Table of Contents

API & SCIM Errors

Workspace API and SCIM use different error formats. Check both the HTTP status and the returned body.

Workspace API

Procedure errors are plain text. The dispatcher returns an explicit procedure error status where one is assigned; otherwise it returns 500. The older project and user procedures frequently use 500 for invalid arguments or access denial, so do not automatically retry every 500.

ConditionStatus / action
Unknown procedure404; verify the procedure name.
Invalid input on revokeWorkspaceUserAccess400; correct workspaceId and userId.
Missing, invalid, rotated or revoked key on revokeWorkspaceUserAccess401 when key authentication is reached; replace or correct the key.
Wrong workspace or insufficient revoke authority403; verify the workspace and current admin authority. A disabled target Workspace API can also return 403.
Last-admin revoke409; ensure another administrator remains.
Revoke billing dependency failure503; the removal did not complete. Retry after recovery.
Other procedure validation/authentication failuresGenerally 500 in current code; inspect the plain-text message and fix the cause.
Unexpected failure500; reconcile the outcome before retrying a non-idempotent operation.
HTTP 400

workspaceId must be a non-empty stable identifier

SCIM

SCIM errors use application/scim+json, the Error schema, a string status and a safe detail. Some also include scimType.

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
  ],
  "status": "400",
  "detail": "userName and work email must identify the same source email",
  "scimType": "invalidValue"
}
StatusTypical causeAction
400Malformed JSON, unsupported attribute/path/filter, invalid role, conflicting email aliasesCorrect the mapping or request. Use only supported fields and equivalent userName/work email.
401Missing, invalid, expired or revoked token; SCIM capability disabledConfirm enablement and replace the token as appropriate. The response includes a Bearer challenge.
403Insufficient scope, unapproved initial email domain, inactive workspace or local admin blockCheck setup and contact a workspace admin. SCIM cannot clear a local veto.
404Unknown or foreign-source User IDUse the SCIM ID returned to this provisioning source, not a canonical Workspace API user ID.
405Unsupported method, including terminal DELETEUse active=false for deprovisioning. DELETE changes nothing.
409Duplicate create, conflicting correlation or another managing sourceRead the existing source-owned User and resolve the conflict; do not create another account blindly.
413Request exceeds the 1 MiB body limitReduce request size.
415Unsupported content typeUse application/scim+json or application/json for writes.
503Required billing reconciliation failedProvisioning did not complete. Retry after the dependency recovers.
500Unexpected provisioning failureRetry cautiously and contact Diggle if repeated.

Retry guidance

Use bounded retries with increasing delay for confirmed transient failures. Verify state after a lost response. For SCIM POST, query the source-owned User before creating again; a committed duplicate returns 409. Use the retained SCIM ID for updates. Do not invent new IDs or change email to bypass a conflict.

Do not automatically retry createProject after an ambiguous result. Equivalent user upserts and workspace revocation are designed for repeat calls. A local block or unsupported operation requires a configuration or administrator action, not more retries.

When contacting Diggle, provide the procedure/path, approximate time, HTTP status and a redacted error description. Never include keys, tokens, passwords or authorization headers.

Related articles