# API Patch Role - Semantically Invalid

**URL:** <https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278>\
**Category:** SHF Discussion and Questions\
**Tags:** roles, sailpoint-identity-security, apis\
**Created:** [April 11, 2025, 5:52am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278 "2025-04-11T05:52:22Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 11, 2025, 5:52am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/1 "2025-04-11T05:52:22Z")

</div>

Hi all,

Trying to add users to a role via: [patch-role | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/v2025/patch-role)

The body I am using is:

```auto
[
  {
    "op": "add",
    "path": "/membership",
    "value": "443214bb99a04aa3b7b4b2710973591c"
  }
]

```

Have also tried:

`"path": "/membership/aliasList/-",`  
&

```auto
[
  {
    "op": "add",
    "path": "/membership/aliasList/-",
    "value": {
        "id" : "443214bb99a04aa3b7b4b2710973591c"
    }
  }
]

```

Every attempt I am, getting the same 400 bad request:

“localeOrigin”: “REQUEST”,  
“text”: “The request was syntactically correct but its content is semantically invalid.”,  
“locale”: “en-US”

Does anybody have an idea as to what I’m getting wrong 👀 ?

Cheers

---

<div class="post-metadata">

**Author:** ![sauvee](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sauvee/32/23601_2.png) [@sauvee](https://developer.sailpoint.com/discuss/u/sauvee)\
**Post date:** [April 11, 2025, 6:45am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/2 "2025-04-11T06:45:33Z")

</div>

Can you share the json of the role?

Have you tried doing a “replace” instead of an “add”?

---

<div class="post-metadata">

**Author:** ![vijayasaikoppineni](https://avatars.discourse-cdn.com/v4/letter/v/c5a1d2/32.png) [@vijayasaikoppineni](https://developer.sailpoint.com/discuss/u/vijayasaikoppineni)\
**Post date:** [April 11, 2025, 7:24am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/3 "2025-04-11T07:24:02Z")

</div>

Hello @SeanK-W

Could you please try the following cURL and let me know if it works as expected?

```auto
curl --location --request PATCH 'https://sailpoint.api.identitynow.com/beta/roles/2c91808a7813090a017814121e121518' \
--header 'Content-Type: application/json-patch+json' \
--header 'Accept: application/json' \
--data-raw '[
  {
    "op": "add",
    "path": "/membership",
    "value": "New description"
  }
]'

```

Thank you

---

<div class="post-metadata">

**Author:** ![officialamitguptaa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/officialamitguptaa/32/6624_2.png) [@officialamitguptaa](https://developer.sailpoint.com/discuss/u/officialamitguptaa)\
**Post date:** [April 11, 2025, 8:19am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/4 "2025-04-11T08:19:37Z")

</div>

@SeanK-W -

Use the request payload in the below format -

```auto
[
  {
    "op": "replace",
    "path": "/membership",
    "value": {
      "type": "IDENTITY_LIST",
      "identities": [
        {
          "id": "7afb1775939c47d6a760d885b028aa44",
		  "type": "IDENTITY"
        }
      ]
    }
  }
]

```

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/1/f/1f22397215c953ef586932f2340949d6da69a89c.png)

Mark it as solved, If this helps.

---

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 13, 2025, 9:52pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/5 "2025-04-13T21:52:00Z")

</div>

Hi Amit,

Thank you for the idea, I’ve tried this code and did successfully get a 200 response; however, this didn’t actually add the user to the role so unfortunately didn’t achieve what I am trying to do.

Ideally trying to have a API call that I can add and/or remove people from roles.

Please let me know if you have any other ideas 🙂

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/0/c/0cc28d2f87e48f3ed1e7d047137ac841c7cfeda9.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/2/e/2edbda29086dedb226b82338ec936718f45f393d.png)

---

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 13, 2025, 9:56pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/6 "2025-04-13T21:56:26Z")

</div>

Also odd that when I now run a call to get the role, it seems the Identity is there but the object looks empty. Nothing in the UI to imply the user has the role either? Maybe I need to wait a while for it to update or something?

