{"record":{"id":"99d1cb8797aef55c","repo":"flowable/flowable-engine","slug":"illegal-action-request-getaction-99d1cb","errorCode":null,"errorMessage":"Illegal action: '${request.getAction()}'.","messagePattern":"Illegal action: '(.+?)'\\.","errorType":"validation","errorClass":"FlowableIllegalArgumentException","httpStatus":400,"severity":"error","filePath":"modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/caze/CaseInstanceCollectionResource.java","lineNumber":465,"sourceCode":"    @ApiResponses(value = {\n            @ApiResponse(code = 204, message = \"Indicates the bulk of case instances was found and deleted. Response body is left empty intentionally.\"),\n            @ApiResponse(code = 404, message = \"Indicates at least one requested case instance was not found.\")\n    })\n    @PostMapping(value = \"/cmmn-runtime/case-instances/delete\")\n    @ResponseStatus(value = HttpStatus.NO_CONTENT)\n    public void bulkDeleteCaseInstances(@RequestBody BulkDeleteInstancesRestActionRequest request) {\n        if (BulkDeleteInstancesRestActionRequest.DELETE_ACTION.equals(request.getAction())) {\n            if (restApiInterceptor != null) {\n                restApiInterceptor.bulkDeleteCaseInstances(request.getInstanceIds());\n            }\n            runtimeService.bulkDeleteCaseInstances(request.getInstanceIds());\n        } else if (BulkDeleteInstancesRestActionRequest.TERMINATE_ACTION.equals(request.getAction())) {\n            if (restApiInterceptor != null) {\n                restApiInterceptor.bulkTerminateCaseInstances(request.getInstanceIds());\n            }\n            runtimeService.bulkTerminateCaseInstances(request.getInstanceIds());\n        } else {\n            throw new FlowableIllegalArgumentException(\"Illegal action: '\" + request.getAction() + \"'.\");\n        }\n    }\n}\n","sourceCodeStart":447,"sourceCodeEnd":469,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/caze/CaseInstanceCollectionResource.java#L447-L469","documentation":"bulkDeleteCaseInstances only accepts the action values 'delete' and 'terminate'. Any other action string in the request body causes FlowableIllegalArgumentException(\"Illegal action: '...'.\"). It is a whitelist check on the action field of BulkDeleteInstancesRestActionRequest.","triggerScenarios":"POST to /cmmn-runtime/case-instances with a BulkDeleteInstancesRestActionRequest whose action is neither 'delete' nor 'terminate' (e.g. 'cancel', 'stop', mixed case, or typo).","commonSituations":"Client code passing a workflow action name from a different Flowable REST API (e.g. process-instance actions); case-sensitivity mistakes ('Terminate'); copy-paste from custom endpoints.","solutions":["Set request.action to exactly \"delete\" or \"terminate\".","Validate the action client-side against BulkDeleteInstancesRestActionRequest.DELETE_ACTION / TERMINATE_ACTION constants.","Catch FlowableIllegalArgumentException and return a 400 with the allowed values."],"exampleFix":"// before\nrequest.setAction(\"cancel\");\n// after\nrequest.setAction(BulkDeleteInstancesRestActionRequest.TERMINATE_ACTION); // \"terminate\"","handlingStrategy":"validation","validationCode":"// Java\nString action = request.getAction();\nif (!BulkDeleteInstancesRestActionRequest.DELETE_ACTION.equals(action)\n    && !BulkDeleteInstancesRestActionRequest.TERMINATE_ACTION.equals(action)) {\n    throw new IllegalArgumentException(\"action must be delete or terminate: \" + action);\n}","typeGuard":null,"tryCatchPattern":"try { restTemplate.postForEntity(url, request, Void.class); }\ncatch (HttpClientErrorException e) { /* 400: inspect body message for 'Illegal action' */ }","preventionTips":["Use the DELETE_ACTION/TERMINATE_ACTION constants instead of literals","Restrict UI action dropdowns to delete/terminate","Validate action strings at the client boundary"],"tags":["rest-api","invalid-action","validation","flowable-cmmn"],"backgroundTag":"invalid-enum-value","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}