ICAP protects selected updates and removals with optimistic concurrency. Read the resource's version, then send that exact raw numeric value in If-Match when you change it.
PATCH /icap/v1/tenant/<tenantId>/identity/<identityId>
Content-Type: application/json
If-Match: 3
Authorization: Bearer <access-token>
[
{ "op": "replace", "path": "/status", "value": "inactive" }
]
If-Match is a decimal ICAP version token, not an HTTP entity tag. Send If-Match: 3, not If-Match: "3" or If-Match: W/"3".
Client algorithm
-
Get the current resource, or keep the version returned by a successful create/update.
-
Apply the JSON Patch operation array with that version in
If-Match. -
On success, replace the local copy with the response and retain its new version.
-
On a conflict, get the current resource, reconcile the intended change, and submit a new request only if appropriate.
A successful PATCH increments the version.
Guarded deletes and purges return 204 No Content and do not provide a next version.
Operations that require If-Match
The guarded public operations are PATCH and remove operations for access units, card credentials, card types, extension field definitions, identities, PACS records, PIN credentials, roles, tenants, visitors, and visits. Identity and visitor purge operations also require it. Updating tenant features requires the tenant's current version—read the tenant before sending that request.
Visitor-participant state changes and role-assignment removals are not part of this versioned HTTP contract.
Conflict responses
|
Status |
Meaning |
Recovery |
|---|---|---|
|
|
The supplied version is stale. |
Re-read, reconcile, then retry only if the change is still valid. |
|
|
A competing change or documented business conflict prevented completion. |
Re-read and resolve the conflict; do not automatically overwrite. |
|
|
|
Send the current raw numeric version. |
See errors and retry behavior for the general response model.