Bad request 400 error on http workflow step

aleksander_jachowicz · September 10, 2026, 10:48am

I’m trying to get the simplest http step working in my workflow.

And the HTTP step is configured as following:

"HTTP Request": {
                "actionId": "sp:http",
                "attributes": {
                    "method": "get",
                    "param_authenticationRef": "oauth",
                    "param_oauth": {
                        "mapping": {
                            "auth_client_id": "clientId",
                            "auth_client_secret": "clientSecret",
                            "auth_credential_location": "credentialLocation",
                            "auth_token_url": "tokenURL"
                        },
                        "paramID": "zzz",
                        "paramType": "1.4",
                        "refID": "4afeff58-9ffc-49c7-aac9-9cdc8114dd30"
                    },
                    "url": "https://zzzz.api.identitynow.com/identities/v1/{{$.trigger.identity.id}}"
                },
                "displayName": "",
                "nextStep": "End Step - Success",
                "type": "action",
                "versionNumber": 3
            }

The ClientID and secret is from Personal Access Token that I created (I am an admin).

I use exact same ClientID and secret in postman and I when invoking endpoint “identities/v1/” I get correct result.

But when running workflow test, I get an error:

task failed: activity error (type: sp:external:http:v3, scheduledEventID: 7, startedEventID: 8, identity: 1@sp-workflow-worker-stg-eucentral1-idn-stg01-euc1-66c569484rmrzh@sp-workflow-engine): request failed (type: HTTP Response Returned a Client Error, retryable: false): request failed: 400 - 400 Bad Request - {"error_description":"Authentication failed","error":"invalid_request"} (type: WorkflowFailure, retryable: false): task failed: activity error (type: sp:external:http:v3, scheduledEventID: 7, startedEventID: 8, identity: 1@sp-workflow-worker-stg-eucentral1-idn-stg01-euc1-66c569484rmrzh@sp-workflow-engine): request failed (type: HTTP Response Returned a Client Error, retryable: false): request failed: 400 - 400 Bad Request - {"error_description":"Authentication failed","error":"invalid_request"}
Input json is invalid.

Just for testing I changed the clientID to wrong one and then I get 401 error “Invalid client” same when providing wrong client secret.

My parameter config:

Like I said: The exact same setup works fine in Postman.

Any ideas or suggestions what I should try welcome.

Pratyush27 · September 10, 2026, 11:08am

Could you check the token url in the workflow?
It should be exactly https://zzz.api.identitynow.com/oauth/token , minus any query string that may be added if you were converting from postman.

You should also check the header fields as a misconfiguration there can produce this error. Check your workflow headers against the headers tab in postman

JackSparrow · September 10, 2026, 11:11am

Hello @aleksander_jachowicz ,

Are these creds used in any other workflows? If yes, then it will eliminate the Authentication failed error. If not, test the creds by creating a new workflow.

Once you confirm that it’s not the creds issue, pass the identity id directly in the URL and check.

aleksander_jachowicz · September 10, 2026, 11:19am

No, these credentials are not working in any other workflow. They do work in postman. This workflow is exactly my test workflow where I’m trying to figure out the issue.

I tried manipulating the service url but it doesn’t make any difference (can even be fake) and when looking at execution I can see it being filled out correctly)

aleksander_jachowicz · September 10, 2026, 11:21am

Not sure I understand. The token url is part of my parameter configuration not in workflow. as can be seen on the screenshot. Is that what you ment?

Pratyush27 · September 10, 2026, 11:22am

Hey @aleksander_jachowicz
Beyond the above suggestions, I recreated your workflow (cron trigger for easier testing) and this config seems to work for me:

  "HTTP Request": {
        "actionId": "sp:http",
        "attributes": {
          "method": "get",
          "param_authenticationRef": "oauth",
          "param_oauth": {
            "mapping": {
              "auth_client_id": "clientId",
              "auth_client_secret": "clientSecret",
              "auth_credential_location": "credentialLocation",
              "auth_token_url": "tokenURL"
            },
            "paramID": "<your-param-id>",
            "paramType": "1.4",
            "refID": "<your-oauth-parameter-ref-id>"
          },
          "param_oauth_scopes": {
            "mapping": {
              "auth_scopes": "scopes"
            },
            "paramID": "",
            "paramType": "3.1"
          },
          "requestContentType": null,
          "url": "https://<tenant>.api.identitynow.com/identities/v1/<identity-id>"
        },
        "description": "",
        "displayName": "",
        "nextStep": "End Step - Success",
        "type": "action",
        "versionNumber": 3
      }
    }
  }```

aleksander_jachowicz · September 10, 2026, 11:23am

@Pratyush27 great thanks. This says something. It could be our environment issue. I will try to check with Sailpoint.

