SCIM3 PATCH API returning 403 Forbidden in SAP Analytics Cloud (GET works, Admin access available)

Ajay105 — Mon, 23 Mar 2026 05:33:35 GMT

Hi folks,

I am facing an issue while using the SCIM3 API in SAP Analytics Cloud to update team members using PATCH operation.

API Details

Endpoint:

PATCH /api/v1/scim3/Groups/<TEAM_UUID>

Authentication:

Authorization Bearer Token

Headers Used

Authorization: Bearer <access_token>
x-csrf-token: <csrf_token>
x-sap-sac-custom-auth: true

Payload

"schemas": [ "urn:ietf:params:scim:api:messages:2.0:PatchOp" ], "Operations": [ { "op":"add", "path":"members", "value":[ { "value":"d0bbac78-776890-9876hjmd", "type":"User", "display":"newuser", "$ref":"/api/v1/scim3/Users/d0bbac78-776890-9876hjmd" } ] }, { "op": "replace", "path": "urn:ietf:params:scim:schemas:extension:sap:2.0:Group:description", "value": "patch test" } ]

Issue

The PATCH request consistently returns:

{ "status": 403, "error":"Forbidden" }

Observations

GET operations on /api/v1/scim3/Groups are working successfully.
Team UUID is retrieved correctly.
Team type is userGroup.
I have full admin access (BI_Admin role) in SAP Analytics Cloud.
OAuth Client is configured with API access with App Integration.
CSRF Token is fetched and passed correctly.
when CSRF token is removed, the API returns 401 Unauthorized.
PATCH always returns 403 Forbidden.

Questions

Are there additional permissions required specifically for SCIM3 PATCH operations ?
Does the OAuth client require explicit SCIM provisioning(write) permissions?
Are there any tenant-level restrictions for SCIM3 write operations ?

Attachments

PATCH request (headers + payload)

Response (403 Forbidden)

Any guidance would be helpful

Thanks!

Re: SCIM3 PATCH API returning 403 Forbidden in SAP Analyt...

spurwar — Tue, 24 Mar 2026 06:42:08 GMT

Maybe the below blog helps with the error.

https://community.sap.com/t5/technology-blog-posts-by-sap/403-when-trying-to-create-user-with-the-scim-rest-api/ba-p/13517068

Re: SCIM3 PATCH API returning 403 Forbidden in SAP Analyt...

Ajay105 — Wed, 25 Mar 2026 11:14:13 GMT

Hi spurwar,

Thanks a lot for this post!

I was facing the same 403 issue, and this blog explanation about CSRF token + session cookies solved it for me. Really helpful!

Question Re: SCIM3 PATCH API returning 403 Forbidden in SAP Analyt... in Technology Q&A

SCIM3 PATCH API returning 403 Forbidden in SAP Analytics Cloud (GET works, Admin access available)

API Details

Endpoint:

Authentication:

Headers Used

Payload

Issue

Observations

Questions

Attachments

Re: SCIM3 PATCH API returning 403 Forbidden in SAP Analyt...

Re: SCIM3 PATCH API returning 403 Forbidden in SAP Analyt...