## TL;DR
The target app marks some SCIM attributes readOnly, and Okta tried to write one. Read the app's schema, find the readOnly attributes, and remove them from the Okta provisioning mapping.

```text
"SCIM user create failed" mutability attribute not supported
```

## Use this when
- SCIM create fails and the error mentions mutability, readOnly, or an attribute not being supported.
- The default Okta mapping was never customized for this app.
- Create fails but the schema looks right at first glance.

## Not for this skill when
- The error is a 409. That is a duplicate, not mutability.
- A required field is missing. That is the opposite problem: add a mapping.
- The connector cannot authenticate at all. Fix credentials first.

## Steps
1. Fetch the app's SCIM schema for the User resource and list every attribute marked readOnly. Verify: you have the authoritative list.
2. In Okta, open the app's Provisioning settings and then the To App attribute mapping. Verify: you can see each mapped attribute.
3. Unmap or drop each readOnly attribute from the mapping. Common culprits are id, meta, and groups on some apps. Verify: no readOnly attribute remains mapped.
4. Force a single-user push to test. Verify: the create succeeds.
5. Re-enable scheduled provisioning. Verify: the next cycle is clean.

## Variant phrasings
### SCIM 400 mutability
The status-first phrasing.
### "attribute is read only" SCIM
The message-first search.
### Okta mapping readOnly error
The cause-first phrasing.

Compatibility: Okta SCIM 2.0 provisioning, Classic and Okta Identity Engine. ReadOnly sets vary by target app.

## Why it happens
SCIM defines mutability per attribute, and Okta's default mapping is generous: it includes attributes many apps refuse to accept on write. The app rejects the whole create over one readOnly field.

## Edge cases / pitfalls
- Some apps accept an attribute on update but not on create; the mapping may need a create-only exclusion.
- Enterprise schema extensions carry their own mutability flags that the base schema does not show.
- Removing the groups attribute from the mapping can break group push for that app; check before dropping it.
- Apps that document an attribute but reject it anyway: trust the live behavior, not the docs.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1A1rCQeBKGkp1dzswBpUxg