What each tab does
- User and Group fill in a request body that follows RFC 7643, check it, and give you a curl command. Empty fields are left out. The enterprise extension and its schema URN are added only when you fill an enterprise field.
- PATCH builds a PatchOp body from rows. A value that is valid JSON (
false, {"a":1}, ["x"]) is sent as JSON; anything else is sent as a string. Leave the path empty to add or replace several attributes in one object.
- Filter parses an RFC 7644 filter, explains it in words, shows the URL-encoded query string, and tests it against a sample resource.
- Validate checks any pasted User, Group or PATCH body.
Filter syntax
Operators: eq ne co sw ew gt ge lt le compare, pr tests that a value is present. Combine with and, or and not ( ... ). Strings are quoted with double quotes. emails[type eq "work"] filters inside a multi-valued attribute. An extension attribute is written with its URN: urn:...:enterprise:2.0:User:department.
String comparison here ignores case, which matches the default for most attributes. A server decides this per attribute (caseExact).
Things servers disagree on
- Microsoft Entra ID sends
Add, Replace and Remove with capital letters, and booleans as strings in some cases. Many servers accept this, the RFC says op values are case-insensitive.
- Some servers do not support filters on every attribute, or limit
count.
- Group membership changes are best sent as
add or remove on members. A replace swaps the whole membership.
The curl commands read the token from an environment variable so no secret is written into the command.