{"record":{"id":"0c12884a94bcc1de","repo":"passbolt/passbolt_api","slug":"unable-to-apply-operation-s-for-the-attribute-s-with","errorCode":null,"errorMessage":"Unable to apply operation `%s` for the attribute `%s` with mutability `%s`","messagePattern":"Unable to apply operation `(.+?)` for the attribute `(.+?)` with mutability `(.+?)`","errorType":"exception","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php","lineNumber":553,"sourceCode":"        if (!$serviceConfig->isPatchSupported()) {\n            throw new NotSupportedException('The PATCH operation is not supported');\n        }\n        if (!$this->userEntity) {\n            throw new ScimException('The database user must be set to apply an operation');\n        }\n\n        $userPatchData = [];\n        $scimEntryPatchData = [];\n        foreach ($patchRequest->getOperations() as $operation) {\n            if ($operation->getAttribute() === null) {\n                $attributes = $operation->getValue();\n            } else {\n                $attributes[$operation->getAttribute()] = $operation->getValue();\n            }\n            foreach ($attributes as $attributeName => $attributeValue) {\n                $mutability = $this->getAttributeMutability($attributeName);\n                if ($mutability === ScimConstants::ATTRIBUTE_MUTABILITY_READ_ONLY) {\n                    throw new BadRequestException(sprintf(\n                        'Unable to apply operation `%s` for the attribute `%s` with mutability `%s`',\n                        $operation->getType(),\n                        $attributeName,\n                        $mutability,\n                    ), scimType: ScimException::SCIM_TYPE_MUTABILITY);\n                }\n                if (\n                    $mutability === ScimConstants::ATTRIBUTE_MUTABILITY_IMMUTABLE &&\n                    $operation->getType() !== Operation::TYPE_ADD\n                ) {\n                    throw new BadRequestException(sprintf(\n                        'Unable to apply operation `%s` for the attribute `%s` with mutability `%s`',\n                        $operation->getType(),\n                        $attributeName,\n                        $mutability,\n                    ), scimType: ScimException::SCIM_TYPE_MUTABILITY);\n                }\n","sourceCodeStart":535,"sourceCodeEnd":571,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php#L535-L571","documentation":"This BadRequestException is raised during patch() when an operation targets an attribute whose SCIM mutability is readOnly (or, in the following check, immutable with a non-add operation). SCIM semantics forbid clients modifying such attributes, and the error carries scimType \"mutability\".","triggerScenarios":"PATCH /scim/v2/Users/{id} with an operation (add/replace/remove) on a readOnly attribute from the CORE_USER schema — e.g. attempting to replace the immutable id, meta, or any schema field marked readOnly.","commonSituations":"IdP trying to push server-managed fields (e.g. groups/id/meta) during sync, custom SCIM clients PATCHing the whole user object including readOnly attributes, or schema updates making previously writable fields readOnly.","solutions":["Remove readOnly attributes from the PATCH operations payload; only send mutable fields (active, name.*, emails, externalId, userName)","Change the operation to TYPE_ADD if targeting an immutable attribute that permits add","Inspect ServiceProviderConfig /Schemas to confirm each attribute's mutability before building PATCH operations"],"exampleFix":"// before\n{\"Operations\":[{\"op\":\"replace\",\"path\":\"id\",\"value\":\"new-id\"}]}\n// after\n{\"Operations\":[{\"op\":\"replace\",\"path\":\"active\",\"value\":true}]}","handlingStrategy":"validation","validationCode":"$readOnly = ['id', 'meta', 'groups', 'schemas']; // plus any schema attrs marked readOnly\nforeach ($patchRequest->getOperations() as $op) {\n    $attrs = $op->getAttribute() !== null ? [$op->getAttribute()] : array_keys($op->getValue());\n    foreach ($attrs as $attr) {\n        if (in_array($attr, $readOnly, true)) {\n            throw new InvalidArgumentException(\"Cannot PATCH read-only attribute '$attr'.\");\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    $scimUsers->patch($id, $patchRequest);\n} catch (\\Passbolt\\Scim\\Exception\\BadRequestException $e) {\n    if ($e->getScimType() === 'mutability') {\n        // strip the offending read-only/immutable attribute and resend\n    }\n}","preventionTips":["Send only minimal, mutable attributes in PATCH (active, name.*, emails, externalId, userName)","Never echo full fetched user objects back as PATCH operations payloads","Consult the /Schemas endpoint for each attribute's mutability before building operations"],"tags":["scim","mutability","patch","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}