passbolt/passbolt_api · error · Cake\Http\Exception\ForbiddenException

SCIM settings endpoints are disabled.

Error message

SCIM settings endpoints are disabled.

What it means

This ForbiddenException is raised by ScimSettingsSecurityMiddleware when the Configure flag passbolt.security.scim.settings.endpointsDisabled is set to a truthy value. It is a kill-switch that lets instance administrators hard-disable all SCIM settings management endpoints (creating/updating/deleting SCIM configurations) while leaving SCIM provisioning itself unaffected. The middleware short-circuits the request before the handler runs.

Solutions

1. If the endpoints should be available, remove or set to false the 'passbolt.security.scim.settings.endpointsDisabled' key in config/passbolt.php and clear the config cache
2. Verify the current value before calling the API by inspecting your configuration files (grep for endpointsDisabled)
3. If disabling is intentional, manage SCIM settings through alternative means (CLI or direct provisioning) instead of the HTTP API
4. Confirm with your instance administrator that the flag was deliberately set before changing it, as it may be part of a security policy

Example fix

// before (config/passbolt.php)
'security' => [
    'scim' => ['settings' => ['endpointsDisabled' => true]],
],

// after
'security' => [
    'scim' => ['settings' => ['endpointsDisabled' => false]],
],

// check config before calling
$enabled = !Configure::read('passbolt.security.scim.settings.endpointsDisabled');
if (!$enabled) { /* skip settings API calls */ }

function isScimSettingsEnabled(config: { passbolt?: { security?: { scim?: { settings?: { endpointsDisabled?: boolean } } } } }): boolean {
  return config.passbolt?.security?.scim?.settings?.endpointsDisabled !== true;
}

try {
  const res = await fetch('/scim/v2/settingId.json', opts);
  if (res.status === 403) throw new ScimSettingsDisabledError();
} catch (e) { /* fall back to CLI/direct config management */ }

When it happens

Trigger: Any HTTP call to the SCIM settings endpoints (GET/POST/PUT/DELETE on /scim/v2/settingId.json routes) while the config key 'passbolt.security.scim.settings.endpointsDisabled' is truthy - typically because passbolt.php or config/scim.php sets 'security' => ['scim' => ['settings' => ['endpointsDisabled' => true]]].

Common situations: Hardened production deployments where the SCIM config was set once out-of-band and admins now wonder why the API returns 403; stale configuration copied from a security-hardening guide; attempting to manage SCIM settings via API on an instance where the admin policy requires CLI-based configuration.

Related errors

• An administrator user cannot be deleted via SCIM.
• An administrator user cannot be suspended via SCIM.
• Missing or invalid SCIM user in configuration settings
• Simultaneous SCIM and session authentication is not…
• The SCIM secret token expiry configuration is invalid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/f574d88354f82777. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Middleware/ScimSettingsSecurityMiddleware.php:41

use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class ScimSettingsSecurityMiddleware implements MiddlewareInterface
{
    public const PASSBOLT_SECURITY_SCIM_SETTINGS_ENDPOINTS_DISABLED =
        'passbolt.security.scim.settings.endpointsDisabled';

    /**
     * @param \Psr\Http\Message\ServerRequestInterface $request The request.
     * @param \Psr\Http\Server\RequestHandlerInterface $handler The handler.
     * @return \Psr\Http\Message\ResponseInterface The response.
     */
    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $handler
    ): ResponseInterface {
        if (Configure::read(self::PASSBOLT_SECURITY_SCIM_SETTINGS_ENDPOINTS_DISABLED)) {
            throw new ForbiddenException(__('SCIM settings endpoints are disabled.'));
        }

        return $handler->handle($request);
    }
}

View on GitHub (pinned to 31c1bbc10f)