})

		It("requires the scim.write scope", func() {
			token = fakeUAAServer.ClientTokenFor("admin", []string{"scim.banana"}, []string{"scim"})
			_, err := service.Update(user, token)
			Expect(err).To(BeAssignableToTypeOf(warrant.UnauthorizedError{}))
		})

		It("requires the scim audience", func() {
			token = fakeUAAServer.ClientTokenFor("admin", []string{"scim.write"}, []string{"banana"})
			_, err := service.Update(user, token)
			Expect(err).To(BeAssignableToTypeOf(warrant.UnauthorizedError{}))
		})

		It("must match the 'If-Match' header value", func() {
			user.Version = 24
			_, err := service.Update(user, token)
			Expect(err).To(BeAssignableToTypeOf(warrant.BadRequestError{}))
			Expect(err).To(MatchError(`bad request: {"message":"Missing If-Match for PUT","error":"scim"}`))
		})

		It("returns an error if the user does not exist", func() {
			user.ID = "non-existant-guid"
			_, err := service.Update(user, token)
			Expect(err).To(BeAssignableToTypeOf(warrant.NotFoundError{}))
		})

		Context("failure cases", func() {
			It("returns an error when the json response is malformed", func() {
				malformedJSONServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
					w.Write([]byte("this is not JSON"))