Troubleshooting SCIM

Start with your IdP’s provisioning log: Okta lists failed tasks under the app’s provisioning errors, and Entra ID shows them in its provisioning logs. Each failure has a status code and, for most, a scimType. Find them in the table below, fix the cause, then retry the person from your IdP. Every SCIM error uses the SCIM error schema (urn:ietf:params:scim:api:messages:2.0:Error), with a scimType where SCIM defines one and a detail that names the problem.

Status codes

Status	`scimType`	When	What to do
`400`	`invalidValue`	The email isn’t on one of your verified domains; the primary email isn’t an email address; `userName` is empty; in a PATCH, `active` isn’t a boolean	Verify the domain in Sazabi, or fix the attribute mapping in your IdP
`400`	`invalidFilter`	A filter other than `userName eq "…"` or `externalId eq "…"`	Use one of those two filters
`400`	`invalidSyntax`	A body that isn’t JSON or isn’t a SCIM User or PatchOp, including a POST or PUT whose `active` isn’t a boolean; a PATCH `remove`; a PATCH path Sazabi doesn’t support	Remove the unsupported attribute from your IdP’s mapping
`400`	`mutability`	Deactivating an owner, a break-glass owner or the last admin; reactivating someone an admin removed	Change the person’s role or membership in Sazabi, or have an admin invite them again. See SCIM provisioning.
`401`	none	The token is missing, unknown, expired or revoked; SCIM is off; the connection is deleted or its sign-in is off	If the token is missing, unknown, expired or revoked, rotate it and paste the new one into your IdP. If SCIM is off, turn it on and paste the token it shows. If the connection’s Allow sign-in is off, turn it back on. If the connection was deleted, configure a new one and turn SCIM on for it. See Manage SCIM and Set up SCIM.
`403`	none	Your plan’s member limit is reached, or it doesn’t allow the connection’s default role	Free a seat or change plans, then retry
`404`	none	The user ID is unknown, deleted, or belongs to another connection	Let your IdP look the person up again by `userName`
`409`	`uniqueness`	The person already has an active SCIM record; more than one member has the address; two directory objects claim one person; an admin removed the person; another record on your connection has the same `userName`, ignoring case; the email belongs to an account SCIM can’t create	See SCIM provisioning
`429`	none	More than 600 requests a minute on one token	Nothing; your IdP retries after `Retry-After`
`501`	none	Groups, Bulk or Me	Turn off group provisioning in your IdP
`503`	none	SCIM is paused, or Sazabi couldn’t complete the request	If paused, check your IdP’s recent changes and resume. See Manage SCIM. Otherwise your IdP retries after `Retry-After`.

409, 403 and 400 mutability refusals that owners need to act on also email every owner. See SCIM provisioning.

What Sazabi supports

Endpoint	Supported
`GET /ServiceProviderConfig`, `GET /ResourceTypes`, `GET /Schemas`	Yes
`GET /Users`, with `filter`, `startIndex` and `count` up to 100	Yes
`GET`, `PUT`, `PATCH` and `DELETE` on `/Users/{id}`	Yes
`POST /Users`	Yes
`/Groups`, `/Bulk`, `/Me`	No: `501`
Sorting, ETags, password changes	No

A User’s writable attributes are userName, name, displayName, emails and active, and externalId on create. PATCH supports add and replace. In a PATCH, active may be a boolean or the string "True" or "False"; in a POST or PUT it must be a boolean. Sazabi ignores emails in a PATCH: a changed email never changes a person’s Sazabi account address. An externalId in a PUT or PATCH replaces a record’s userName stand-in, when it was created without one, and is otherwise ignored. The person’s address is their primary email, or their only email, or else userName. Unknown is never success: if Sazabi can’t read the token, the domain or the membership, it answers 503 so your IdP retries.

Verify the fix

Retry the person from your IdP: in Okta, retry the failed task; in Entra ID, use Provision on demand. The person appears on Settings > Members, or their change shows there, and Last change received in the SCIM provisioning section of Settings > Single sign-on updates. If the same error comes back and none of the causes fits, send the person’s userName and the time of the failure to Sazabi support.

Overview

Get started

Guides

Catalogs

Reference

Security & trust

cve.now

Troubleshooting SCIM

Status codes

What Sazabi supports

Verify the fix

​Status codes

​What Sazabi supports

​Verify the fix

Status codes

What Sazabi supports

Verify the fix