passbolt/passbolt_api · error · Cake\Http\Exception\BadRequestException

Unable to apply operation

Error message

Unable to apply operation `%s` for the attribute `%s` with mutability `%s`

What it means

This BadRequestException is raised during patch() when an operation targets an attribute whose SCIM mutability is readOnly (or, in the following check, immutable with a non-add operation). SCIM semantics forbid clients modifying such attributes, and the error carries scimType "mutability".

Solutions

1. Remove readOnly attributes from the PATCH operations payload; only send mutable fields (active, name.*, emails, externalId, userName)
2. Change the operation to TYPE_ADD if targeting an immutable attribute that permits add
3. Inspect ServiceProviderConfig /Schemas to confirm each attribute's mutability before building PATCH operations

Example fix

// before
{"Operations":[{"op":"replace","path":"id","value":"new-id"}]}
// after
{"Operations":[{"op":"replace","path":"active","value":true}]}

$readOnly = ['id', 'meta', 'groups', 'schemas']; // plus any schema attrs marked readOnly
foreach ($patchRequest->getOperations() as $op) {
    $attrs = $op->getAttribute() !== null ? [$op->getAttribute()] : array_keys($op->getValue());
    foreach ($attrs as $attr) {
        if (in_array($attr, $readOnly, true)) {
            throw new InvalidArgumentException("Cannot PATCH read-only attribute '$attr'.");
        }
    }
}

try {
    $scimUsers->patch($id, $patchRequest);
} catch (\Passbolt\Scim\Exception\BadRequestException $e) {
    if ($e->getScimType() === 'mutability') {
        // strip the offending read-only/immutable attribute and resend
    }
}

When it happens

Trigger: PATCH /scim/v2/Users/{id} with an operation (add/replace/remove) on a readOnly attribute from the CORE_USER schema — e.g. attempting to replace the immutable id, meta, or any schema field marked readOnly.

Common situations: IdP trying to push server-managed fields (e.g. groups/id/meta) during sync, custom SCIM clients PATCHing the whole user object including readOnly attributes, or schema updates making previously writable fields readOnly.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalid data to create a SCIM Operation
• The email can not be changed
• Could not validate the SCIM settings.
• Could not validate the SCIM settings found in database.
• Invalid data to create a SCIM PATCH REQUEST

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0c12884a94bcc1de. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php:553

        if (!$serviceConfig->isPatchSupported()) {
            throw new NotSupportedException('The PATCH operation is not supported');
        }
        if (!$this->userEntity) {
            throw new ScimException('The database user must be set to apply an operation');
        }

        $userPatchData = [];
        $scimEntryPatchData = [];
        foreach ($patchRequest->getOperations() as $operation) {
            if ($operation->getAttribute() === null) {
                $attributes = $operation->getValue();
            } else {
                $attributes[$operation->getAttribute()] = $operation->getValue();
            }
            foreach ($attributes as $attributeName => $attributeValue) {
                $mutability = $this->getAttributeMutability($attributeName);
                if ($mutability === ScimConstants::ATTRIBUTE_MUTABILITY_READ_ONLY) {
                    throw new BadRequestException(sprintf(
                        'Unable to apply operation `%s` for the attribute `%s` with mutability `%s`',
                        $operation->getType(),
                        $attributeName,
                        $mutability,
                    ), scimType: ScimException::SCIM_TYPE_MUTABILITY);
                }
                if (
                    $mutability === ScimConstants::ATTRIBUTE_MUTABILITY_IMMUTABLE &&
                    $operation->getType() !== Operation::TYPE_ADD
                ) {
                    throw new BadRequestException(sprintf(
                        'Unable to apply operation `%s` for the attribute `%s` with mutability `%s`',
                        $operation->getType(),
                        $attributeName,
                        $mutability,
                    ), scimType: ScimException::SCIM_TYPE_MUTABILITY);
                }

View on GitHub (pinned to 31c1bbc10f)