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/8/b/8ba1a0d548222a7ed73e2a1cae7164f330d86cd4.png)

---

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 13, 2025, 9:58pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/7 "2025-04-13T21:58:35Z")

</div>

Hi Edwin,

I’ve tried the replace method for this user ID (with results posted as replies to Amit in this thread) - getting odd results.

Here is the JSON for the role:

```auto
{
    "id": "14c0dd4132bd44d5af2b8dde4609b7a5",
    "name": "Manual - Block IT Access and Authentication",
    "created": "2025-04-11T05:17:02.523649Z",
    "modified": "2025-04-13T21:49:12.154459Z",
    "description": "Users added to this will be given access to groups in AD and AAD. Conditional policies are applied to these groups to block access and authentication",
    "owner": {
        "type": "IDENTITY",
        "id": "7eae9659b2a74564b1408a3feb7284f2",
        "name": "Sean Kriegerwill"
    },
    "entitlements": [],
    "accessProfiles": [],
    "membership": {
        "type": "IDENTITY_LIST",
        "criteria": null,
        "identities": [
            {
                "type": "IDENTITY",
                "id": "7afb1775939c47d6a760d885b028aa44",
                "name": null,
                "aliasName": null
            }
        ]
    },
    "legacyMembershipInfo": null,
    "enabled": true,
    "requestable": false,
    "accessRequestConfig": {
        "commentsRequired": null,
        "denialCommentsRequired": null,
        "approvalSchemes": [],
        "reauthorizationRequired": false
    },
    "revocationRequestConfig": {
        "approvalSchemes": []
    },
    "segments": [],
    "dimensional": false,
    "dimensionRefs": [],
    "accessModelMetadata": {
        "attributes": []
    }
}

```

---

<div class="post-metadata">

**Author:** ![officialamitguptaa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/officialamitguptaa/32/6624_2.png) [@officialamitguptaa](https://developer.sailpoint.com/discuss/u/officialamitguptaa)\
**Post date:** [April 14, 2025, 5:39am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/8 "2025-04-14T05:39:06Z")

</div>

@SeanK-W -

Check this post and let me know if that works as a workaround for you -

> [@Assign a new role to existing identities in bulk](https://developer.sailpoint.com/discuss/t/assign-a-new-role-to-existing-identities-in-bulk/28614):
>
> I have created a new role that is now available in the request center. This role in turn will provide access to privileged AD accounts. These privileged AD accounts already are assigned to many old identities but of course those identities (a few hundred) do not have the new role. What is the recommended way to assign the new role to those old existing accounts in bulk?

Thank you!

---

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 14, 2025, 11:42pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/9 "2025-04-14T23:42:42Z")

</div>

Using the replace syntax did work in the end, the UI took quite long time to reflect the change… _Which is a real shame because it delays access management._

```auto
[
  {
    "op": "replace",
    "path": "/membership",
    "value": {
      "type": "IDENTITY_LIST",
      "identities": [
        {
          "id": "7afb1775939c47d6a760d885b028aa44",
		  "type": "IDENTITY"
        }
      ]
    }
  }
]

```

However, the replace operation isn’t quite what I’m after, I’m trying to remove or add people to the list.

Even when I change the ‘replace’ op to ‘add’, it still seems to replace the identities… Any ideas on how to do an add or remove rather than a full replace?

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/5/8/58e5dc5817e5984bd77b8c1f0488cf4de62affc8.png)

---

<div class="post-metadata">

**Author:** ![tyler\_mairose](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tyler_mairose/32/30112_2.png) [@tyler\_mairose](https://developer.sailpoint.com/discuss/u/tyler_mairose)\
**Post date:** [April 15, 2025, 4:08am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/10 "2025-04-15T04:08:26Z")

</div>

Hey @SeanK-W,

You should be able to do the patch on the identities field like so.

```json

 [
   {
     "op": "add",
     "path": "/membership/identities/-",
     "value": {
                 "type": "IDENTITY",
                 "id": "d4d367cda6774571ad4183b83028f52f",
                 "name": "Adam.Kennedy",
                 "aliasName": "Adam.Kennedy"
             }
   }
 ]

```

---

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 15, 2025, 4:56am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/11 "2025-04-15T04:56:52Z")

</div>

Thanks Tyler, this is exactly what I was after. Looks like I needed to update my path and add an additional curly bracket inside of the value to get a 200 response.

