diff --git a/internal/keycloak/groups.go b/internal/keycloak/groups.go
index 2f52d6b..c82c42b 100644
--- a/internal/keycloak/groups.go
+++ b/internal/keycloak/groups.go
@@ -7,6 +7,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"net/http/httputil"
 	"path"
 
 	"golang.org/x/oauth2/clientcredentials"
@@ -40,11 +41,26 @@ func (c *Client) rawGroups(ctx context.Context) ([]byte, error) {
 	q := req.URL.Query()
 	q.Add("briefRepresentation", "true")
 	req.URL.RawQuery = q.Encode()
+	// debug groups request
+	dump, err := httputil.DumpRequestOut(req, true)
+	if err != nil {
+		c.log.Debug("couldn't dump request", slog.Any("error", err))
+	} else {
+		c.log.Debug("rawGroups", slog.String("request", string(dump)))
+	}
+	// perform request
 	res, err := c.httpClient(ctx).Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("couldn't get groups: %v", err)
 	}
 	defer res.Body.Close()
+	// debug groups response
+	dump, err = httputil.DumpResponse(res, true)
+	if err != nil {
+		c.log.Debug("couldn't dump response", slog.Any("error", err))
+	} else {
+		c.log.Debug("rawGroups", slog.String("response", string(dump)))
+	}
 	if res.StatusCode > 299 {
 		body, _ := io.ReadAll(res.Body)
 		return nil, fmt.Errorf("bad groups response: %d\n%s", res.StatusCode, body)