SCIM3 PATCH API returning 403 Forbidden in SAP Analytics Cloud (GET works, Admin access available)

[#1]

Hi folks,

I am facing an issue while using the SCIM3 API in SAP Analytics Cloud to update team members using PATCH operation.

API Details

Endpoint:

PATCH  /api/v1/scim3/Groups/<TEAM_UUID>

Authentication:

• Authorization Bearer Token

Headers Used

• Authorization: Bearer <access_token>

• x-csrf-token: <csrf_token>

• x-sap-sac-custom-auth: true

Payload

"schemas": [
            "urn:ietf:params:scim:api:messages:2.0:PatchOp"
        ],
        "Operations": [
            {
                "op":"add",
                "path":"members",
                "value":[
                    {
                        "value":"d0bbac78-776890-9876hjmd",
                        "type":"User",
                        "display":"newuser",
                        "$ref":"/api/v1/scim3/Users/d0bbac78-776890-9876hjmd"
                    }
                ]
            },
            {
                "op": "replace",
            "path": "urn:ietf:params:scim:schemas:extension:sap:2.0:Group:description",
            "value": "patch test"
            }
        ]

Issue

The PATCH request consistently returns:

{
"status": 403,
"error":"Forbidden"
}

Observations

• GET operations on /api/v1/scim3/Groups are working successfully.
• Team UUID is retrieved correctly.
• Team type is userGroup.
• I have full admin access (BI_Admin role) in SAP Analytics Cloud.
• OAuth Client is configured with API access with App Integration.
• CSRF Token is fetched and passed correctly.
• when CSRF token is removed, the API returns 401 Unauthorized.
• PATCH always returns 403 Forbidden.

Questions

1. Are there additional permissions required specifically for SCIM3 PATCH operations ?
2. Does the OAuth client require explicit SCIM provisioning(write) permissions?
3. Are there any tenant-level restrictions for SCIM3 write operations ?

Attachments

• PATCH request (headers + payload)

• Response (403 Forbidden)

Any guidance would be helpful

Thanks!

[spurwar · Accepted solution]

Maybe the below blog helps with the error.

https://community.sap.com/t5/technology-blog-posts-by-sap/403-when-trying-to-create-user-with-the-sc... 

[Ajay105 · Accepted solution]

Hi spurwar,

Thanks a lot for this post!

I was facing the same 403 issue, and this blog explanation about CSRF token + session cookies solved it for me. Really helpful!