> ## Documentation Index
> Fetch the complete documentation index at: https://launchdarkly.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM API constraints and troubleshooting

<View title="Developer" />

<View title="Federal docs" />

<View title="EU docs" />

This topic explains constraints on the LaunchDarkly System for Cross-domain Identity Management (SCIM) API and how to troubleshoot common problems.

## Owner restrictions

Owner restrictions include:

* You cannot create users with the `"owner"` role. The API returns a 400 error: "Cannot create an owner."
* Any attempt to update an existing owner's role using SCIM is silently ignored. No error is returned.
* You cannot deactivate an owner. The API returns a 400 error: "Cannot deactivate an owner."
* Only one owner is allowed per account.

## Deactivated users

You cannot update attributes (name, role, and so forth) on a user who is currently deactivated (`active: false`). You must reactivate them first or simultaneously with the update.

## Role keys

When assigning custom roles, you must use the role **key**, and not the human-readable name or ID. Custom roles must exist in the account before they can be assigned.

## Email uniqueness

Email addresses must be unique within an account. If you attempt to provision a user with an email that already exists, you will receive a 409 Conflict error.

## Field validation

Field validation includes:

* `givenName` and `familyName` must be 256 characters or fewer each.
* Email addresses must use a valid format.
* Role values must be `"reader"`, `"writer"`, `"admin"`, or `"noAccess"`.

## Okta compatibility

For Okta requests (identified by User-Agent header starting with `okta`), the `customRole` string field is not included in responses. Only `customRolesArray` is returned.

## Extension schema declaration

The LaunchDarkly implementation is lenient and will accept root-level extension attributes (`role`, `customRole`, `customRolesArray`) even if the extension schema is not declared in the `schemas` array. However, for strict SCIM 2.0 compliance, include `urn:ietf:params:scim:schemas:extension:launchdarkly:2.0:User` in the `schemas` array when using these attributes.