What causes "Invalid Resource type `%s`" in passbolt/passbolt_api?

Only sync Users over SCIM, or upgrade to a passbolt version where Groups SCIM resources are supported; configure the IdP to skip group provisioning.

passbolt/passbolt_api · warning · BadRequestException

Invalid Resource type

Error message

Invalid Resource type `%s`

What it means

ScimResources::build() maps a resource endpoint segment ('Users', 'Groups') to its resource class. Currently only 'Users' is mapped (Groups is not implemented in this build), so any other type throws BadRequestException 'Invalid Resource type `%s`' (HTTP 400).

Solutions

Only sync Users over SCIM, or upgrade to a passbolt version where Groups SCIM resources are supported; configure the IdP to skip group provisioning.
Use the exact endpoint segment 'Users' (case-sensitive) in client requests.
Guard with ScimResources::isValid($type) before build(), and return a proper SCIM error listing supported types.

Example fix

// before
curl -X POST https://passbolt/scim/v2.0/Groups ... // 400 Invalid Resource type `Groups`
// after: provision groups via passbolt API/UI, or upgrade to a build mapping Groups

Defensive patterns

Strategy: validation

Validate before calling

if (!scimCapabilities.resourceTypes.includes('Groups')) {
  // skip group provisioning entirely
  return;
}

Try / catch

try {
  await client.post('/scim/v2.0/Groups', body);
} catch (e) {
  if (e.response && e.response.status === 400 && /Invalid Resource type/.test(e.response.data?.detail ?? '')) {
    logger.warn('Groups not supported by this passbolt build');
  }
}

Prevention

Check GET /scim/v2.0/ResourceTypes before enabling group sync in the IdP.
Configure the IdP to not push groups when the passbolt build lacks Groups support.
Keep endpoint URLs exactly 'Users'/'Groups', case-sensitive.
Upgrade passbolt if group provisioning over SCIM is required.

When it happens

Trigger: Requests to /scim/v2.0/Groups or any endpoint segment not in MAPPING (e.g. /Users typo'd, /groups lowercase); calling ScimResources::build() from controller actions (create/delete/patch/put/view) with an unknown segment.

Common situations: IdP configured to sync groups to a passbolt version/build that doesn't support SCIM Groups; URL case mistakes; forwarding rules rewriting the path.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/cb120f9cea500055. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/ScimResources.php:60

     * @return bool
     */
    public static function isValid(string $type): bool
    {
        return array_key_exists($type, self::MAPPING);
    }

    /**
     * Build a Resource given the type
     *
     * @param string $type
     * @return \Passbolt\Scim\Utility\ScimResourceInterface
     * @throws \Exception
     */
    public static function build(string $type): ScimResourceInterface
    {
        $class = self::MAPPING[$type] ?? null;
        if (!$class) {
            throw new BadRequestException(sprintf('Invalid Resource type `%s`', $type), 400);
        }

        return new $class();
    }
}

View on GitHub (pinned to 31c1bbc10f)