{"record":{"id":"87d932f199c5cd5e","repo":"passbolt/passbolt_api","slug":"the-email-can-not-be-changed","errorCode":null,"errorMessage":"The email can not be changed","messagePattern":"The email can not be changed","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php","lineNumber":606,"sourceCode":"                                }\n                                break;\n                            case 'name.familyName':\n                                if (empty($this->lastName)) {\n                                    $userPatchData['profile']['last_name'] = $attributeValue;\n                                }\n                                break;\n                            case 'active':\n                                if ($this->active === null) {\n                                    if (is_string($attributeValue)) {\n                                        $value = in_array(strtolower($attributeValue), ['true', '1']);\n                                    } else {\n                                        $value = (bool)$attributeValue;\n                                    }\n                                    $userPatchData['disabled'] = $this->getDisabledValue($value);\n                                }\n                                break;\n                            case 'emails':\n                                throw new BadRequestException(\n                                    'The email can not be changed',\n                                    scimType: ScimException::SCIM_TYPE_MUTABILITY\n                                );\n                            default:\n                                // ignore attributes not used in this application\n                        }\n                        break;\n                    case Operation::TYPE_REPLACE:\n                        switch ($attributeName) {\n                            case 'externalId':\n                                $scimEntryPatchData['external_identifier'] = $attributeValue;\n                                break;\n                            case 'userName':\n                                $scimEntryPatchData['scim_name'] = $attributeValue;\n                                break;\n                            case 'name.givenName':\n                                $userPatchData['profile']['first_name'] = $attributeValue;\n                                break;","sourceCodeStart":588,"sourceCodeEnd":624,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php#L588-L624","documentation":"In a SCIM PATCH `add` operation on a user, an operation targeting the `emails` attribute is unconditionally rejected: passbolt does not allow email addresses to be modified through SCIM because the email is the user's identity/login key. It throws a 400 BadRequestException with scimType `mutability`.","triggerScenarios":"PATCH /scim/v2/Users/<id> with op `add` and path/value containing `emails` (e.g. {\"op\":\"add\",\"path\":\"emails\",\"value\":[{\"value\":\"new@mail.com\"}]}).","commonSituations":"An IdP synchronization changes a user's email address and tries to propagate the change via SCIM; an admin tries to fix a typo'd email through SCIM instead of the passbolt UI/CLI; Azure AD provisioning maps the mail field as an updatable attribute.","solutions":["Remove the `emails` attribute from the IdP's SCIM attribute mapping so it is never sent in PATCH operations.","Change the email through the passbolt admin UI or the `passbolt users` CLI command instead of SCIM.","If the address must change, delete and re-create (re-provision) the user via SCIM.","Configure the IdP to treat email as immutable for this provisioning app."],"exampleFix":"// before (IdP mapping sends email updates)\n{\"Operations\":[{\"op\":\"add\",\"path\":\"emails\",\"value\":[{\"value\":\"new@mail.com\"}]}]}\n// after (map emails read-only; change it server-side instead)\n// passbolt: bin/cake passbolt users change_user_email <user-id> new@mail.com","handlingStrategy":"validation","validationCode":"if (String(op.path || '').startsWith('emails')) throw new Error('passbolt: emails cannot be changed via SCIM; use admin UI/CLI');","typeGuard":null,"tryCatchPattern":"try { await scim.patchUser(id, ops); } catch (e) { if (e.status === 400 && e.scimType === 'mutability' && /email/i.test(e.message)) { ops = ops.filter(o => !String(o.path||'').startsWith('emails')); } else throw e; }","preventionTips":["Set emails mapping to read-only / DoNotSync in the IdP","Never include emails in PATCH payloads for passbolt","Change emails via passbolt admin UI or CLI only"],"tags":["scim","patch","email","mutability"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}