What causes "The operation type `%s` is not supported or invalid" in passbolt/passbolt_api?

Use only RFC 7644 operations: add, remove, replace.

passbolt/passbolt_api · error · Passbolt\Scim\Exception\ScimException

The operation type ` ` is not supported or invalid

Error message

The operation type `%s` is not supported or invalid

What it means

The 'op' value of a SCIM operation must be one of the supported types (add, remove, replace, case-insensitive). setType lowercases the input and checks it against Operation::isValidType; anything else throws this ScimException. It prevents unknown or misspelled operation verbs from entering the PATCH pipeline.

Solutions

Use only RFC 7644 operations: add, remove, replace.
Check Operation::isValidType / the class constants for the exact accepted set.
Log the raw op value from the request to spot typos or vendor extensions.
If a new operation is genuinely needed, extend isValidType and the handling code in the plugin.

Example fix

// before
{"op": "modify", "path": "displayName", "value": "Alice"}
// after
{"op": "replace", "path": "displayName", "value": "Alice"}

Defensive patterns

Strategy: validation

Validate before calling

const ALLOWED_OPS = ['add', 'remove', 'replace'];
if (!in_array(strtolower($op['op'] ?? ''), ALLOWED_OPS, true)) {
    throw new InvalidArgumentException("Invalid SCIM op: " . ($op['op'] ?? 'null'));
}

Type guard

function isValidOpType(string $op): bool {
    return in_array(strtolower($op), ['add', 'remove', 'replace'], true);
}

Try / catch

try {
    $operation = Operation::setFromScim($data);
} catch (ScimException $e) {
    // skip or remap unsupported op; alert on unknown IdP verbs
}

Prevention

Restrict generated ops to add/remove/replace.
Normalize op casing before sending (server lowercases anyway, but validate early).
Check Operation::isValidType when upgrading the plugin, in case the accepted set changes.
Reject vendor-specific ops at the client boundary.

When it happens

Trigger: Calling Operation::setFromScim() or the constructor with an op like 'delete', 'Add User', 'modify', or an empty/invalid string, typically from a PATCH request Operations[] entry with an unknown op.

Common situations: Custom SCIM client uses a non-RFC7644 verb; IdP sends a vendor-specific op; typo in hand-written PATCH payload; localized/case issues in op names.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/a7f91024d78b7507. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Object/Operation.php:163

    public function getType(): ?string
    {
        return $this->operationType;
    }

    /**
     * @param string|null $operationType
     * @return $this
     */
    protected function setType(?string $operationType)
    {
        if ($operationType === null) {
            $this->operationType = null;

            return $this;
        }
        $operationType = strtolower($operationType);
        if (!self::isValidType($operationType)) {
            throw new ScimException(sprintf('The operation type `%s` is not supported or invalid', $operationType));
        }
        $this->operationType = $operationType;

        return $this;
    }

    /**
     * Return the path
     *
     * @return string|null
     */
    public function getPath(): ?string
    {
        return $this->path;
    }

    /**
     * Return the value

View on GitHub (pinned to 31c1bbc10f)