Auth0-deploy-cli error: Problem deleting actions BadRequestError Status code: 400 "message": "Invalid Argument"

Get Help
,
1

Ive encountered an error with the auth0-deploy-cli tool: 400 Deploy error with deleting Actions even though the management API has deletion scope.

I added the delete:actions scope to the Auth0 API for nb-auth0 deploy CLI which hasnt resolved this issue.

You will encounter this error when using the auth0-deploy-cli GitHub - auth0/auth0-deploy-cli: The Auth0 Deploy CLI is a tool that helps you manage your Auth0 tenant configuration. It integrates into your development workflows as a standalone CLI or as a node module. · GitHub , if an action exists on the Auth0 tenant but isnt included in the configuration being deployed. The config deployment attempts to delete the action, but fails with an error. Even though our management cli has the scope to delete actions. This is an issue I’d like to bring up with Auth0 engineers working on the auth0-deploy-cli tool, but since I am not yet sure this issue is specific to the auth0-deploy-cli tool, I would like to share with the community.

2026-08-14T18:01:23.264Z - error: Problem running command import during stage processChanges when processing type actions
2026-08-14T18:01:23.264Z - error: Problem deleting actions {"id":"6a37163b-c801-4017-9fe9-db353dad2940","name":"Custom Event Stream Action (2026-08-06 20:27:16)"}
BadRequestError: BadRequestError
Status code: 400
Body: {
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Invalid Argument"
}

Steps to reproduce

  1. Pull your current tenant configs using the directory (json) format using the auth0-deploy-cli like so
npx auth0-deploy-cli export \
  --strip \
  --format directory \
  --output_folder ./${output_folder} \
  --config_file ./${output_folder}/${from_tenant}.json \
  --debug true
  1. Create an action bound to a trigger in the Auth0 UI, also can be reproduced with Actions belonging to an eventStream .
  2. Then without exporting any of the newly created action+triggers in step 1, perform an import to tenant, in our case the command uses the directory (json) format. (At this point the newly created trigger + Action exists on the auth0 tenant but not at all on the config repo on my local machine, so it will attempt to delete).
  3. See the error occur, error: Problem deleting actions
#https://github.com/auth0/auth0-deploy-cli/blob/master/docs/using-as-cli.md
npx auth0-deploy-cli import \
  --input_file ./${input_folder} \
  --config_file ./${input_folder}/${to_tenant}.json \
  --debug true \

Known workaround

The solution is to manually delete the action in the auth0 UI if possible. Then re-import to tenant and the error should be resolved.

Also note, for Actions bound to an eventStream as a trigger, it is not possible to delete these Actions code from the Auth0 UI, the eventStream must be deleted. I have recently accidentally orphaned the action belonging to an eventStream, wont go into the details how to reproduce here, but I got completely stuck with a broken deploy tool because I couldnt delete the action in the UI. Deleting an action that is orphaned from an eventStream is only possible with the latest auth0 cli interface (Confirmed with auth0/auth0-cli/auth0 version 1.33.0):

nb-auth0 % auth0 actions show
...
nb-dev.eu.auth0.com action

  ID             c402bad2-8b11-4e9c-85cd-e33a66420b12
...
nb-auth0 % auth0 actions delete "c402bad2-8b11-4e9c-85cd-e33a66420b12"  
 Are you sure you want to proceed? Yes
Deleting action(s)... done

Background

I am working on updating our depency of auth0-deploy-cli for our config repo, and this issue of actions not being able to be deleted by the deploy tool has been around as long as I can remember since 2024 (as of Aug20th 2026 time of writing, we’re on auth0-deploy-cli v8.25, and I’m working on updating to latest 8.43.0)
I’d like to improve our experience with the auth0-deploy-cli and make it a more robust + reliable infrastructure as code tool, with less manual workarounds such as this. If this issue is better moved to GitHub - auth0/auth0-deploy-cli: The Auth0 Deploy CLI is a tool that helps you manage your Auth0 tenant configuration. It integrates into your development workflows as a standalone CLI or as a node module. · GitHub, that would be cool with me as well, I wanted to get other developers attention to this.

