keycloak · ahus1 · Jul 21, 2026 · Jul 14, 2026 · sguilhen · Jul 15, 2026
@@ -96,7 +96,10 @@ request results in a `400 Bad Request` error. Use the `PATCH` method to manage g
 
 == Partially updating a group
 
-To modify specific group attributes, use a `PATCH` request:
+To modify specific group attributes, use a `PATCH` request.
+
+NOTE: A single PATCH request can contain at most 100 operations. Requests exceeding this limit are rejected with
+a `400 Bad Request` response and `scimType: "tooMany"`.
 
 [source,bash]
 ----

@@ -212,6 +212,9 @@ The `PATCH` method allows you to modify specific attributes without replacing th
 contains one or more operations, each specifying an action (`add`, `replace`, or `remove`), an optional path to
 the attribute, and a value.
 
+NOTE: A single PATCH request can contain at most 100 operations. Requests exceeding this limit are rejected with
+a `400 Bad Request` response and `scimType: "tooMany"`.
+
 === Adding or replacing attributes
 
 [source,bash]

@@ -23,6 +23,13 @@
 
 public abstract class AbstractScimResourceTypeProvider<M extends Model, R extends ResourceTypeRepresentation> implements ScimResourceTypeProvider<R> {
 
+    /**
+     * Maximum number of operations allowed in a single SCIM PATCH request.
+     * Exceeding this limit results in a {@code 400 Bad Request} with {@code scimType=tooMany}.
+     * This limit is not advertised via {@code /ServiceProviderConfig}.
+     */
+    public static final int MAX_PATCH_OPERATIONS = 100;
+
     protected final KeycloakSession session;
     private final ModelSchema<M, R> schema;
     private final List<ModelSchema<M, R>> schemaExtensions;
@@ -107,6 +114,12 @@ public boolean delete(String id) {
     public void patch(R existing, List<PatchOperation> operations) {
         Objects.requireNonNull(existing, "existing cannot be null");
         Objects.requireNonNull(operations, "operations cannot be null");
+
+        if (operations.size() > MAX_PATCH_OPERATIONS) {
+            throw new ScimPatchException(
+                    "PATCH request exceeds maximum allowed number of %d operations".formatted(MAX_PATCH_OPERATIONS));
+        }
+
         M model = getModel(existing.getId());
 
         if (!hasPermission(model, getRealmResourceType(), AdminPermissionsSchema.MANAGE)) {

@@ -0,0 +1,28 @@
+/*
+ * Copyright 2026 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.scim.resource.spi;
+
+/**
+ * Exception thrown when a PATCH request exceeds the maximum allowed number of operations.
+ */
+public class ScimPatchException extends RuntimeException {
+
+    public ScimPatchException(String message) {
+        super(message);
+    }
+}
@@ -16,6 +16,7 @@
 import org.keycloak.scim.filter.ScimFilterException;
 import org.keycloak.scim.protocol.ForbiddenException;
 import org.keycloak.scim.protocol.response.ErrorResponse;
+import org.keycloak.scim.resource.spi.ScimPatchException;
 import org.keycloak.theme.Theme;
 
 import org.jboss.logging.Logger;
@@ -38,6 +39,8 @@ static Response toResponse(KeycloakSession session, Exception e) {
             return errorResponse(Status.CONFLICT, "uniqueness", "A resource with the same unique attribute already exists");
         } else if (e instanceof ScimFilterException) {
             return badRequest("invalidFilter", e.getMessage());
+        } else if (e instanceof ScimPatchException) {
+            return badRequest("tooMany", e.getMessage());
         } else if (e instanceof ForbiddenException) {
             logger.debug("SCIM request denied: caller does not have the required permissions");
             return forbidden();

@@ -57,6 +57,7 @@
 import static org.keycloak.scim.resource.Scim.ENTERPRISE_USER_SCHEMA;
 import static org.keycloak.scim.resource.Scim.USER_RESOURCE_TYPE;
 import static org.keycloak.scim.resource.Scim.getCoreSchema;
+import static org.keycloak.scim.resource.spi.AbstractScimResourceTypeProvider.MAX_PATCH_OPERATIONS;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.greaterThanOrEqualTo;
@@ -65,6 +66,7 @@
 import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 
@@ -773,6 +775,21 @@ public void testPatchRemove() {
         assertEquals("5678", actual.getEnterpriseUser().getCostCenter());
     }
 
+    @Test
+    public void testPatchExceedingMaxOperations() {
+        User expected = client.users().create(createUser());
+        PatchRequest.Builder builder = PatchRequest.create();
+        for (int i = 0; i <= MAX_PATCH_OPERATIONS; i++) {
+            builder.add("displayName", "name-" + i);
+        }
+        ScimClientException ce = assertThrows(ScimClientException.class,
+                () -> client.users().patch(expected.getId(), builder.build()));
+        assertNotNull(ce.getError());
+        assertEquals(Status.BAD_REQUEST.getStatusCode(), ce.getError().getStatusInt());
+        assertEquals("tooMany", ce.getError().getScimType());
+        assertTrue(ce.getError().getDetail().contains("maximum allowed number"));
+    }
+
     @Test
     public void testUserMembership() {
         GroupRepresentation groupA = createGroup("Group A");