passbolt/passbolt_api · error · Cake\Http\Exception\BadRequestException

Invalid data to create a SCIM PATCH REQUEST

Error message

Invalid data to create a SCIM PATCH REQUEST

What it means

After the schema check passes, validateScimData requires the PATCH payload to contain an 'Operations' key holding the list of patch operations. Its absence means the request has a valid PatchOp schema declaration but no actual operations, so this BadRequestException is thrown.

Solutions

1. Include an 'Operations' key (array) in the PATCH body; use an empty array if there is truly nothing to change.
2. Fix key casing to exactly 'Operations' per RFC 7644.
3. Ensure your serializer does not drop empty arrays; send Operations: [] explicitly.
4. Log the decoded request body to confirm what actually reached the server.

Example fix

// before
{"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "operations": []}
// after
{"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": []}

if (!array_key_exists('Operations', $body)) {
    throw new InvalidArgumentException('PATCH body must contain an Operations array');
}

function hasOperations(mixed $body): bool {
    return is_array($body) && array_key_exists('Operations', $body)
        && is_array($body['Operations']);
}

try {
    $patchRequest = PatchRequest::setFromScim($data);
} catch (BadRequestException $e) {
    // ensure key casing is 'Operations' and rebuild payload
}

When it happens

Trigger: PATCH /scim/v2/Users/{id} or /Groups/{id} with a body containing 'schemas' with the PatchOp URN but no 'Operations' array (or misspelled key like 'operations').

Common situations: Case-sensitivity mistake ('operations' vs 'Operations'); client builds an empty patch and omits the key instead of sending an empty array; JSON serialization drops empty arrays.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Invalid data to create a SCIM Operation
• Invalid schema for SCIM PATCH REQUEST
• The email can not be changed
• The operation type ` ` is not supported or invalid
• The operation type ` ` is not supported or invalid

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d463be57b0cafd44. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Object/PatchRequest.php:65

        foreach ((array)$operations as $operationData) {
            $this->operations[] = (new Operation())->setFromScim($operationData);
        }

        return $this;
    }

    /**
     * @param array $data
     * @return void
     */
    protected function validateScimData(array $data): void
    {
        $schemas = $data['schemas'] ?? [];
        if (!in_array(SchemaIdentifier::API_PATCH_OPERATION, $schemas)) {
            throw new BadRequestException('Invalid schema for SCIM PATCH REQUEST');
        }
        if (!array_key_exists('Operations', $data)) {
            throw new BadRequestException('Invalid data to create a SCIM PATCH REQUEST');
        }
    }

    /**
     * @inheritDoc
     */
    public function toSCIM(): array
    {
        $data = [
            'schemas' => [SchemaIdentifier::API_PATCH_OPERATION],
            'Operations' => [],
        ];
        foreach ($this->operations as $operation) {
            $data['Operations'][] = $operation->toSCIM();
        }

        return $data;
    }

View on GitHub (pinned to 31c1bbc10f)