Troubleshooting
You can use logs in the Platform or Okta to diagnose and troubleshoot provisioning issues.
-
In the Platform, review the SCIM Connector logs via Datadog or Azure Storage.
-
In Okta check the provisioning logs for your SAML app integration. On the SAML application's Provisioning tab, select Reports and then System Log.
The following table lists the possible HTTP status codes in the logs and offers a resolution for each error code.
| Code | Status | Meaning | Resolution |
|---|---|---|---|
| 200 | OK |
Request succeeded. Used for GET, PUT, PATCH operations. |
No action required. |
| 201 | Created | Resource created successfully. Used for POST /Users and POST /Groups. |
No action required. Verify the resource in the Platform. |
| 204 | No Content | PATCH operation succeeded with no response body. Valid SCIM response. |
No action required. |
| 400 | Bad Request | Invalid SCIM data, malformed JSON, missing required attributes, invalid filter, or invalid pagination parameters. | Review the request payload in Okta provisioning logs. Verify attribute mappings. Ensure required fields (userName, displayName) are populated. |
| 401 | Unauthorized | Authentication failed. OAuth token expired, revoked, or invalid credentials | Re-authenticate via Provisioning → Integration. Verify service user credentials. Check token endpoint URL. |
| 403 | Forbidden | Service user lacks required permissions on the target resource (container, secret, user). | Verify the SCIM service account has owner-level permissions on required containers. Review the custom role assignment in the Platform. |
| 404 | Not Found | The requested resource does not exist (for example, deleting an already-removed user, updating a non-existent group). | Confirm that the resource still exists in the Platform. If already removed, clear the Okta assignment to stop retry attempts. |
| 409 | Conflict | Duplicate resource. The userName or group displayName already exists in the Platform. |
Use Import to match existing Platform users/groups with Okta profiles before provisioning. Do not create duplicates. |
| 429 | Too Many Requests | Rate limit exceeded on either the Platform or Okta side. | Reduce batch size. Implement exponential backoff. Check Retry-After header. Monitor via Okta Reports → Rate Limits. |
| 500 | Internal Server Error | Unexpected error in the SCIM Cloud Connector or Platform backend. | Review SCIM Cloud Connector logs in Datadog/Azure Storage. Contact Support with the request correlation ID. |
| 501 | Not Implemented | The requested SCIM endpoint or operation is not implemented by the SCIM Cloud Connector. | Verify that the operation is listed in the SCIM Connector supported capabilities. Contact Support if the operation should be supported. |
| 503 | Service Unavailable | Platform backend or Secret Server is unreachable. | Verify Platform or Secret Server availability. Check network connectivity. Wait for service recovery and Okta will retry. |
