--- title: "Patch a Group" method: PATCH path: "/scim/v2/Groups/{group_id}" tags: ["SCIM"] --- # Patch a Group `PATCH /scim/v2/Groups/{group_id}` ## Request - Base URL: `https://api.byndid.com` - URL: `https://api.byndid.com/scim/v2/Groups/{group_id}` - Auth: HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) To update specific attributes of an existing group, send a PATCH request to `/Groups/$GROUP_ID`. The PATCH operation is defined by [RFC-7644 §3.5.2](https://datatracker.ietf.org/doc/html/rfc7644#section-3.5.2). The request body MUST contain a valid SCIM PATCH request with a "schemas" value of "urn:ietf:params:scim:api:messages:2.0:PatchOp" and an "Operations" array with one or more PATCH operations (add, remove, or replace). Values in the request body for immutable or read-only fields (as defined in [RFC-7643 §4.2](https://datatracker.ietf.org/doc/html/rfc7643#section-4.2)) will be ignored. Fields that are omitted from the request body will be left unchanged. Note: The Beyond Identity SCIM server currently does not support atomic PATCH operations. If a request contains multiple operations, the request may be partially applied. The Beyond Identity SCIM server also does not support modifying both a group's attributes and its membership in the same operation. For example, a PATCH request to update a group's display name and its membership should specify two separate operations, one to update the display name and the other to modify the membership. If a request contains multiple operations, the request may be partially applied: 1. The server first validates the overall request schema and attribute types 2. Operations are then applied sequentially in the order provided 3. If any operation fails, processing stops immediately 4. Previously successful operations remain applied 5. The error response does not indicate which operation failed or which operations were applied 6. To determine the current state, clients should issue a GET request after receiving an error This method can be used to provision roles to a user. Role provisioning is performed by adding the user to the appropriate role group as a member. It is not possible to rename a role group or change its description. ## Path parameters - `group_id` string, required ## Request body - object: Request for UpdateGroup. Due to the complexity of SCIM PATCH operations, it is strongly recommended to refer to the examples for proper request formatting and supported operations. - `schemas` string[], required - `Operations` object[], required - `op` 'add' | 'remove' | 'replace', required - `path` string - `value` object, required: The value to be updated. The structure of the value is dependent on the path. Please refer to the examples for proper request formatting. For example, the value for the path "members" must be an array of member objects as follows: ```json [ { "value": "2819c223-7f76-453a-919d-413861904646" } ] ``` The value for the path "displayName" must be a string representing the display name of the group. The value for the path "urn:scim:schemas:extension:byndid:1.0:Group:description" must be a string representing the description of the group. ## Response `200` Successfully updated the Group resource. The response contains the full representation of the modified Group, including any server-side changes and read-only attributes as specified in [RFC-7644 §3.5.2](https://datatracker.ietf.org/doc/html/rfc7644#section-3.5.2). - SCIMGroup: A group is a collection of users corresponding to [RFC 7643 Section 4.2](https://www.rfc-editor.org/rfc/rfc7643#section-4.2). - `schemas` string[], required: The list of schemas used to define the group. This must contain the core Group schema ("urn:ietf:params:scim:schemas:core:2.0:Group") and may include the custom Beyond Identity Group schema extension ("urn:scim:schemas:extension:byndid:1.0:Group"). - `id` string, required: The unique ID of the group. This is automatically generated on creation. This field is immutable and output-only. - `displayName` string, required: The unique display name of the group. This name is used for display purposes. - `members` object[]: The list of the group's members. - `display` string: The display name of the group member, primarily used for display purposes. - `value` string: ID of the user resource corresponding to the group member. This field is immutable. - `$ref` string: The URI to another user resource that is a member of the group. This is field is only used for requests and is not returned on the response. - `type` string: The resource type of the group member. Currently, only users are supported as group members. This field is only used for requests and is not returned on the response. Specifying a group as a group member on a request is unsupported and will result in undefined behavior. - `urn:scim:schemas:extension:byndid:1.0:Group` object, required: The Beyond Identity Group schema extension. - `description` string, required: Description of the group. - `meta` Meta, required (unresolved $ref) ## Other responses - `400`: Request validation error. May occur due to: - Invalid PATCH operation syntax - Attempt to modify read-only attributes - Invalid attribute values - Schema validation failures - Unsupported operation combinations - `401`: Unauthorized. - `404`: Returns 404 if: * The group was not found * The group exists but was created through the Admin Console * The group is one of the RBAC permission groups Note: Groups not created via SCIM APIs cannot be updated using SCIM APIs. - `429`: Rate limit exceeded. - `500`: Server error. --- [API](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api.md) - [All operations](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/llms.txt) - [OpenAPI document](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/revisions/562e14b2e4ba?raw)