passbolt/passbolt_api · error · Passbolt\Scim\Exception\ScimException

The mutability ` ` is invalid or not supported

Error message

The mutability `%s` is invalid or not supported

What it means

This ScimException is thrown by getAttributeMutability() when the mutability value extracted from the core user SCIM schema is not one of the valid SCIM mutability constants (readOnly/readWrite/immutable/writeOnly). It guards against a corrupted or unexpected schema definition.

Solutions

1. Verify ScimConstants::isValidAttributeMutability and the CORE_USER schema contain correct mutability values
2. Clear cache and ensure the Scim plugin version matches the schema definitions (composer install/update)
3. Inspect Schemas::build(SchemaIdentifier::CORE_USER)->toSCIM() output to confirm attributes expose a valid 'mutability' key

Example fix

// before (schema attribute missing mutability)
{"name":"active","type":"boolean"}
// after
{"name":"active","type":"boolean","mutability":"readWrite"}

$mutability = $schemaAttribute['mutability'] ?? null;
$valid = ['readOnly', 'readWrite', 'immutable', 'writeOnly'];
if (!in_array($mutability, $valid, true)) {
    // fail fast before sending PATCH
    throw new RuntimeException("Attribute mutability '$mutability' is not valid SCIM.");
}

try {
    $scimUsers->patch($id, $patchRequest);
} catch (\Passbolt\Scim\Exception\ScimException $e) {
    if (str_contains($e->getMessage(), 'mutability')) {
        // schema/plugin mismatch: update plugin, clear cache, re-fetch schema
    }
}

When it happens

Trigger: PATCH /scim/v2/Users/{id} processing an attribute (name.givenName, name.familyName, active, emails) whose mutability extracted from the generated schema is null or an unrecognized string.

Common situations: Schema files/plugin version mismatch (schema built by Schemas::build returns unexpected structure), Hash::extract path failing after a schema refactor leaving mutability null, or customized/overridden SCIM schema constants.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Could not validate the SCIM settings.
• Could not validate the SCIM settings found in database.
• Invalid data to create a SCIM Operation
• Invalid Schema
• Invalid schema for SCIM PATCH REQUEST

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/17607a285966ac15. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php:521

                $attribute = Hash::extract($nameAttribute, "subAttributes.{n}[name=$subAttributeName]");
                $mutability = $attribute[0]['mutability'] ?? null;
                break;
            case 'active':
                $attribute = Hash::extract($userSchema, 'attributes.{n}[name=active]');
                $mutability = $attribute[0]['mutability'] ?? null;
                break;
            case 'emails':
                $emailsAttribute = Hash::extract($userSchema, 'attributes.{n}[name=emails]')[0] ?? [];
                $attribute = Hash::extract($emailsAttribute, 'subAttributes.{n}[name=value]');
                $mutability = $attribute[0]['mutability'] ?? null;
                break;
            default:
                // set no used attributes as ATTRIBUTE_MUTABILITY_READ_WRITE to not trigger an error
                // this attributes will not be processed further int he process
                $mutability = ScimConstants::ATTRIBUTE_MUTABILITY_READ_WRITE;
        }
        if (!ScimConstants::isValidAttributeMutability((string)$mutability)) {
            throw new ScimException(sprintf('The mutability `%s` is invalid or not supported', $mutability));
        }

        return $mutability;
    }

    /**
     * {@inheritDoc}
     *
     * @throws \Exception
     */
    public function patch(PatchRequest $patchRequest): static
    {
        $serviceConfig = new ServiceProviderConfig();
        if (!$serviceConfig->isPatchSupported()) {
            throw new NotSupportedException('The PATCH operation is not supported');
        }
        if (!$this->userEntity) {
            throw new ScimException('The database user must be set to apply an operation');

View on GitHub (pinned to 31c1bbc10f)