kannan_sb85 · September 10, 2026, 11:26am

{
  "HTTP Request": {
    "actionId": "sp:http",
    "attributes": {
      "method": "GET",
      "param_authenticationRef": "oauth",
      "param_oauth": {
        "mapping": {
          "auth_client_id": "clientId",
          "auth_client_secret": "clientSecret",
          "auth_credential_location": "credentialLocation",
          "auth_token_url": "tokenURL"
        },
        "paramID": "1",
        "paramType": "1.4",
        "refID": "REPLACE_WITH_REAL_OAUTH_PARAM_REF_ID"
      },
      "requestContentType": "application/json",
      "url": "https://<tenant>.api.identitynow.com/v3/identities/<identity-id>"
    },
    "description": "",
    "displayName": "HTTP Request",
    "nextStep": "End Step - Success",
    "type": "action",
    "versionNumber": 3
  },
  "End Step - Success": {
    "type": "success"
  }
}

Pratyush27 · September 10, 2026, 11:34am

Can I get you to check the credentials?
Admin > Global > Parameter storage

Take a look at the token url of your authentication parameter.

aleksander_jachowicz · September 10, 2026, 11:52am

Looks correct, so I modified it to point to :https://.api.identitynow.com/oauth/tokenz and I got

“task failed: activity error (type: sp:external:http:v3, scheduledEventID: 7, startedEventID: 8, identity: 1@sp-workflow-worker-stg-eucentral1-idn-stg01-euc1-66c569484rmrzh@sp-workflow-engine): request failed (type: HTTP Response Returned a Client Error, retryable: false): request failed: 401 - 401 Unauthorized - {“error”:“unauthorized”,“error_description”:“Full authentication is required to access this resource”} (type: WorkflowFailure, retryable: false): task failed: activity error (type: sp:external:http:v3, scheduledEventID: 7, startedEventID: 8, identity: 1@sp-workflow-worker-stg-eucentral1-idn-stg01-euc1-66c569484rmrzh@sp-workflow-engine): request failed (type: HTTP Response Returned a Client Error, retryable: false): request failed: 401 - 401 Unauthorized - {“error”:“unauthorized”,“error_description”:“Full authentication is required to access this resource”}”

Which suggests that the original value was correct.

JackSparrow · September 10, 2026, 12:17pm

Last suggestion from me. Can you try passing {{$.trigger.identity.id}} in path parameters rather than in URL?

aleksander_jachowicz · September 10, 2026, 12:33pm

Yes, just for validation I did that https://.api.identitynow.com/identities/v1/0075396e70404126bdee57590xxxxxxx

and as expected that didn’t change anything.

Moreover, I tried the same setup on different tenant and it worked no issue.

Must be a SailPoint tenant problem.

chaithu979 · September 11, 2026, 3:11am

Who is the owner of the workflow can you change the owner of the workflow and give a try?

aleksander_jachowicz · September 11, 2026, 6:47am

I tried that but it changes nothing same error. We have reported this to support. Will update this thread with any findings there for future reference.

punna0001 · September 11, 2026, 6:47am

Hello Aleksander. Since the PAT works in Postman, a literal identity ID makes no difference, and the same setup works in another tenant, I would not focus on the identity URL for now. The issue seems more likely to be with the OAuth token request.

The response codes point that way too. Wrong credentials return 401 invalid_client, while your real ones return 400 invalid_request, which suggests the request is getting further with the actual credentials and failing during the token request rather than at the identity endpoint.

One thing you could try is creating a new OAuth 2.0 Client Credentials Grant parameter with the same token URL, client ID, and secret, but set Credential Location = Body instead of Header. Then use that new parameter in the HTTP Request action and test again.

SailPoint supports both Header and Body, and its authentication documentation shows the client credentials being sent in the request body, so I think this is worth trying.

If Body works, that may help narrow the issue to the current parameter/Header setup. You could then switch the new parameter back to Header and test once more if you want to confirm it.

If Body still gives the same 400 invalid_request / Authentication failed, I would suggest opening a SailPoint Support case.

I would leave the identity URL as it is for now, since /identities/v1/{id} is valid.

Topic		Replies	Views
Token Missing in the HTTP Request SHF Discussion and Questions workflows , identity-security-cloud	15	842	March 30, 2024
Previously working workflow giving HTTP 401 SHF Discussion and Questions workflows , identity-security-cloud	3	604	February 27, 2024
Workflow HTTP Operation 401 JWT Required SHF Discussion and Questions workflows , identity-security-cloud	22	1806	July 12, 2024
Workflow HTTP Request Not Creating Campaign SHF Discussion and Questions workflows , identity-security-cloud	13	693	June 19, 2024
Unable to make a call internally to IDN from workflow SHF Discussion and Questions workflows , identity-security-cloud	8	187	July 9, 2025

Bad request 400 error on http workflow step

Related topics