flowable/flowable-engine · error · FlowableIllegalArgumentException

Illegal action: '${request.getAction()}'.

Error message

Illegal action: '${request.getAction()}'.

What it means

bulkDeleteCaseInstances only accepts the action values 'delete' and 'terminate'. Any other action string in the request body causes FlowableIllegalArgumentException("Illegal action: '...'."). It is a whitelist check on the action field of BulkDeleteInstancesRestActionRequest.

Source

Thrown at modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/caze/CaseInstanceCollectionResource.java:465

    @ApiResponses(value = {
            @ApiResponse(code = 204, message = "Indicates the bulk of case instances was found and deleted. Response body is left empty intentionally."),
            @ApiResponse(code = 404, message = "Indicates at least one requested case instance was not found.")
    })
    @PostMapping(value = "/cmmn-runtime/case-instances/delete")
    @ResponseStatus(value = HttpStatus.NO_CONTENT)
    public void bulkDeleteCaseInstances(@RequestBody BulkDeleteInstancesRestActionRequest request) {
        if (BulkDeleteInstancesRestActionRequest.DELETE_ACTION.equals(request.getAction())) {
            if (restApiInterceptor != null) {
                restApiInterceptor.bulkDeleteCaseInstances(request.getInstanceIds());
            }
            runtimeService.bulkDeleteCaseInstances(request.getInstanceIds());
        } else if (BulkDeleteInstancesRestActionRequest.TERMINATE_ACTION.equals(request.getAction())) {
            if (restApiInterceptor != null) {
                restApiInterceptor.bulkTerminateCaseInstances(request.getInstanceIds());
            }
            runtimeService.bulkTerminateCaseInstances(request.getInstanceIds());
        } else {
            throw new FlowableIllegalArgumentException("Illegal action: '" + request.getAction() + "'.");
        }
    }
}

View on GitHub (pinned to d6d39ce1c6)

Solutions

1. Set request.action to exactly "delete" or "terminate".
2. Validate the action client-side against BulkDeleteInstancesRestActionRequest.DELETE_ACTION / TERMINATE_ACTION constants.
3. Catch FlowableIllegalArgumentException and return a 400 with the allowed values.

Example fix

// before
request.setAction("cancel");
// after
request.setAction(BulkDeleteInstancesRestActionRequest.TERMINATE_ACTION); // "terminate"

// Java
String action = request.getAction();
if (!BulkDeleteInstancesRestActionRequest.DELETE_ACTION.equals(action)
    && !BulkDeleteInstancesRestActionRequest.TERMINATE_ACTION.equals(action)) {
    throw new IllegalArgumentException("action must be delete or terminate: " + action);
}

try { restTemplate.postForEntity(url, request, Void.class); }
catch (HttpClientErrorException e) { /* 400: inspect body message for 'Illegal action' */ }

When it happens

Trigger: POST to /cmmn-runtime/case-instances with a BulkDeleteInstancesRestActionRequest whose action is neither 'delete' nor 'terminate' (e.g. 'cancel', 'stop', mixed case, or typo).

Common situations: Client code passing a workflow action name from a different Flowable REST API (e.g. process-instance actions); case-sensitivity mistakes ('Terminate'); copy-paste from custom endpoints.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Invalid action, only 'execute' is supported.
• Invalid action: '${action}'.
• Invalid action, only 'execute' is supported.
• Variable operation is missing for variable: ${variable.getNa
• Variable value is missing for variable: ${variable.getName()

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/99d1cb8797aef55c. Report an issue: GitHub.