---
title: "PUT | Update LDAP group sync by [id]"
slug: "api-v2-put-update-ldap-group-sync"
updated: 2026-11-03T14:57:57Z
published: 2026-11-03T14:57:57Z
canonical: "docs.senhasegura.io/api-v2-put-update-ldap-group-sync"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# PUT | Update LDAP group sync by [id]

## Description

Replace every setting of an LDAP group synchronization in the Segura™ platform. The request carries the complete resource: any optional field you omit returns to its default value. To change a few fields and leave the rest untouched, access [PATCH | Partially update LDAP group sync by [id]](/v4-2/docs/api-v2-patch-update-ldap-group-sync).

---

## Prerequisites

- An application with the **Users** authorization granted by the administrator in A2A, and its resource permission set to **Read and write**. For more information, access [How to manage authorizations in A2A](/v4-2/docs/how-to-manage-authorizations-in-a2a).
- A valid OAuth 2.0 access token. For more information, access [How to authenticate an application in A2A](/v4-2/docs/how-to-authenticate-an-application-in-a2a).
- The current `ETag` of the synchronization, returned by [GET | List an LDAP group sync by [id]](/v4-2/docs/api-v2-get-list-an-ldap-group-sync).

---

## Request

`PUT` `/api/v2/iam/ldap-group-syncs/[id]`

### Path parameters

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | int | Yes | Unique identification code of the synchronization. |

### Headers

| Header | Required | Description |
| --- | --- | --- |
| `Content-Type` | Yes | Must be `application/json`. |
| `If-Match` | Yes | The `ETag` of the synchronization as it was last read. The platform rejects the request when the stored version differs. |

### Request body

The body carries the same objects and fields as [POST | Create LDAP group sync](/v4-2/docs/api-v2-post-create-ldap-group-sync). Every required field must be present.

Sending a read-only field returns `422 patch.field.not.allowed`. The read-only fields are `id`, `active`, `last_sync_at`, `last_sync_succeeded`, `created_at`, `updated_at`, and `tenant_code`. To change the active state, access [POST | Activate LDAP group sync](/v4-2/docs/api-v2-post-activate-ldap-group-sync) or [POST | Deactivate LDAP group sync](/v4-2/docs/api-v2-post-deactivate-ldap-group-sync).

### Example request `PUT` `{{url}}/api/v2/iam/ldap-group-syncs/501`

#### Body

```
{
    "group_sync": {
        "name": "Infrastructure operators",
        "server_id": 10,
        "user_group_id": 7,
        "synchronization_enabled": true,
        "overwrite_user_accesses": true,
        "force_roles": true,
        "automatic_sync": true,
        "dn": "OU=Operators,DC=example,DC=com",
        "ad_username_attribute": "sAMAccountName",
        "ad_name_attribute": "displayname",
        "ad_query": "(&(objectClass=group)(cn=ops-*))",
        "role_ids": [1, 3, 8]
    },
    "domum": {
        "enabled": true,
        "type": "full_users",
        "vendor_id": 22
    }
}
```

---

## Response

```
HTTP/1.1 200 OK
ETag: "9f2c71ab04e85d16"
```

The `ETag` header holds the new version of the synchronization. Use this value in the next `If-Match` header.

              Info

              

Changing `role_ids` also changes the `ETag`, even when no other field differs.

### Example response body

The response carries the same canonical model as [GET | List an LDAP group sync by [id]](/v4-2/docs/api-v2-get-list-an-ldap-group-sync).

```
{
    "data": {
        "id": "501",
        "group_sync": {
            "name": "Infrastructure operators",
            "active": true,
            "server": { "id": "10" },
            "user_group": { "id": "7" },
            "synchronization_enabled": true,
            "overwrite_user_accesses": true,
            "force_roles": true,
            "automatic_sync": true,
            "dn": "OU=Operators,DC=example,DC=com",
            "ad_username_attribute": "sAMAccountName",
            "ad_name_attribute": "displayname",
            "department": null,
            "ad_query": "(&(objectClass=group)(cn=ops-*))",
            "roles": [{ "id": 1 }, { "id": 3 }, { "id": 8 }]
        },
        "domum": {
            "enabled": true,
            "type": "full_users",
            "vendor": { "id": 22 }
        }
    },
    "meta": {
        "links": { "self": "/api/v2/iam/ldap-group-syncs/501" },
        "actions": {
            "sync": "/api/v2/iam/ldap-group-syncs/501/sync",
            "deactivate": "/api/v2/iam/ldap-group-syncs/501/deactivate"
        }
    }
}
```

## Response body fields

The response fields match [GET | List an LDAP group sync by [id]](/v4-2/docs/api-v2-get-list-an-ldap-group-sync).

---

## Errors

| HTTP code | Message | Possible cause | Solution |
| --- | --- | --- | --- |
| `400` | `api.request.malformed` | The body is not valid JSON. | Check the JSON syntax and resend the request. |
| `403` | `api.permission.denied` | The application lacks permission for this resource. | Ask the administrator to check the application's **Users** authorization in A2A. |
| `404` | `api.resource.not_found` | No synchronization exists with the identification code sent. | Check the `id` and resend the request. |
| `412` | `api.precondition.failed` | The `If-Match` value does not match the stored version. Another client changed the resource. | Read the resource again, review the change, and resend the request with the new `ETag`. |
| `428` | `api.precondition.required` | The `If-Match` header is missing. | Read the resource, then resend the request with its `ETag` in `If-Match`. |
| `422` | `api.validation.required_field` | A required field is missing or `null`. | Send every required field. A `PUT` replaces the whole resource. |
| `422` | `api.validation.invalid_reference` | `server_id`, `user_group_id`, `department_id`, an entry in `role_ids`, or `domum.vendor_id` does not exist. | Confirm the referenced resources exist before you resend the request. |
| `422` | `api.validation.overwrite.requires_sync_enabled` | `overwrite_user_accesses` is `true` while `synchronization_enabled` is `false`. | Set `synchronization_enabled` to `true`, or set `overwrite_user_accesses` to `false`. |
| `422` | `api.validation.unknown_field` | The body carries a key that is not part of the resource schema. | Remove the key. Check that the body uses the `group_sync` and `domum` objects. |
| `422` | `patch.field.not.allowed` | The body carries a read-only field. | Remove `id`, `active`, `last_sync_at`, `last_sync_succeeded`, `created_at`, `updated_at`, and `tenant_code`. |
| `422` | `api.feature.unavailable` | The `domum` block was sent without the `cote` license module. | Remove the `domum` block, or ask the administrator to license the module. |
| `429` | `rate_limit_exceeded` | The application exceeded its request quota. | Wait for the period in the `Retry-After` header and resend the request. |

### Authentication errors

| Message | Possible cause | Solution |
| --- | --- | --- |
| `Client authentication failed.` | Application authentication failure with the Segura server. | Check the authentication parameters (`Access Token URL`, `Client ID`, and `Client secret`) and request a new access token. |
| `Invalid signature` | Failure in recognizing the client application URL. | Check the URL of the client application and resend the request. |
| `No route matched with those values.` | Missing authorization header in the API request. | Request a new access token. |
| `Request timed out.` | The request exceeded the timeout limit. | Check the connectivity between the source of the request and the Segura server. |