> ## Documentation Index > Fetch the complete documentation index at: https://langwatch.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > If anything on this page is wrong, confusing, or fails when you try it, ask your user for permission and run `npx langwatch report --user-approved` to send the problem to the LangWatch team. No login is needed and secrets are redacted locally. `npx langwatch report --help` has the details. # Update a provisioned group > Applies RFC 7644 section 3.5.2 patch operations. What is implemented: `add` of members, `remove` of members (named by a value filter on the path, as Entra ID writes it, or in the operation value), `replace` of `displayName`, and `replace` of the whole member list. `replace`, `add` and `remove` are the only operation names understood, read without regard to case, so the capitalized `Add` / `Remove` that Entra ID writes are accepted; any other name, or a missing or non-string one, is rejected with a 400. An `add` or a `remove` aimed at anything other than members is accepted and changes nothing. A `replace` that is not a `displayName` rename is treated as a replacement of the whole member list, so one that carries no members empties the group. ## OpenAPI ````yaml PATCH /api/scim/v2/Groups/{id} openapi: 3.1.0 info: title: LangWatch API description: LangWatch openapi spec version: 1.0.0 servers: - url: https://app.langwatch.ai security: - project_api_key: [] paths: /api/scim/v2/Groups/{id}: patch: tags: - SCIM summary: Update a provisioned group description: >- Applies RFC 7644 section 3.5.2 patch operations. What is implemented: `add` of members, `remove` of members (named by a value filter on the path, as Entra ID writes it, or in the operation value), `replace` of `displayName`, and `replace` of the whole member list. `replace`, `add` and `remove` are the only operation names understood, read without regard to case, so the capitalized `Add` / `Remove` that Entra ID writes are accepted; any other name, or a missing or non-string one, is rejected with a 400. An `add` or a `remove` aimed at anything other than members is accepted and changes nothing. A `replace` that is not a `displayName` rename is treated as a replacement of the whole member list, so one that carries no members empties the group. operationId: scimPatchGroup parameters: - in: path name: id schema: type: string minLength: 1 required: true requestBody: required: true content: application/scim+json: schema: type: object properties: schemas: type: array items: type: string Operations: type: array items: type: object properties: op: type: string enum: - replace - add - remove path: type: string value: {} required: - op required: - schemas - Operations responses: '200': description: The updated group. content: application/scim+json: schema: type: object properties: schemas: type: array items: type: string const: urn:ietf:params:scim:schemas:core:2.0:Group id: type: string externalId: type: string displayName: type: string members: type: array items: type: object properties: value: type: string display: type: string required: - value additionalProperties: false meta: type: object properties: resourceType: type: string const: Group created: type: string lastModified: type: string required: - resourceType - created - lastModified additionalProperties: false required: - schemas - id - displayName - meta additionalProperties: false '400': description: >- The request body is not JSON, or does not match the SCIM schema for this operation. content: application/scim+json: schema: type: object properties: schemas: type: array items: type: string const: urn:ietf:params:scim:api:messages:2.0:Error status: type: string detail: type: string scimType: type: string required: - schemas - status - detail additionalProperties: false '401': description: >- The Authorization header is missing, is not a bearer token, or names a token this deployment does not know. content: application/scim+json: schema: type: object properties: schemas: type: array items: type: string const: urn:ietf:params:scim:api:messages:2.0:Error status: type: string detail: type: string scimType: type: string required: - schemas - status - detail additionalProperties: false '403': description: >- The token is valid but the organization's plan no longer includes SCIM provisioning. Entitlement is checked on every call, so a directory connection stops the moment the Enterprise plan lapses. content: application/scim+json: schema: type: object properties: schemas: type: array items: type: string const: urn:ietf:params:scim:api:messages:2.0:Error status: type: string detail: type: string scimType: type: string required: - schemas - status - detail additionalProperties: false '404': description: No such group in this organization. content: application/scim+json: schema: type: object properties: schemas: type: array items: type: string const: urn:ietf:params:scim:api:messages:2.0:Error status: type: string detail: type: string scimType: type: string required: - schemas - status - detail additionalProperties: false security: - scim_bearer: [] components: securitySchemes: project_api_key: type: apiKey in: header name: X-Auth-Token description: >- Project API key for sending traces and accessing project-scoped resources. Format: sk-lw-... (no underscore). Obtain one by creating a project via the Admin API or the LangWatch UI. scim_bearer: type: http scheme: bearer description: >- SCIM token for one organization's directory connection, created with POST /api/scim-tokens or in Settings > SCIM. It authenticates provisioning calls only, and stops working if the organization's Enterprise plan lapses. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.