apache/pulsar · error · ParameterException

Illegal auth action '${action}'. Possible values: ${Arrays.t

Error message

Illegal auth action '${action}'. Possible values: ${Arrays.toString(AuthAction.values())}

What it means

The pulsar-admin CLI's getAuthActions option parser converts each --actions value to the AuthAction enum via AuthAction.valueOf(). When a value is not an exact enum constant name, JCommander's ParameterException is thrown listing all valid values. This guards the sink/source/publish permission API against typo'd action names.

Source

Thrown at pulsar-client-tools/src/main/java/org/apache/pulsar/admin/cli/CliCommand.java:91

    static MessageId validateMessageIdString(String resetMessageIdStr, int partitionIndex) throws PulsarAdminException {
        String[] messageId = resetMessageIdStr.split(":");
        try {
            com.google.common.base.Preconditions.checkArgument(messageId.length == 2);
            return new MessageIdImpl(Long.parseLong(messageId[0]), Long.parseLong(messageId[1]), partitionIndex);
        } catch (Exception e) {
            throw new PulsarAdminException(
                    "Invalid message id (must be in format: ledgerId:entryId) value " + resetMessageIdStr);
        }
    }

    Set<AuthAction> getAuthActions(List<String> actions) {
        Set<AuthAction> res = new TreeSet<>();
        AuthAction authAction;
        for (String action : actions) {
            try {
                authAction = AuthAction.valueOf(action);
            } catch (IllegalArgumentException exception) {
                throw new ParameterException(String.format("Illegal auth action '%s'. Possible values: %s",
                        action, Arrays.toString(AuthAction.values())));
            }
            res.add(authAction);
        }

        return res;
    }

    <T> void print(List<T> items) {
        for (T item : items) {
            print(item);
        }
    }

    <K, V> void print(Map<K, V> items) {
        for (Map.Entry<K, V> entry : items.entrySet()) {
            print(entry.getKey() + "    " + entry.getValue());
        }

View on GitHub (pinned to 820761864e)

Solutions

1. Use one of the exact AuthAction values listed in the message (e.g. produce, consume, functions), matching case exactly.
2. Pass multiple actions as repeated/whitespace-separated arguments (e.g. --actions produce --actions consume) rather than inventing names.
3. Check AuthAction enum constants in org.apache.pulsar.common.policies.data.AuthAction for the authoritative list on your Pulsar version.

Example fix

// before
pulsar-admin namespaces grant-permission my-namespace --role app1 --actions read
// after
pulsar-admin namespaces grant-permission my-namespace --role app1 --actions consume

Set<String> VALID = Set.of("produce", "consume", "functions");
if (!VALID.contains(action)) {
    throw new IllegalArgumentException("action must be one of " + VALID + ": got " + action);
}

try {
    admin.namespaces().grantPermission(ns, role, EnumSet.of(AuthAction.valueOf(action)));
} catch (IllegalArgumentException e) {
    System.err.println("Invalid auth action '" + action + "'; valid: " + Arrays.toString(AuthAction.values()));
}

When it happens

Trigger: Running commands like 'pulsar-admin namespaces grant-permission' or 'permissions grant' with --actions containing a string that is not exactly one of produce, consume, or functions (case-sensitive).

Common situations: Typing lowercase/pluralized variants ('read', 'write', 'admin'), copying actions from other systems (Kafka ACLs), or forgetting that enum names are case-sensitive and comma-separated values must be valid individually.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Invalid key value pair '${property}', valid format like 'a=b
• ${paramName} cannot be bigger than <${maxValue}>!
• ${paramName} cannot be less than or equal to <0>!
• The value of ${paramName} can't be empty
• ${name} cannot be less than <${min}>!

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/5e810cb534879160. Report an issue: GitHub.