passbolt/passbolt_api · error · Cake\Http\Exception\BadRequestException

Invalid data to create a SCIM Operation

Error message

Invalid data to create a SCIM Operation

What it means

SCIM Operation objects require at least an 'op' key and a 'value' key in their raw data. When setFromScim is given operation data missing either key, validateScimData throws this BadRequestException before constructing the object. It guards against malformed PATCH operation payloads.

Solutions

1. Ensure each entry in the PATCH request 'Operations' array contains both 'op' and 'value' keys.
2. For remove operations, include a 'value' key (even an empty array or the required value shape) as passbolt requires it.
3. Validate the PATCH payload against RFC 7644 section 3.5.2 before sending.
4. Inspect the incoming JSON and log it to identify the offending operation entry.

Example fix

// before
{"op": "replace", "path": "active"}
// after
{"op": "replace", "path": "active", "value": true}

// Validate each PATCH operation entry before sending
foreach ($payload['Operations'] as $op) {
    if (!array_key_exists('op', $op) || !array_key_exists('value', $op)) {
        throw new InvalidArgumentException('SCIM operation must contain both op and value');
    }
}

function isValidScimOperation(mixed $op): bool {
    return is_array($op) && array_key_exists('op', $op) && array_key_exists('value', $op);
}

try {
    $operation = Operation::setFromScim($data);
} catch (BadRequestException $e) {
    // log $data and reject/repair the operation entry
}

When it happens

Trigger: Calling Operation::setFromScim() with an array lacking 'op' (e.g. ['value' => [...]]) or lacking 'value' (e.g. ['op' => 'replace', 'path' => 'active']), typically from a SCIM PATCH request Operations[] entry.

Common situations: A SCIM client omits 'value' for a remove operation variant passbolt doesn't accept; hand-crafted PATCH JSON misses a field; IdP sends non-standard operation objects.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Unable to apply operation
• Could not validate the SCIM settings.
• Could not validate the SCIM settings found in database.
• Invalid data to create a SCIM PATCH REQUEST
• Invalid schema for SCIM PATCH REQUEST

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/558101ef30ccd951. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Object/Operation.php:118

        $this->validateScimData($data);
        $this->setType($data['op'] ?? null);
        $this->setPathData($data['path'] ?? null);
        $this->value = $data['value'] ?? null;

        return $this;
    }

    /**
     * @param array $data
     * @return void
     */
    protected function validateScimData(array $data): void
    {
        if (
            !array_key_exists('op', $data) ||
            !array_key_exists('value', $data)
        ) {
            throw new BadRequestException('Invalid data to create a SCIM Operation');
        }
        if (
            !array_key_exists('path', $data) &&
            !is_array($data['value'])
        ) {
            throw new BadRequestException('Invalid data to create a SCIM Operation');
        }
    }

    /**
     * @inheritDoc
     */
    public function toSCIM(): array
    {
        return [
            'op' => $this->operationType,
            'path' => $this->path,
            'value' => $this->value,

View on GitHub (pinned to 31c1bbc10f)