---
title: "PATCH | Partially update LDAP server by [id]"
slug: "api-v2-patch-update-ldap-server"
updated: 2026-11-03T14:57:58Z
published: 2026-11-03T14:57:58Z
canonical: "docs.senhasegura.io/api-v2-patch-update-ldap-server"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# PATCH | Partially update LDAP server by [id]

## Description

Change selected attributes of an LDAP/AD server connection profile in the Segura™ platform. The request follows the JSON Merge Patch format described in RFC 7396: it carries only the fields to change, and every field absent from the body keeps its current value.

To replace the complete configuration in one request, access [PUT | Update LDAP server by [id]](/v4-2/docs/api-v2-put-update-ldap-server).

---

## Prerequisites

- An application with the **Users** authorization granted by the administrator in A2A, and its resource permission set to **Read and write**. For more information, access [How to manage authorizations in A2A](/v4-2/docs/how-to-manage-authorizations-in-a2a).
- A valid OAuth 2.0 access token. For more information, access [How to authenticate an application in A2A](/v4-2/docs/how-to-authenticate-an-application-in-a2a).
- The server's current version, read from the `ETag` header returned by [GET | List an LDAP server by [id]](/v4-2/docs/api-v2-get-list-an-ldap-server).
- The server must be active. Access [POST | Activate LDAP server](/v4-2/docs/api-v2-post-activate-ldap-server) first when it is not.

---

## Request

`PATCH` `/api/v2/iam/ldap-servers/{id}`

### Path parameters

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | integer | Yes | Unique identification code of the LDAP server. **Note:** this value is assigned by Segura™ in [POST \| Create LDAP server](/v4-2/docs/api-v2-post-create-ldap-server). |

### Headers

| Header | Required | Description |
| --- | --- | --- |
| `Content-Type` | Yes | Must be `application/merge-patch+json`. Another value returns `415 Unsupported Media Type`. |
| `If-Match` | Yes | Current version of the server, as returned in the `ETag` header of the latest read. |

              Attention

              

`If-Match` is mandatory. A request without the header returns `428 Precondition Required`, and a request carrying a version that no longer matches returns `412 Precondition Failed`.

### Request body

Every field is optional, and each field sent follows the rules it has in [POST | Create LDAP server](/v4-2/docs/api-v2-post-create-ldap-server): `host`, `port`, `dn_base`, `use_ssl`, `member_is_dn`, `bind_requires_dn`, `account_form`, `order`, `domain_id`, `bind_credential_id`, `network_connector_id`, `account_filter_format`, `use_credential_domain`, `ignore_disabled_expired`, `username_attribute`, `dn_bind`, `group`, `group_dn`, `group_attribute`, `group_scope`, `group_filter`, and `member_attribute`.

Sending `null` in an optional field clears it. `network_connector_id: null`, for example, removes the network connector agent and returns the server to a direct connection.

#### Fields that cannot be changed

| Field | Reason |
| --- | --- |
| `id` | Assigned by Segura™ and permanent. |
| `active` | Changed through [POST \| Activate LDAP server](/v4-2/docs/api-v2-post-activate-ldap-server) and [POST \| Deactivate LDAP server](/v4-2/docs/api-v2-post-deactivate-ldap-server). |
| `account_domain_name` | Derived from the domain referenced in `domain_id`. |
| `account_domain_name_short` | Derived from the domain referenced in `domain_id`. |
| `created_at` | Set by Segura™. |
| `updated_at` | Set by Segura™. |
| `tenant_code` | Set by Segura™. |

Sending any of them returns `422 patch.field.not.allowed`.

---

### Example request

`PATCH` `{{url}}/api/v2/iam/ldap-servers/7`

#### Headers

```
Content-Type: application/merge-patch+json
If-Match: "a3f8c2e1d9b04567"
```

#### Body

```
{
    "port": 636,
    "use_ssl": true
}
```

---

## Response

```
HTTP/1.1 200 OK
ETag: "b7c1e4f2a8d93016"
```

The `ETag` header holds the server's new version. Use it in the `If-Match` header of the next write.

