SCIM token rotation succeeded, but the response was incomple

Error message

SCIM token rotation succeeded, but the response was incomplete.

What it means

After a successful SCIM token rotation request, handleRotateToken parses the response with parseOrgScimPayload and requires baseUrl, connection, and scimToken to all be present before updating UI state. If any of the three is missing, it throws this error. The rotation itself succeeded — the server likely rotated the token — but the client cannot display the new connection state, and the new token value may be lost if not shown here.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_components/scim-screen.tsx:180

    setError(null);
    setVisibleToken(null);
    try {
      await runReauthableAction("rotate-scim-token", async () => {
        setRotating(true);
        try {
          const { response, payload } = await requestJson(
            "/v1/scim/token",
            { method: "POST", body: JSON.stringify({}) },
            12000,
          );

          if (!response.ok) {
            throw getRequestError(payload, response, `Failed to rotate SCIM token (${response.status}).`);
          }

          const parsed = parseOrgScimPayload(payload);
          if (!parsed.baseUrl || !parsed.connection || !parsed.scimToken) {
            throw new Error("SCIM token rotation succeeded, but the response was incomplete.");
          }

          setBaseUrl(parsed.baseUrl);
          setSsoReady(parsed.ssoReady);
          setConnection(parsed.connection);
          setHealth(parsed.health);
          setVisibleToken(parsed.scimToken);
          setCopiedValue(null);
        } finally {
          setRotating(false);
        }
      });
    } catch (nextError) {
      setError(
        nextError instanceof Error ? nextError.message : "Failed to rotate SCIM token.",
      );
    }
  }

View on GitHub (pinned to 2b7df46e8a)

Solutions

Log/inspect the rotate response payload and confirm which of baseUrl/connection/scimToken is missing
Update parseOrgScimPayload to unwrap the actual response envelope
Fix the rotate endpoint to return the full SCIM config (baseUrl, connection, scimToken) after rotation
If the token is intentionally redacted after rotation, redesign the UI to show the token only from the rotate response and stop requiring it here

Example fix

// before
if (!parsed.baseUrl || !parsed.connection || !parsed.scimToken) {
  throw new Error("SCIM token rotation succeeded, but the response was incomplete.");
}
// after
if (!parsed.scimToken || !parsed.connection) {
  throw new Error(`SCIM token rotation response incomplete (baseUrl=${Boolean(parsed.baseUrl)}, connection=${Boolean(parsed.connection)}, token=${Boolean(parsed.scimToken)}).`);
}
if (parsed.baseUrl) setBaseUrl(parsed.baseUrl);

Defensive patterns

Strategy: validation

Validate before calling

function parseOrgScimPayload(payload: unknown): { baseUrl?: string; connection?: unknown; scimToken?: string; ssoReady?: boolean; health?: unknown } {
  const body = typeof payload === "object" && payload !== null && "data" in payload ? (payload as { data: unknown }).data : payload;
  return (body ?? {}) as Record<string, never>;
}
// pre-check before trusting state updates:
const missing = [!parsed.baseUrl && "baseUrl", !parsed.connection && "connection", !parsed.scimToken && "scimToken"].filter(Boolean);

Type guard

function isCompleteScimRotation(p: { baseUrl?: unknown; connection?: unknown; scimToken?: unknown }): p is { baseUrl: string; connection: Record<string, unknown>; scimToken: string } {
  return typeof p.baseUrl === "string" && p.baseUrl.length > 0 && typeof p.connection === "object" && p.connection !== null && typeof p.scimToken === "string" && p.scimToken.length > 0;
}

Try / catch

try {
  const parsed = parseOrgScimPayload(payload);
  if (!isCompleteScimRotation(parsed)) {
    throw new Error("SCIM token rotation succeeded, but the response was incomplete.");
  }
  setBaseUrl(parsed.baseUrl);
} catch (error) {
  setError(error instanceof Error ? error.message : "Failed to rotate SCIM token.");
}

Prevention

Have the rotate endpoint return the full SCIM config atomically and cover it with a contract test
Log (redacted) rotation payloads during development to catch envelope drift early
Never require a secret (scimToken) in later GET responses — only in the rotation response
Version the SCIM API response schema and validate with Zod at the boundary

When it happens

Trigger: POST to the SCIM rotate-token endpoint returns ok but the payload lacks baseUrl, connection, or scimToken — e.g. the API only returns the new token, omits the connection object for partially configured orgs, or returns a wrapped envelope parseOrgScimPayload doesn't unwrap.

Common situations: Org with SSO configured but SCIM connection not yet provisioned; API response envelope change ({ data: ... }); server redacting scimToken for security in newer versions; stale frontend expecting a field the API no longer returns.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/dbe10ccfa485355a. Report an issue: GitHub.