passbolt/passbolt_api · error · Passbolt\Scim\Exception\BadRequestException

No email with type "work" was found in the

Error message

No email with type "work" was found in the %s payload.

What it means

This BadRequestException is thrown when a SCIM POST (user create) payload contains no email of type "work", so the resource cannot resolve a username. Passbolt requires exactly the "work" email as the canonical user identifier before creating a User entity. It is raised in validateCreatePreconditions() at the start of create().

Solutions

1. Add an emails entry with "type": "work" and "primary": true to the SCIM payload
2. Fix the IdP attribute mapping so the user's email is sent as a work-type email
3. Verify the payload with the SCIM /Schemas endpoint to confirm emails.type is populated

Example fix

// before
{"userName":"jdoe@example.com","emails":[{"value":"jdoe@example.com","type":"home"}]}
// after
{"userName":"jdoe@example.com","emails":[{"value":"jdoe@example.com","type":"work","primary":true}]}

$emails = $payload['emails'] ?? [];
$hasWorkEmail = false;
foreach ($emails as $email) {
    if (($email['type'] ?? '') === 'work' && !empty($email['value'])) {
        $hasWorkEmail = true;
    }
}
if (!$hasWorkEmail) {
    throw new InvalidArgumentException('SCIM payload must include an email with type "work".');
}

try {
    $scimUsers->create();
} catch (\Passbolt\Scim\Exception\BadRequestException $e) {
    if ($e->getScimType() === 'invalidValue') {
        // fix payload: add work-type email and retry
    }
}

When it happens

Trigger: POST /scim/v2/Users whose emails array omits type "work", uses a different type (e.g. "home"), or omits the emails attribute entirely.

Common situations: Misconfigured IdP SCIM attribute mappings (e.g. Azure AD/Okta mapping emails to a custom type), custom SCIM clients sending only preferredEmail, or schema changes where email is mapped with no type field.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Could not validate the SCIM settings.
• Could not validate the SCIM settings found in database.
• Invalid data to create a SCIM Operation
• Invalid UserControl username.
• The email can not be changed

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/61cba0a8d8f4c005. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php:291

                return $user;
            }
        );

        $this->setFromDatabase($user->id);

        return $this;
    }

    /**
     * Validate preconditions before attempting user creation.
     *
     * @throws \Passbolt\Scim\Exception\BadRequestException When "work" email is missing in the payload.
     * @throws \Passbolt\Scim\Exception\ConflictException When resource id is already present.
     */
    private function validateCreatePreconditions(): void
    {
        if (!$this->email) {
            throw new BadRequestException(
                sprintf('No email with type "work" was found in the %s payload.', $this->getType()),
                scimType: ScimException::SCIM_TYPE_INVALID_VALUE,
            );
        }
        if ($this->id) {
            throw new ConflictException(
                sprintf(
                    'The %s resource with id `%s` could not be created due to a uniqueness conflict',
                    $this->getType(),
                    $this->id
                ),
                scimType: ScimException::SCIM_TYPE_UNIQUENESS,
            );
        }
    }

    /**
     * Find an existing user by email with a FOR UPDATE lock, loading associations.

View on GitHub (pinned to 31c1bbc10f)