Groups

When: A POST or PUT /groups request omits name, provides an empty name, description, externalId, or displayName that is empty or exceeds its size limit (displayName must be 1‑256 characters, externalId at most 1024), or includes blacklisted patterns such as <script or ${

Details: must not be null for an omitted name, size must be between 1 and 256 for an empty or over-length name, must be between 1 and 256 characters for an empty or over-length displayName, must not be empty for an empty description, size must be between 1 and 1024 for an empty or over-length externalId, must not contain blacklisted patterns for a name, displayName, or externalId that includes a blacklisted pattern, or:

for a name with disallowed characters, for example Validation Error : [name size must be between 1 and 256]

When: A POST /groups request creates a group with a name that duplicates an existing group in the environment or population, or a PUT /groups/{ID} request renames the group to one that does. Only groups in different populations can have the same name

Details: A group with the specified name already exists. with target name on create, or A group with the specified name already exists. Only groups in different populations can have the same name. with target name on rename

When: A POST or PUT /groups request attempts to create or update an external or provisioned group from the standard group endpoint, or omits sourceType or sourceId from an external group creation request, or provides a displayName without which an external group cannot be created

Details: Cannot create an external group from this endpoint., Cannot create a group without a sourceType from the External Group Creation endpoint., Cannot create a group without a sourceId from the External Group Creation endpoint., or Cannot create an External Group without a displayName.

When: A POST /groups request would exceed the maximum number of groups per environment (100,000 by default), provides customData larger than the size limit, or requests a dynamic group (userFilter) in an environment configured for a high group count

Details: Cannot create more than <maximum> groups per environment., Cannot create a group with customData larger than 10 KB, or Dynamic groups are disabled in this environment as it is configured for a high group count.

When: A POST or PUT /groups request sets isAdmin or isAccessRequestGroup directly, sets userFilter on an access request group, or a DELETE /groups/{ID} request targets an access request group

Details: The isAdmin attribute is not editable and is only updated when the group’s roles are added or removed., The isAccessRequestGroup attribute cannot be set directly. Use the Access Request group endpoint., The userFilter attribute cannot be set on an access request group., or Access request groups cannot be deleted.

When: A POST /users/{userID}/memberOfGroups request adds a user to a group with more than 10,000 memberships, a POST /groups/{groupID}/memberOfGroups request exceeds the nested group size limit of 250 nested groups or the environment nested membership limit, or nests a group inside an external group, or an environment configured for a high group count receives a nested‑group request

Details: Membership count for this group has exceeded 10,000., Number of nested groups has exceeded the size limit of <maximum>, Nested membership count for this environment has exceeded the limit of <maximum>, Cannot create a membership for a group within an external group, or Nested groups are disabled in this environment as it is configured for a high group count.

When: A POST /users/{userID}/memberOfGroups request adds a user to a JIT external group, or a POST /groups/{groupID}/memberOfGroups request nests an environment group inside a population group, or nests groups that include an administrator group

Details: Cannot create a membership for a user within an external group (target memberOfGroupIDs), Cannot add an environment group to a population group, or You cannot create a group membership that includes an administrator group.

When: A POST /users/{userID}/memberOfGroups request adds a user to a group in a different population, or a POST /groups/{groupID}/memberOfGroups request nests a group into a group in a different population, nests a group into itself, or references a nesting group that does not exist

Details: Cannot add a user to a group in a different population, Cannot add a group to another group in a different population, Cannot add a group to itself (detail INVALID_VALUE on the nested‑group endpoint; the same self‑nesting check inside the service returns detail CONSTRAINT_VIOLATION), or Group does not exist groupId=<groupId>

When: A POST or PUT /groups request provides a userFilter SCIM filter expression that is invalid, or sets userFilter on an admin group, or a GET /groups request uses a filter expression that cannot be parsed, references an attribute that does not support filtering, or contains an unsupported operator

Details: For a dynamic group filter, detail INVALID_FILTER with target userFilter carrying the underlying filter message or Invalid Filter: <userFilter>, or The userFilter property cannot be used to populate an admin group and must be empty. with target value. For collection filters, The value provided is invalid with target value, Invalid filter: <underlying message> with target value, The filter operator was invalid or not supported. with target operator, or The filter attribute was invalid or does not support filtering. with target attribute.

When: A GET /groups or GET /users/{userID}/memberOfGroups request has a limit query parameter less than 1 or greater than 1000, or an unsupported expand option

Details: Must be between 1 and 1000 (on GET /groups; the same check on GET /users/{userID}/memberOfGroups and GET /groups/{groupID}/memberOfGroups returns must be between 1 and 1000) or <expand> is not a valid expand option. Valid options: group

When: The actor lacks the dir:create:group permission (POST), the dir:read:group permission (GET), the dir:update:group or dir:provision:group permission (PUT), the dir:delete:group permission (DELETE), or the dir:create:groupMembership, dir:create:bulkGroupMembership, dir:delete:groupMembership, or dir:delete:bulkGroupMembership permission (membership operations), or the actor is population‑ or group‑scoped and is not authorized for the target resource

Details: None.

When: A POST /users/{userID}/memberOfGroups request adds the actor themselves to an administrator group (or removes themselves from one), or a DELETE /groups/{ID} request deletes an administrator group the actor belongs to

Details: None. The delete guard applies only when the actor is a USER; a CLIENT actor can delete any admin group.

When: A GET, PUT, or DELETE /groups/{ID} request references a group or an environment that does not exist, or a POST /users/{userID}/memberOfGroups request references a nested group that does not exist

Details: None.