> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting SCIM

> Fix SCIM provisioning failures from the status code and scimType your identity provider reports.

Start with your IdP's provisioning log: Okta lists failed tasks under the app's provisioning errors, and Entra ID shows them in its provisioning logs. Each failure has a status code and, for most, a `scimType`. Find them in the table below, fix the cause, then retry the person from your IdP.

Every SCIM error uses the SCIM error schema (`urn:ietf:params:scim:api:messages:2.0:Error`), with a `scimType` where SCIM defines one and a `detail` that names the problem.

## Status codes

| Status | `scimType` | When | What to do |
| - | - | - | - |
| `400` | `invalidValue` | The email isn't on one of your verified domains; the primary email isn't an email address; `userName` is empty; in a PATCH, `active` isn't a boolean | Verify the domain in Sazabi, or fix the attribute mapping in your IdP |
| `400` | `invalidFilter` | A filter other than `userName eq "…"` or `externalId eq "…"` | Use one of those two filters |
| `400` | `invalidSyntax` | A body that isn't JSON or isn't a SCIM User or PatchOp, including a POST or PUT whose `active` isn't a boolean; a PATCH `remove`; a PATCH path Sazabi doesn't support | Remove the unsupported attribute from your IdP's mapping |
| `400` | `mutability` | Deactivating an owner, a break-glass owner or the last admin; reactivating someone an admin removed | Change the person's role or membership in Sazabi, or have an admin invite them again. See [SCIM provisioning](https://docs.sazabi.com/guides/administer/single-sign-on/scim.md#deactivation). |
| `401` | none | The token is missing, unknown, expired or revoked; SCIM is off; the connection is deleted or its sign-in is off | If the token is missing, unknown, expired or revoked, rotate it and paste the new one into your IdP. If SCIM is off, turn it on and paste the token it shows. If the connection's **Allow sign-in** is off, turn it back on. If the connection was deleted, configure a new one and turn SCIM on for it. See [Manage SCIM](https://docs.sazabi.com/guides/administer/single-sign-on/scim-manage.md) and [Set up SCIM](https://docs.sazabi.com/guides/administer/single-sign-on/scim-setup.md). |
| `403` | none | Your plan's member limit is reached, or it doesn't allow the connection's default role | Free a seat or change plans, then retry |
| `404` | none | The user ID is unknown, deleted, or belongs to another connection | Let your IdP look the person up again by `userName` |
| `409` | `uniqueness` | The person already has an active SCIM record; more than one member has the address; two directory objects claim one person; an admin removed the person; another record on your connection has the same `userName`, ignoring case; the email belongs to an account SCIM can't create | See [SCIM provisioning](https://docs.sazabi.com/guides/administer/single-sign-on/scim.md#how-people-are-matched) |
| `429` | none | More than 600 requests a minute on one token | Nothing; your IdP retries after `Retry-After` |
| `501` | none | Groups, Bulk or Me | Turn off group provisioning in your IdP |
| `503` | none | SCIM is paused, or Sazabi couldn't complete the request | If paused, check your IdP's recent changes and resume. See [Manage SCIM](https://docs.sazabi.com/guides/administer/single-sign-on/scim-manage.md#safety-limits). Otherwise your IdP retries after `Retry-After`. |

`409`, `403` and `400 mutability` refusals that owners need to act on also email every owner. See [SCIM provisioning](https://docs.sazabi.com/guides/administer/single-sign-on/scim.md#conflicts-and-owner-notices).

## What Sazabi supports

| Endpoint | Supported |
| - | - |
| `GET /ServiceProviderConfig`, `GET /ResourceTypes`, `GET /Schemas` | Yes |
| `GET /Users`, with `filter`, `startIndex` and `count` up to 100 | Yes |
| `GET`, `PUT`, `PATCH` and `DELETE` on `/Users/{id}` | Yes |
| `POST /Users` | Yes |
| `/Groups`, `/Bulk`, `/Me` | No: `501` |
| Sorting, ETags, password changes | No |

A User's writable attributes are `userName`, `name`, `displayName`, `emails` and `active`, and `externalId` on create. PATCH supports `add` and `replace`. In a PATCH, `active` may be a boolean or the string `"True"` or `"False"`; in a POST or PUT it must be a boolean. Sazabi ignores `emails` in a PATCH: a changed email never changes a person's Sazabi account address. An `externalId` in a PUT or PATCH replaces a record's `userName` stand-in, when it was created without one, and is otherwise ignored.

The person's address is their primary email, or their only email, or else `userName`.

Unknown is never success: if Sazabi can't read the token, the domain or the membership, it answers `503` so your IdP retries.

## Verify the fix

Retry the person from your IdP: in Okta, retry the failed task; in Entra ID, use **Provision on demand**. The person appears on [**Settings > Members**](https://app.sazabi.com/settings/members), or their change shows there, and **Last change received** in the **SCIM provisioning** section of [**Settings > Single sign-on**](https://app.sazabi.com/settings/single-sign-on) updates. If the same error comes back and none of the causes fits, send the person's `userName` and the time of the failure to [Sazabi support](https://docs.sazabi.com/guides/administer/support.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.