---
title: "Update a group mapping"
method: PATCH
path: "/group-mapping/{id}"
tags: ["Group mapping"]
---

# Update a group mapping

`PATCH /group-mapping/{id}`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/group-mapping/{id}`
- Auth: HTTP bearer

Updates a group mapping. **`role_ids` REPLACES the mapped role when present** — at most one role, since a member holds exactly one (two or more answers 400 `role_cardinality`). Members lose the old mapped role on their next recompute; manually assigned roles are untouched and always win. Requires `sso:manage`, and — because a mapping is a deferred grant applied with no actor present — you may only map a role whose permissions you hold yourself. A browser session must also pass a fresh step-up reauthentication in the app (without it the call answers `428 step_up_required`). An organization API token is not challenged.

## Path parameters

- `id` string, required

## Headers

- `X-Organization-Id` string

## Request body

- object
  - `scim_group_id` string
  - `role_ids` string[]: Replaces the mapped role; at most one.

## Response `200`

OK

- object
  - `id` string: Group mapping id (`gmap_…`).
  - `scim_group_id` string: SCIM group from `GET /scim-group`.
  - `role_ids` string[]: The single role (`role_…`) every member of that group receives.
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)