Patch a Group

To update specific attributes of an existing group, send a PATCH request to /Groups/$GROUP_ID. The PATCH operation is defined by RFC-7644 §3.5.2.

The request body MUST contain a valid SCIM PATCH request with a "schemas" value of "urn:ietf:params:scim:api:messages:2.0:PatchOp" and an "Operations" array with one or more PATCH operations (add, remove, or replace).

Values in the request body for immutable or read-only fields (as defined in RFC-7643 §4.2) will be ignored. Fields that are omitted from the request body will be left unchanged.

Note: The Beyond Identity SCIM server currently does not support atomic PATCH operations. If a request contains multiple operations, the request may be partially applied.

The Beyond Identity SCIM server also does not support modifying both a group's attributes and its membership in the same operation. For example, a PATCH request to update a group's display name and its membership should specify two separate operations, one to update the display name and the other to modify the membership.

If a request contains multiple operations, the request may be partially applied:

1. The server first validates the overall request schema and attribute types
2. Operations are then applied sequentially in the order provided
3. If any operation fails, processing stops immediately
4. Previously successful operations remain applied
5. The error response does not indicate which operation failed or which operations were applied
6. To determine the current state, clients should issue a GET request after receiving an error

This method can be used to provision roles to a user. Role provisioning is performed by adding the user to the appropriate role group as a member.

It is not possible to rename a role group or change its description.