{"id":"bf8b354d-b9e8-463b-b4b9-d1181cc66f7f","task":"Implement SCIM 2.0 group provisioning and PATCH semantics correctly","domain":"identity-general","steps":["Expose a /Groups endpoint supporting GET, POST, PUT, PATCH, and DELETE as specified in RFC 7644 sections 3.3 through 3.6.","Handle PATCH requests with a PatchOp body containing an array of operations; each operation has an op of add, remove, or replace and a path targeting the members attribute.","For add operations on members, append the supplied value array to the existing members list; for remove operations, delete members matching the filter in the path (e.g., members[value eq \"user-id\"]).","For replace on the members attribute, overwrite the entire members list with the supplied value array — do not merge.","Be aware that Microsoft Entra ID sends non-standard PATCH bodies when modifying group members, sometimes combining add and replace operations in a single request; handle both in your parser.","Return 200 with the updated Group resource or 204 with no body on successful PATCH; return 400 with a SCIM error schema body for malformed operations."],"gotchas":["Microsoft Entra ID is known to send PATCH requests that do not fully conform to RFC 7644 — for example, issuing a replace on members alongside an add in the same PATCH body; test against your actual IdP, not just the spec.","SCIM PATCH is not JSON Patch (RFC 6902); do not implement array indexing or the move operation — SCIM patch uses path filters, not numeric indices.","Some IdPs send a full replace on the members array to add a single member, which can truncate the group if your server treats replace as a delta rather than a full overwrite."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:30.178Z"},"url":"https://mcp.waymark.network/r/bf8b354d-b9e8-463b-b4b9-d1181cc66f7f"}