{
  "slug": "scim-group-patch-supports-member-value-filter-paths-5a1fbc9067ac",
  "title": "SCIM Group PATCH supports member value filter paths",
  "tools": [
    "vault"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-15T16:17:18.000Z",
  "announced_at": "2026-10-15T16:17:18.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When removing a member from an existing SCIM Group, set the PATCH operation’s `path` to `members[value eq \"<user-id>\"]`.",
    "gotchas": [
      "Version: v2.2.0",
      "Operations[].path: On a remove operation, use `members[value eq \"<user-id>\"]` to target the member. The Vault API docs do not specify this path form; it is stated in the v2.2.0 release note.",
      "Prerequisite: SCIM requires Vault Enterprise and activation of the SCIM feature flag. Authenticate with a Vault token whose entity matches the SCIM client’s `access_grant_principal`; the client also needs ACL permission for the SCIM Groups endpoint.",
      "The path form is supported on remove operations."
    ]
  },
  "why_it_matters": "Remove a SCIM Group member using a value-filter path.",
  "sources": [
    "https://github.com/hashicorp/vault/releases/tag/v2.2.0",
    "https://developer.hashicorp.com/vault/docs/enterprise/scim-overview"
  ],
  "rank": 0.92027,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "daily-20261017-12",
    "verdict_id": "daily-20261017-12:daily-20261017-12-245745929d04b269-20:gate",
    "evidence_hash": "0c842dd2ba535a0663151031c84c99a685ec605a9f729a4f7baed5a041e491d5"
  },
  "review": {
    "draft_hash": "71984a4ab2138a0a839216aafa09b2a022c8a3fcc036dc0ff66c619af2011382",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-15T16:17:18.000Z",
    "decision": "daily-20261017-12:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.92 >= 0.9; 2 needed) and Jev gave 0.65 (>= 0.6 needed)."
  }
}