I created a workflow (shown below) to remove access upon an identity becoming inactive. I am able to successfully remove the access in a workflow when I do it outside of a loop, but when I try it inside of the loop I get this error:
task failed: activity error (type: sp:access:manage, scheduledEventID: 17, startedEventID: 18, identity: 1@sp-workflow-worker-stg-us-east-1-7bd7d5469f-5lbdg@sp-workflow-engine): request failed (type: Bad Request, retryable: false): 400 - 400 Bad Request: (type: HTTP Response Returned a Client Error, retryable: false): request failed (type: Bad Request, retryable: false): 400 - 400 Bad Request (type: fundamental, retryable: true)
From my debugging I have determined that it is coming from the RemoveAccess action within the loop. When I try to use the RemoveAccess action outside of the loop with the same input (same user ID and same item info from GetAccess), it is successful.
I have seen this same error in a few other threads but Iâm not able to find any explanation or resolution. Any help is appreciated, thank you.
Workflow:
{
"id": "XXXXXXXXXXXXXXXXXXXXXXXXX",
"name": "Remove Subtemplate Upon Becoming Inactive",
"description": "",
"created": "2025-11-04T16:07:26.774088018Z",
"modified": "2025-11-10T15:26:30.824910248Z",
"modifiedBy": {
"type": "IDENTITY",
"id": "XXXXXXXXXXXXXXXXXXXXXXXXX",
"name": "My.Name"
},
"definition": {
"start": "Compare Strings",
"steps": {
"Compare Strings": {
"actionId": "sp:compare-strings",
"choiceList": [
{
"comparator": "StringEquals",
"nextStep": "Get Accounts",
"variableA.$": "$.trigger.newState.name",
"variableB": "inactive"
}
],
"defaultStep": "End Step - Success",
"description": "Verify that new lifecycle state is inactive.",
"displayName": "Verify new state is inactive.",
"type": "choice"
},
"End Step - Success": {
"actionId": "sp:operator-success",
"displayName": "New lifecycle state not inactive.",
"type": "success"
},
"End Step - Success 1": {
"actionId": "sp:operator-success",
"displayName": "Identity does not have an EMP account.",
"type": "success"
},
"End Step - Success 3": {
"actionId": "sp:operator-success",
"displayName": "Identity does not have subtemplates.",
"type": "success"
},
"End Step - Success 4": {
"actionId": "sp:operator-success",
"displayName": "",
"type": "success"
},
"Get Accounts": {
"actionId": "sp:get-accounts",
"attributes": {
"getAccountsBy": "specificIdentity",
"identity.$": "$.trigger.identity.id"
},
"displayName": "",
"nextStep": "Verify Data Type",
"type": "action",
"versionNumber": 1
},
"Loop": {
"actionId": "sp:loop:iterator",
"attributes": {
"context.$": "$.trigger.identity.id",
"input.$": "$.getAccounts.accounts[?(@.sourceId==\"XXXXXXXXXXXXXXXXXXX\")].attributes.LinkedSubtemplateIDs",
"start": "Get Access",
"steps": {
"End Step - Success 2": {
"actionId": "sp:operator-success",
"displayName": "",
"type": "success"
},
"Get Access": {
"actionId": "sp:access:get",
"attributes": {
"accessprofiles": true,
"entitlements": true,
"getAccessBy": "searchQuery",
"query.$": "$.loop.loopInput",
"roles": true
},
"displayName": "",
"nextStep": "Send Email",
"type": "action",
"versionNumber": 1
},
"Manage Access": {
"actionId": "sp:access:manage",
"attributes": {
"comments": "Removing subtemplates upon identity becoming inactive. ",
"removeDuration": null,
"removeIdentity.$": "$.loop.context",
"requestType": "REVOKE_ACCESS",
"requestedItems.$": "$.getAccess.accessItems"
},
"displayName": "",
"nextStep": "End Step - Success 2",
"type": "action",
"versionNumber": 1
},
"Send Email": {
"actionId": "sp:send-email",
"attributes": {
"body.$": "$.getAccess.accessItems",
"context": {},
"recipientEmailList": [
"XXXXXXXXXXXXXXXXXXXXXXXXX"
],
"replyTo": null,
"subject.$": "$.loop.context"
},
"displayName": "",
"nextStep": "Manage Access",
"type": "action",
"versionNumber": 2
}
}
},
"displayName": "",
"nextStep": "End Step - Success 4",
"type": "action",
"versionNumber": 1
},
"Verify Data Type": {
"actionId": "sp:compare-unary",
"choiceList": [
{
"comparator": "IsPresent",
"nextStep": "Verify Data Type 1",
"variableA.$": "$.getAccounts.accounts[?(@.sourceId==\"XXXXXXXXXXXXXXXXXXX\")].id"
}
],
"defaultStep": "End Step - Success 1",
"displayName": "Verify identity has EMP account.",
"type": "choice"
},
"Verify Data Type 1": {
"actionId": "sp:compare-unary",
"choiceList": [
{
"comparator": "IsNull",
"nextStep": "End Step - Success 3",
"variableA.$": "$.getAccounts.accounts[?(@.sourceId==\"XXXXXXXXXXXXXXXXXXX\")].attributes.LinkedSubtemplateIDs"
}
],
"defaultStep": "Loop",
"description": "Check to see if LinkedSubTemplates value is null. If False, Identity has subtemplates",
"displayName": "Check for subtemplates",
"type": "choice"
}
}
},
"enabled": false,
"executionCount": 0,
"failureCount": 0,
"creator": {
"type": "IDENTITY",
"id": "XXXXXXXXXXXXXXXXXXXXXXXXX",
"name": "My.Name"
},
"owner": {
"type": "IDENTITY",
"id": "XXXXXXXXXXXXXXXXXXXXXXXXX",
"name": "My.Name"
},
"trigger": {
"type": "EVENT",
"attributes": {
"id": "idn:identity-lifecycle-state-change-processed"
}
}
}```