Thank you!

---

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 15, 2025, 5:04am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/12 "2025-04-15T05:04:03Z")

</div>

Although, when I try a “remove” operation I get the 400 response again ☹

Does the remove body need to be different in some way?

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/4/6/46499bcce89235dd8d8c05fdb38e2305c0879c9d.png)

Also it seems to allow duplicates being added which is odd, I would’ve thought it reject this if the data already exists:

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/0/e/0ecb08d41a56524e2960e62eff4647a601e4eabb.png)

---

<div class="post-metadata">

**Author:** ![tyler\_mairose](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tyler_mairose/32/30112_2.png) [@tyler\_mairose](https://developer.sailpoint.com/discuss/u/tyler_mairose)\
**Post date:** [April 15, 2025, 8:08pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/13 "2025-04-15T20:08:10Z")

</div>

The duplicates should not be allowed. I will raise a ticket with the team to dig into that further.

To remove you must know the index at which the identity you want to remove is at. For example, if you wanted to remove the first identity in the list, you could use the patch structure below.

```json
[
   {
     "op": "remove",
     "path": "/membership/identities/0"
   }
 ]

```

---

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 16, 2025, 3:02am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/14 "2025-04-16T03:02:40Z")

</div>

Hi Tyler,

Thank you for this, I can confirm this has worked and successfully removed the user.

Do you know if the pathing is limited via hardcoding to the position of the identity in the list? For example, say if I have 50 users and would like to remove an identity. Would I need to identify the position they appear against the role? EG: /membership/identities/23

Additionally, I have noticed that when we add users to the list using ID, when I get info about the role, they appear in the response but not in the UI?

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/e/5/e59003662b57b946d8da6f56486e256c904170c6.png)

---

<div class="post-metadata">

**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\
**Post date:** [April 16, 2025, 4:52am UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/15 "2025-04-16T04:52:23Z")

</div>

With that, how do you avoid race condition during the period between knowing the index position, and committing the patch request?

---

<div class="post-metadata">

**Author:** ![SeanK-W](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/seank-w/32/24245_2.png) [@SeanK-W](https://developer.sailpoint.com/discuss/u/SeanK-W)\
**Post date:** [April 28, 2025, 10:28pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/16 "2025-04-28T22:28:02Z")

</div>

Apologies Terry I’m not quite sure what you mean.

I’m trying to remove a user from the list based on their Identity ID rather than their position on the list itself.

---

<div class="post-metadata">

**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\
**Post date:** [April 29, 2025, 1:52pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/17 "2025-04-29T13:52:59Z")

</div>

Let’s say you have 4 people / identities (below) who is a member of a particular role.

[z, x, c, v]

You want to remove c from the list, so that’s index 2.

However, in the time between you getting the list and the time you submit a request to remove index item 2, member “z” is revoked from the role due to say, offboarding, immediate termination, role request expiry date reached…etc.

So the list is now:

[x, c, v]

But your request of move index item 2 just reached ISC…so it removed “v”.

How do you avoid this situation?

---

<div class="post-metadata">

**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\
**Post date:** [April 29, 2025, 2:49pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/18 "2025-04-29T14:49:25Z")

</div>

Not the same API, but when I remove users from arrays like this using PATCH operations against the CyberArk SCIM API I’ve been able to do something like

```JSON
{
   "op": "remove",
   "path": "/membership/identities[id eq \"${id}\"]",
}

```

where you replace ${id} with the identity Id

---

<div class="post-metadata">

**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\
**Post date:** [April 29, 2025, 2:57pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/19 "2025-04-29T14:57:06Z")

</div>

Maybe I’m just uninformed, but when I look at this use case, I wonder why access requests aren’t being used to fulfill this? Isn’t that essentially what we’re doing?

---

<div class="post-metadata">

**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\
**Post date:** [April 29, 2025, 4:53pm UTC](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278/20 "2025-04-29T16:53:03Z")

</div>

Potentially to bypass access request approvals if the role membership is being system-managed in this instance / use case, while still maintaining the approval scheme if the request was submitted via access request interactively.

[Next page](https://developer.sailpoint.com/discuss/t/api-patch-role-semantically-invalid/110278.md?page=2)