingsecurity.com/features/settings/scim/attributes.md)
- [SCIM and Google Workspace](https://docs.livingsecurity.com/features/settings/scim-google-workspace.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.