different-ai/openwork · error

Failed to update SCIM group mapping (${response.status}).

Error message

Failed to update SCIM group mapping (${response.status}).

What it means

handleGroupMappingChange in scim-screen.tsx throws this when PATCH /v1/scim with { groupMappingMode } returns non-ok. It updates how SCIM group mappings are applied for the org; the error means the server rejected the change. On success it re-parses the payload and requires a connection object back.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_components/scim-screen.tsx:261

    if (!connection) {
      setError("Create the SCIM connector before enabling group synchronization.");
      return;
    }

    const groupMappingMode = connection.groupMappingMode === "create_teams"
      ? "metadata_only"
      : "create_teams";
    setError(null);
    setUpdatingGroupMapping(true);
    try {
      const { response, payload } = await requestJson(
        "/v1/scim",
        { method: "PATCH", body: JSON.stringify({ groupMappingMode }) },
        12000,
      );
      if (!response.ok) {
        throw getRequestError(payload, response, `Failed to update SCIM group mapping (${response.status}).`);
      }
      const parsed = parseOrgScimPayload(payload);
      if (!parsed.connection) {
        throw new Error("SCIM settings were updated, but the response was incomplete.");
      }
      setConnection(parsed.connection);
      setHealth(parsed.health);
    } catch (nextError) {
      setError(nextError instanceof Error ? nextError.message : "Failed to update SCIM group mapping.");
    } finally {
      setUpdatingGroupMapping(false);
    }
  }

  async function handleDeleteConnection() {
    if (!access.canManageScim) {
      setError("Only workspace owners and super-admins can delete SCIM connections.");
      return;

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Check status 400 and the payload: send only groupMappingMode values the server accepts (refresh the page to get current options).
2. For 401/403, re-authenticate or use an org-admin account.
3. 404: re-provision the SCIM connection, then change the mapping.
4. Retry after transient 5xx.

Example fix

// before: sending raw state that may be outdated
await requestJson('/v1/scim', { method: 'PATCH', body: JSON.stringify({ groupMappingMode: mode }) });
// after: whitelist known modes
const validModes = ['filter', 'sync_all'];
if (!validModes.includes(mode)) throw new Error('Unsupported group mapping mode.');
await requestJson('/v1/scim', { method: 'PATCH', body: JSON.stringify({ groupMappingMode: mode }) });

const VALID_MODES = connection?.supportedGroupMappingModes ?? [];
if (!VALID_MODES.includes(groupMappingMode)) {
  throw new Error('Unsupported group mapping mode for this connection.');
}

function isGroupMappingMode(v: unknown): v is string {
  return typeof v === 'string' && ['filter', 'sync_all'].includes(v);
}

try {
  await updateGroupMapping(mode);
} catch (e) {
  const msg = e instanceof Error ? e.message : String(e);
  if (/\(400\)/.test(msg)) { await loadScimConfig(); toast('That mapping mode is no longer supported — options refreshed.'); }
  else toast(msg);
}

When it happens

Trigger: PATCH /v1/scim returns 400 (invalid groupMappingMode value), 401/403 (auth/permission), 404 (no SCIM connection), or 5xx. Also when a stale UI sends a mode value the current server version no longer accepts.

Common situations: Selecting a mapping mode from a stale page after a server upgrade renamed modes; non-admin toggling settings; org lost its SCIM connection between load and save.

Related errors

• Failed to load SCIM settings (${response.status}).
• Failed to rotate SCIM token (${response.status}).
• Failed to reconcile SCIM (${response.status}).
• Failed to delete SCIM connection (${response.status}).
• Failed to update organization (${response.status}).

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/02bcf3e200906cfe. Report an issue: GitHub.