{"record":{"id":"61cba0a8d8f4c005","repo":"passbolt/passbolt_api","slug":"no-email-with-type-work-was-found-in-the-s-payload","errorCode":null,"errorMessage":"No email with type \"work\" was found in the %s payload.","messagePattern":"No email with type \"work\" was found in the (.+?) payload\\.","errorType":"exception","errorClass":"Passbolt\\Scim\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php","lineNumber":291,"sourceCode":"                return $user;\n            }\n        );\n\n        $this->setFromDatabase($user->id);\n\n        return $this;\n    }\n\n    /**\n     * Validate preconditions before attempting user creation.\n     *\n     * @throws \\Passbolt\\Scim\\Exception\\BadRequestException When \"work\" email is missing in the payload.\n     * @throws \\Passbolt\\Scim\\Exception\\ConflictException When resource id is already present.\n     */\n    private function validateCreatePreconditions(): void\n    {\n        if (!$this->email) {\n            throw new BadRequestException(\n                sprintf('No email with type \"work\" was found in the %s payload.', $this->getType()),\n                scimType: ScimException::SCIM_TYPE_INVALID_VALUE,\n            );\n        }\n        if ($this->id) {\n            throw new ConflictException(\n                sprintf(\n                    'The %s resource with id `%s` could not be created due to a uniqueness conflict',\n                    $this->getType(),\n                    $this->id\n                ),\n                scimType: ScimException::SCIM_TYPE_UNIQUENESS,\n            );\n        }\n    }\n\n    /**\n     * Find an existing user by email with a FOR UPDATE lock, loading associations.","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php#L273-L309","documentation":"This BadRequestException is thrown when a SCIM POST (user create) payload contains no email of type \"work\", so the resource cannot resolve a username. Passbolt requires exactly the \"work\" email as the canonical user identifier before creating a User entity. It is raised in validateCreatePreconditions() at the start of create().","triggerScenarios":"POST /scim/v2/Users whose emails array omits type \"work\", uses a different type (e.g. \"home\"), or omits the emails attribute entirely.","commonSituations":"Misconfigured IdP SCIM attribute mappings (e.g. Azure AD/Okta mapping emails to a custom type), custom SCIM clients sending only preferredEmail, or schema changes where email is mapped with no type field.","solutions":["Add an emails entry with \"type\": \"work\" and \"primary\": true to the SCIM payload","Fix the IdP attribute mapping so the user's email is sent as a work-type email","Verify the payload with the SCIM /Schemas endpoint to confirm emails.type is populated"],"exampleFix":"// before\n{\"userName\":\"jdoe@example.com\",\"emails\":[{\"value\":\"jdoe@example.com\",\"type\":\"home\"}]}\n// after\n{\"userName\":\"jdoe@example.com\",\"emails\":[{\"value\":\"jdoe@example.com\",\"type\":\"work\",\"primary\":true}]}","handlingStrategy":"validation","validationCode":"$emails = $payload['emails'] ?? [];\n$hasWorkEmail = false;\nforeach ($emails as $email) {\n    if (($email['type'] ?? '') === 'work' && !empty($email['value'])) {\n        $hasWorkEmail = true;\n    }\n}\nif (!$hasWorkEmail) {\n    throw new InvalidArgumentException('SCIM payload must include an email with type \"work\".');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $scimUsers->create();\n} catch (\\Passbolt\\Scim\\Exception\\BadRequestException $e) {\n    if ($e->getScimType() === 'invalidValue') {\n        // fix payload: add work-type email and retry\n    }\n}","preventionTips":["Always map the IdP's primary email attribute to emails with type \"work\" and primary true","Test SCIM payloads against the /Schemas endpoint before enabling production sync","Add a payload lint step in your provisioning pipeline checking emails[0].type"],"tags":["scim","validation","email"],"backgroundTag":"missing-required-argument","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}