Tencent/APIJSON · error · IllegalArgumentException

不支持在 ${method} 中 ${_method} ！

Error message

不支持在 ${method} 中 ${_method} ！

What it means

For non-CRUD endpoints, every table object's resolved method must exactly equal the URL method; the parser throws '不支持在 X 中 Y ！' when an object declares a different method. This is a deliberate security guard so a /get request cannot smuggle a write via per-object @method.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractParser.java:2505

							if (method == RequestMethod.CRUD) {
								_method = GET;
								Map<String, Object> objAttrMap = new HashMap<>();
								objAttrMap.put(KEY_METHOD, GET);
								keyObjectAttributesMap.put(key, objAttrMap);
							} else {
								_method = method;
								Map<String, Object> objAttrMap = new HashMap<>();
								objAttrMap.put(KEY_METHOD, method);
								keyObjectAttributesMap.put(key, objAttrMap);
							}
						} else {
							_method = (RequestMethod) attrMap.get(KEY_METHOD);
						}
					}

					// 非 CRUD 方法，都只能和 URL method 完全一致，避免意料之外的安全风险。
					if (method != RequestMethod.CRUD && _method != method) {
						throw new IllegalArgumentException("不支持在 " + method + " 中 " + _method + " ！");
					}

					// get请求不校验
					if (RequestMethod.isPublicMethod(_method)) {
						correctRequest.put(key, obj);
						continue;
					}

					if (tag != null && ! tag.contains(":")) {
						M object = getRequestStructure(_method, tag, version);
						M ret = objectVerify(_method, tag, version, name, request, maxUpdateCount, creator, object);
						correctRequest.putAll(ret);
						break;
					}

					String _tag = buildTag(request, key, method, tag);
					M object = getRequestStructure(_method, _tag, version);
					if (method == RequestMethod.CRUD && StringUtil.isEmpty(tag, true)) {

View on GitHub (pinned to 5284052872)

Solutions

1. Match the object method to the URL: use /crud if one request must mix methods
2. Or delete the per-object @method / method directive so it inherits the URL method
3. Audit shared request templates for leftover @method keys

Example fix

// before
POST /get  {"User": {"@method": "PUT", "id": 1}}
// after
POST /crud {"User": {"@method": "PUT", "id": 1}}  // or drop @method on /get

if (urlMethod !== 'CRUD') {
  for (const [tbl, obj] of Object.entries(req)) {
    const m = obj?.['@method'];
    if (m && m.toUpperCase() !== urlMethod.toUpperCase()) {
      throw new Error(`${tbl}: @method ${m} conflicts with URL ${urlMethod}; use /crud`);
    }
  }
}

const methodMatchesUrl = (m, url) => url === 'CRUD' || !m || m.toUpperCase() === url.toUpperCase();

try { await client.invoke(url, req); } catch (e) { if (e.message.includes('不支持在')) rerouteToCrud(url, req); else throw e; }

When it happens

Trigger: POST /get with "User": {"@method": "PUT"}; /put endpoint containing an object declared as POST; any non-CRUD URL where attrMap/method directive sets a mismatched per-object method.

Common situations: Reusing one generic request body across endpoints; migrating an endpoint from /crud to /get but keeping per-object @method values; method directive @put inside a /get request.

Related errors

• ${key}:{} 里的 @combine:value 不合法！开放请求 GET、HEAD 才允许传 @combine:
• {}: { @key(): value } 对应存储过程 value 中字符 {} 不合法！schema.functio
• @raw:value 的 value 中 {} 不合法！对应的 {}: value 在当前对象 {} 不存在或 valu
• key[]:{} 只支持 GET, GETS 方法！其它方法不允许传 {}:{} 等这种 key[]:{} 格式！
• 字符 {fun} 不合法！预编译模式下 {example} 中 function 必须符合小写英文单词的 SQL 函数名

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/5f9917bdf13095ca. Report an issue: GitHub.