What one SCIM write did, plus the one diagnostic an admin can act on.
unresolved_paths holds the declared scim_path values — the admin's own
spelling, sorted — that this write produced NO value for. That is what a
typo'd scim_path looks like from our side: silence, on a mapping the
admin believes is wired up. It never names an attribute that WAS written,
by construction (a path that resolved a value is not in it).
Per verb, because the verbs mean different things:
- put/post replace the whole resource, so every declared path is in
play — a declared path the resource yielded nothing for is unresolved.
- patch touches only what it mentions, so only the paths the operations
actually addressed are considered. A declared path a PATCH never
mentioned is left untouched, not unresolved; reporting it would list
every declared attribute on every one of Entra's incremental cycles.
It does NOT enumerate incoming wire paths that matched no declared path:
those are ignored by design (IngestScimAttributes' module docstring).
Deliberate overlap: a declared path a PUT explicitly cleared is both
unresolved (it produced no value) AND counted in deleted (a stored row
went away), so both fields can be non-empty for the same path. Both are
true; neither is double-counting the other. The same overlap happens for
a PATCH remove on a path the operations DID mention: an unfiltered
remove also resolves to "no value", so it lands in both deleted and
unresolved_paths too — a PATCH avoids the overlap only for paths it
never mentions, not for every path it does.