scim bulk operations failed 429 too many requests

Fix SCIM bulk operations failing with 429 too many requests

TL;DR

429 on SCIM bulk means you are pushing users faster than the provider allows. Slow down: shrink bulk batches, add retry with backoff on 429, and serialize your provisioning workers. The users are not lost; they are just throttled.

The error

POST /scim/v2/Bulk -> 429 Too Many Requests
{"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"detail":"Rate limit exceeded","status":"429"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=scim bulk operations failed 429 too many requests"

Fix it

Step 1: Read the retry hint from the response headers

curl -sI -X POST "https://yourapp.example.com/scim/v2/Bulk" \
  -H "your auth header bearer value]" | grep -i -E "retry-after|ratelimit"

Expected: You get a Retry-After value or rate limit headers telling you how long to wait.

Step 2: Shrink the bulk batch size

Cut your Bulk operations per request in half (for example 100 operations down to 50) and re-run.

Expected: Fewer 429s per cycle; the remaining ones are spaced out.

Step 3: Add backoff on 429 in your client

On 429, sleep for the Retry-After value (or exponential backoff starting at a few seconds) and retry the same batch.

Expected: Retries succeed and every operation eventually commits.

Step 4: Serialize or rate-limit your workers

If multiple workers push concurrently, cap concurrency or put them behind a single rate-limited queue.

Expected: The aggregate request rate stays under the provider limit.

Step 5: Verify the full sync completes

Re-run the sync and count created or updated users against your source list.

Expected: Counts match and no users are stuck in a failed state.

When this applies

• SCIM bulk or provisioning syncs fail with 429
• Large initial syncs or backfills keep getting throttled
• You run multiple provisioning workers in parallel

When it doesn't

• The error is 401 or 403 (auth problem, not rate limiting)
• Single requests 429 (check whether the credential is being throttled specifically)
• The provider documents no rate limits (contact their support with timestamps)

Compatibility

SCIM 2.0 Bulk per RFC 7644 section 3.7. Rate limits are provider-specific.

Variant phrasings

scim rate limit exceeded bulk user import

Same fix. Bulk is the heaviest SCIM call; it trips limits long before single-user calls do.

okta scim provisioning throttled 429

Okta backs off automatically, but a throttled connector slows the whole queue. Reduce the sync scope or batch size.

scim 429 retry-after header

Honor Retry-After when present. Guessing a shorter wait just earns another 429.

Why it happens

SCIM bulk endpoints accept many operations per request, which makes them the fastest way to hit a provider's rate limit. Providers throttle to protect the shared service; 429 is the backpressure signal, not a rejection of your data. Clients that retry immediately or run parallel workers amplify the problem.

Edge cases

• Some providers count each operation inside a bulk request separately against the limit
• 429 responses sometimes carry no Retry-After; use exponential backoff with jitter then
• IdP-driven syncs throttle too; you cannot fix provider-side limits from the IdP alone

If it still fails

• Capture the exact timestamp, the failing username, and the full error from the IdP system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• Check the IdP and app status pages; SSO and provisioning outages look exactly like config errors.
• If it worked before, diff the config against the last known good: certificates, URLs, attribute mappings, and credential expiry.
• Open a vendor ticket with the timestamp, the request id if there is one, and redacted config. Never send secrets or private keys.

Prevention

• Track certificate and credential expiry with alerts, not memory.
• Run a synthetic login per SSO app daily so breakage pages you, not a user.
• Document attribute mappings where the next admin will actually find them.
• Test provisioning with a single user before bulk changes.
• Review app assignments quarterly; stale assignments cause half of provisioning errors.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3lGgstzqsHhUNHquZOxrUw