3

Hi @seb.dtrg

Welcome back to the Auth0 Community!

You are encountering a 400 “Invalid Argument” error when the auth0-deploy-cli attempts to delete Actions during import, even though the delete:actions scope has been added to the Management API credentials for the deploy CLI application.

**The 400 error when deleting actions in auth0-deploy-cli is most likely caused by one of two conditions:

  1. The action is bound to a trigger in the Auth0 tenant
  2. The action has stale or orphaned references (particularly for actions associated with Event Streams). The delete:actions scope alone is not sufficient if the action is still bound to a trigger or has invalid internal state.**

[ROOT CAUSE]
Auth0’s action deletion logic enforces a constraint: actions cannot be deleted if they are bound to a trigger or have unresolved dependencies. This is by design to prevent accidental removal of active authentication flows. When auth0-deploy-cli attempts to delete an action that exists on the tenant but is not in your configuration file, it first tries to delete the action directly. If that action is bound to a trigger (even if the trigger is not in your config), the Management API returns a 400 “Invalid Argument” error instead of a more explicit “action bound to trigger” error.

Additionally, if an action is orphaned from an Event Stream (a known issue in the deploy-cli), the action enters an invalid state and cannot be deleted via the Management API, even with the correct scopes.

[Official Workaround]

Step 1: Verify trigger bindings before import

Before running the import command, check the Auth0 Dashboard to see if the action you are trying to delete is bound to any triggers:

  1. Navigate to Auth0 Dashboard → Actions → Flows (or Triggers).
  2. Identify any actions that exist on the tenant but are not in your configuration file.
  3. Check if those actions are bound to any trigger flows.

Step 2: Remove trigger bindings manually (if possible)

If the action is bound to a trigger:

  1. Navigate to Auth0 Dashboard → Actions → [Trigger Name] (e.g., Post-Login).
  2. Remove the action from the flow by clicking the action and selecting Delete or Remove.
  3. Save the flow.

After the trigger binding is removed, the action can be deleted.

Step 3: Use the newer auth0 CLI for orphaned actions

If the action is orphaned from an Event Stream or cannot be deleted via the Dashboard, use the official auth0 CLI (version 1.33.0 or later) to delete it:

auth0 actions show
# Find the action ID you need to delete

auth0 actions delete "<ACTION_ID>"
# Confirm the deletion when prompted

Step 4: Re-run the deploy-cli import

After manually removing the action, re-run your import command:

npx auth0-deploy-cli import \
  --input_file ./${input_folder} \
  --config_file ./${input_folder}/${to_tenant}.json \
  --debug true

Step 5: Prevent future deletions with AUTH0_ALLOW_DELETE

To prevent the deploy-cli from attempting to delete actions in the future, add the following to your configuration file:

{
  "AUTH0_DOMAIN": "<domain>",
  "AUTH0_CLIENT_ID": "<client>",
  "AUTH0_ALLOW_DELETE": false
}

Setting AUTH0_ALLOW_DELETE to false will prevent the deploy-cli from deleting any resources that exist on the tenant but are not in your configuration.

I understand that you have already mentioned the known workaround provided, however, I have added all additional details in response to your post.

Also well noted in your post, actions bound to Event Streams cannot be deleted from the Auth0 Dashboard UI. If you need to remove an Event Stream action, you must either:

  • Delete the Event Stream itself (which will remove the associated action), or
  • Use the auth0 CLI to delete the orphaned action directly.

This issue has been reported as a long-standing limitation in auth0-deploy-cli (present since at least v8.25). Consider opening or upvoting an issue on the auth0-deploy-cli GitHub repository to request improved error messaging and automatic trigger unbinding before deletion. In the meantime, the workarounds above should resolve your immediate deployment issues.

Kind Regards,
Nik