### Example response body

The response carries the complete server, in the same shape as [GET | List an LDAP server by [id]](/v4-2/docs/api-v2-get-list-an-ldap-server), with the changed fields already applied.

```
{
    "data": {
        "id": 7,
        "ldap_server": {
            "host": "ad.example.com",
            "port": 636,
            "dn_base": "CN=Users,DC=example,DC=com",
            "active": true,
            "use_ssl": true,
            "member_is_dn": false,
            "bind_requires_dn": false,
            "account_form": "principal",
            "order": 1,
            "domain": { "id": 5, "name": "EXAMPLE.COM" },
            "bind_credential": {
                "id": 102,
                "username": "svc-ldap@example.com",
                "domain": { "id": 5, "name": "EXAMPLE.COM" }
            },
            "network_connector": null,
            "account_filter_format": null,
            "use_credential_domain": false,
            "ignore_disabled_expired": false,
            "username_attribute": null,
            "dn_bind": null,
            "account_domain_name": "EXAMPLE.COM",
            "account_domain_name_short": "EXAMPLE",
            "group": null,
            "group_dn": null,
            "group_attribute": null,
            "group_scope": null,
            "group_filter": null,
            "member_attribute": null,
            "created_at": "2026-05-08T22:42:34+00:00",
            "updated_at": "2026-05-12T14:11:07+00:00"
        }
    },
    "meta": {
        "links": { "self": "/api/v2/iam/ldap-servers/7" },
        "actions": {
            "test-connection": "/api/v2/iam/ldap-servers/7/test-connection",
            "deactivate": "/api/v2/iam/ldap-servers/7/deactivate"
        }
    }
}
```

---

## Response body fields

The response fields match [GET | List an LDAP server by [id]](/v4-2/docs/api-v2-get-list-an-ldap-server).

| Field | Type | Description |
| --- | --- | --- |
| `data` | object | The updated LDAP server. |
| `data.id` | integer | Unique identification code of the server. |
| `data.ldap_server` | object | Attributes of the server, with every field returned. |
| `meta` | object | Resource metadata. |
| `meta.links.self` | string | Path of the server. |
| `meta.actions` | object | Actions available for the server in its current state. |

              Info

              

From version 4.2.10, the response returns `id` and the `id` of each nested object as strings, for example `"7"`. Request bodies still take these values as integers.

---

## Errors

| HTTP code | Message | Possible cause | Solution |
| --- | --- | --- | --- |
| `400` | `api.request.bad_request` | The request carries an unknown query parameter. | Remove the parameter and resend the request. |
| `401` | `api.auth.unauthorized` | The access token is missing or has expired. | Request a new access token. |
| `404` | `api.resource.not_found` | The server does not exist. | Check the identification code sent in the path. |
| `409` | `api.resource.inactive` | The server is inactive, and an inactive server cannot be changed. | Activate the server with [POST \| Activate LDAP server](/v4-2/docs/api-v2-post-activate-ldap-server), then resend the request. |
| `412` | `api.precondition.failed` | The `If-Match` value does not match the server's current version, which means the server changed after it was read. | Read the server again with [GET \| List an LDAP server by [id]](/v4-2/docs/api-v2-get-list-an-ldap-server), review the changes, and resend the request with the new `ETag`. |
| `415` | `api.request.unsupported_media_type` | The `Content-Type` header is not `application/merge-patch+json`. | Correct the header and resend the request. |
| `422` | `api.validation.invalid_type` | A field received a value of the wrong type. | Check the type expected for the field and resend the request. |
| `422` | `api.validation.order.duplicate` | Another active server already uses this `order` value. | Send a different value, or deactivate the server that holds it. |
| `422` | `api.validation.invalid_reference` | The referenced domain, credential, or network connector does not exist. | Check the identification codes sent in the body. |
| `422` | `api.enum.invalid_value` | `account_form` or `group_scope` received a value outside its allowed list. | Check the allowed values for the field and resend the request. |
| `422` | `patch.field.not.allowed` | The body carries one of the fields that cannot be changed. | Remove the field and resend the request. |
| `428` | `api.precondition.required` | The request arrived without the `If-Match` header. | Read the server, then resend the request with its `ETag` value in `If-Match`. |
| `429` | `api.rate_limit.exceeded` | The request rate limit was exceeded. | Reduce the request rate and try again. |

### Example error response

`422` the body carries a field that cannot be changed:

```
{
    "code": "patch.field.not.allowed",
    "message": "Field 'active' cannot be set via the API.",
    "details": [
        { "field": "active", "code": "patch.field.not.allowed" }
    ]
}
```

For authentication error messages and the `403` versus `404` policy, access [API v2 - Conventions and shared behaviors](/v4-2/docs/api-v2-conventions-and-shared-behaviors).