passbolt/passbolt_api · warning · ScimException

Invalid Schema

Error message

Invalid Schema

What it means

Schemas::build() looks up a SCIM schema id (a URN like urn:ietf:params:scim:schemas:core:2.0:User) in its MAPPING of known schemas. If the id is unknown, it throws ScimException 'Invalid Schema'. Passbolt only implements the core User and Group schemas.

Solutions

1. Use only the supported schema URNs: urn:ietf:params:scim:schemas:core:2.0:User and urn:ietf:params:scim:schemas:core:2.0:Group (see SchemaIdentifier / GET /Schemas).
2. Check GET /scim/v2.0/Schemas to list exactly which schemas passbolt advertises, and make the client consume that list instead of hardcoding extra ones.
3. If your IdP requires an unsupported schema (e.g. Enterprise User), disable that feature in the IdP mapping or contribute/extend the MAPPING in Schemas.php.

Example fix

// before
Schemas::build('urn:ietf:params:scim:schemas:extension:enterprise:2.0:User'); // throws
// after
if (Schemas::isValid($schemaId)) {
    $schema = Schemas::build($schemaId);
}

const SUPPORTED_SCHEMAS = [
  'urn:ietf:params:scim:schemas:core:2.0:User',
  'urn:ietf:params:scim:schemas:core:2.0:Group',
];
if (!SUPPORTED_SCHEMAS.includes(schemaUrn)) {
  console.warn('Schema not supported by passbolt, skipping');
}

function isSupportedSchema(urn) {
  return typeof urn === 'string' &&
    /^urn:ietf:params:scim:schemas:core:2\.0:(User|Group)$/.test(urn);
}

try {
  const schema = await fetchSchema(urn);
} catch (e) {
  if (e.response && e.response.status === 400) {
    // unknown schema: fall back to GET /Schemas discovery
  }
}

When it happens

Trigger: Requesting /scim/v2.0/Schemas/{id} with an unknown or misspelled schema URN; client code calling Schemas::build() with an id not in MAPPING (e.g. an Enterprise extension schema the client expects but passbolt does not provide).

Common situations: IdP probing for schemas passbolt doesn't implement (e.g. urn:...:enterprise:2.0:User); typo in a custom integration's schema URN; case-sensitivity issues in the URN.

Related errors

• Invalid ResourceType
• Invalid schema for SCIM PATCH REQUEST
• Invalid schema for SCIM User Resource
• The mutability ` ` is invalid or not supported
• An administrator user cannot be deleted via SCIM.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0d41e8bd39bcf7e1. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Schemas.php:77

            $schemas[] = self::build($identifier);
        }

        return $schemas;
    }

    /**
     * Build a schema object given the id
     *
     * @param string $schemaId
     * @return \Passbolt\Scim\Utility\ScimObjectInterface
     * @throws \Passbolt\Scim\Exception\ScimException
     * @throws \Exception
     */
    public static function build(string $schemaId): ScimObjectInterface
    {
        $schemaClass = self::MAPPING[$schemaId] ?? null;
        if (!$schemaClass) {
            throw new ScimException(__('Invalid Schema'));
        }

        return new $schemaClass();
    }
}

View on GitHub (pinned to 31c1bbc10f)