{"record":{"id":"813afd43fa76d4b5","repo":"passbolt/passbolt_api","slug":"the-user-resource-could-not-be-deleted-due-to-validation","errorCode":null,"errorMessage":"The User resource could not be deleted due to validation failure","messagePattern":"The User resource could not be deleted due to validation failure","errorType":"http","errorClass":"ConflictException","httpStatus":409,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php","lineNumber":959,"sourceCode":"                    'The values of the %s resource has not been set for the `delete` operation',\n                    $this->getType()\n                )\n            );\n        }\n\n        $this->assertAdminDeleteAllowed();\n\n        try {\n            $result = $this->Users->softDelete($this->userEntity);\n            $errors = $this->userEntity->getErrors();\n            if (!$result || $errors !== []) {\n                if (isset($errors['id']['soleOwnerOfSharedContent'])) {\n                    // @todo: send email\n                    throw new ConflictException(\n                        'The user cannot be deleted because its the sole owner of shared content'\n                    );\n                }\n                throw new ConflictException('The User resource could not be deleted due to validation failure');\n            }\n        } catch (Exception $e) {\n            ScimLog::error(sprintf('Unable to delete the user with id `%s`', $this->userEntity->id));\n            ScimLog::error($e->getMessage());\n            ScimLog::error($e->getTraceAsString());\n\n            throw new ConflictException('Unexpected error when trying to delete the user.');\n        }\n\n        return $this;\n    }\n\n    /**\n     * @inheritDoc\n     */\n    public function toSCIM(): array\n    {\n        if (!$this->id) {","sourceCodeStart":941,"sourceCodeEnd":977,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php#L941-L977","documentation":"Generic fallback in UserScimResource::delete(): the soft-delete call returned false or produced entity validation errors that are not the specific 'sole owner of shared content' rule. The SCIM endpoint translates this into an HTTP 409 Conflict. The real cause is only visible in ScimLog (error + stack trace are logged).","triggerScenarios":"DELETE /scim/v2.0/Users/{id} where Users->softDelete() fails for any validation reason other than sole ownership: e.g. user already deleted, entity in an invalid state, or a table rule blocking deletion.","commonSituations":"Attempting to delete an already-deleted user through a stale IdP directory; deleting a user blocked by a validation rule added by a plugin; race conditions where two SCIM delete requests arrive concurrently.","solutions":["Inspect ScimLog for 'Unable to delete the user with id `...`' and the logged error/trace to identify the actual validation failure.","Check whether the user was already deleted or is currently marked deleted (GET the user first; treat 404/already-deleted as success for idempotency).","Fix the underlying validation issue (entity state, plugin rule) and retry the DELETE.","Ensure the SCIM client sends deletes only once and handles retries idempotently."],"exampleFix":"// before\ncurl -X DELETE .../Users/$id  # retries on timeout cause double delete\n// after: check current state first\ncurl .../Users/$id || true\ncurl -X DELETE .../Users/$id  # only if still active","handlingStrategy":"try-catch","validationCode":"$user = $client->get(\"/scim/v2.0/Users/{$id}\");\nif ($user->getStatusCode() !== 200) { /* skip: not deletable */ }","typeGuard":null,"tryCatchPattern":"try {\n    $client->delete(\"/scim/v2.0/Users/{$id}\");\n} catch (ClientException $e) {\n    if ($e->getResponse()->getStatusCode() === 404) {\n        return; // idempotent success: already deleted\n    }\n    throw $e; // inspect server ScimLog for the real validation error\n}","preventionTips":["Make SCIM deletes idempotent: treat 404/409-on-already-deleted as success.","Never retry the same DELETE concurrently; serialize delete operations per user.","Keep the deletion flow single-step per user in the IdP mapping.","Correlate failures with server ScimLog entries 'Unable to delete the user with id'."],"tags":["scim","user-deletion","validation","conflict"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}