Skip to main content
This topic explains constraints on the LaunchDarkly System for Cross-domain Identity Management (SCIM) API and how to troubleshoot common problems.

​
Owner restrictions

Owner restrictions include:
  • You cannot create users with the "owner" role. The API returns a 400 error: “Cannot create an owner.”
  • Any attempt to update an existing owner’s role using SCIM is silently ignored. No error is returned.
  • You cannot deactivate an owner. The API returns a 400 error: “Cannot deactivate an owner.”
  • Only one owner is allowed per account.

​
Deactivated users

You cannot update attributes (name, role, and so forth) on a user who is currently deactivated (active: false). You must reactivate them first or simultaneously with the update.

​
Role keys

When assigning custom roles, you must use the role key, and not the human-readable name or ID. Custom roles must exist in the account before they can be assigned.

​
Email uniqueness

Email addresses must be unique within an account. If you attempt to provision a user with an email that already exists, you will receive a 409 Conflict error.

​
Field validation

Field validation includes:
  • givenName and familyName must be 256 characters or fewer each.
  • Email addresses must use a valid format.
  • Role values must be "reader", "writer", "admin", or "noAccess".

​
Okta compatibility

For Okta requests (identified by User-Agent header starting with okta), the customRole string field is not included in responses. Only customRolesArray is returned.

​
Extension schema declaration

The LaunchDarkly implementation is lenient and will accept root-level extension attributes (role, customRole, customRolesArray) even if the extension schema is not declared in the schemas array. However, for strict SCIM 2.0 compliance, include urn:ietf:params:scim:schemas:extension:launchdarkly:2.0:User in the schemas array when using these attributes.