Tencent/APIJSON · error · IllegalArgumentException

{method}请求，{name}/{key} 里面的 {idInKey}:[] 中[]的长度不能超过 {maxUpda

Error message

{method}请求，{name}/{key} 里面的 {idInKey}:[] 中[]的长度不能超过 {maxUpdateCount} ！

What it means

Thrown by verifyId when the id{} array length exceeds maxUpdateCount, the per-request cap on how many rows one UPDATE/DELETE may touch. This is a safety valve against accidental mass modification.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:773

		//批量修改或删除
		String idInKey = idKey + "{}";
		// id引用, 格式: "id{}@": "sql"
		String idRefInKey = getString(robj, idKey + "{}@");
		L idIn = null;
		try {
			idIn = get(robj, idInKey); //如果必须传 id{} ，可在Request表中配置NECESSARY
		} catch (Exception e) {
			throw new IllegalArgumentException(method + "请求，" + name + "/" + key
					+ " 里面的 " + idInKey + ":value 中value的类型只能是 [Long] ！");
		}
		if (idIn == null) {
			if (atLeastOne && id == null && idRefInKey == null) {
				throw new IllegalArgumentException(method + "请求，" + name + "/" + key
						+ " 里面 " + idKey + "," + idInKey  + "," + (idKey + "{}@") + " 至少传其中一个！");
			}
		} else {
			if (idIn.size() > maxUpdateCount) { //不允许一次操作 maxUpdateCount 条以上记录
				throw new IllegalArgumentException(method + "请求，" + name + "/" + key
						+ " 里面的 " + idInKey + ":[] 中[]的长度不能超过 " + maxUpdateCount + " ！");
			}
			//解决 id{}: ["1' OR 1='1'))--"] 绕过id{}限制
			//new ArrayList<Long>(idIn) 不能检查类型，Java泛型擦除问题，居然能把 ["a"] 赋值进去还不报错
			for (int i = 0; i < idIn.size(); i++) {
				Object o = idIn.get(i);
				if (o == null) {
					throw new IllegalArgumentException(method + "请求，" + name + "/" + key
							+ " 里面的 " + idInKey + ":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \"\" ] 中任何一个 ！");
				}
				if (o instanceof Number) {
					//解决 Windows mysql-5.6.26-winx64 等低于 5.7 的 MySQL 可能 id{}: [0] 生成 id IN(0) 触发 MySQL bug 导致忽略 IN 条件
					//例如 UPDATE `apijson`.`TestRecord` SET `testAccountId` = -1 WHERE ( (`id` IN (0)) AND (`userId`= 82001) )
					if (((Number) o).longValue() <= 0) {
						throw new IllegalArgumentException(method + "请求，" + name + "/" + key
								+ " 里面的 " + idInKey + ":[] 中所有项都不能为 [ null, <= 0 的数字, 空字符串 \"\" ] 中任何一个 ！");
					}
				}

View on GitHub (pinned to 5284052872)

Solutions

Chunk the client request into batches of at most maxUpdateCount ids per call
If the operation is legitimate and authorized, raise the maxUpdateCount passed to verifyId / configured for the request
Prefer a server-side batch API or stored procedure for very large sets instead of huge id{} arrays

Example fix

// before
{"User":{"id{}":[1,2,3,...,5000],"status":1}}
// after (chunk client-side, e.g. 100 per request)
{"User":{"id{}":[1,2,3,...,100],"status":1}}

Defensive patterns

Strategy: validation

Validate before calling

const MAX_UPDATE_COUNT = 100; // match server config
function chunkIds(ids, size = MAX_UPDATE_COUNT) {
  const out = [];
  for (let i = 0; i < ids.length; i += size) out.push(ids.slice(i, i + size));
  return out;
}

Try / catch

catch (e) { if (/长度不能超过/.test(e.message)) { const n = Number(e.message.match(/超过 (\d+)/)?.[1]); retryInChunks(n); } else throw e; }

Prevention

Know the server's maxUpdateCount before building batch UIs
Chunk by default in bulk import/export code paths
Show remaining count in bulk-operation UI so users sense the cap

When it happens

Trigger: PUT/DELETE with {"User":{"id{}":[ ...more than maxUpdateCount ids... ]}} — default cap is small (e.g. 10 in the framework's verifyId call sites; MAX_UPDATE_COUNT configurable per deployment).

Common situations: Bulk-sync jobs pushing thousands of ids in one request; admin 'select all and delete' UI; raising data volume after launch without raising the cap.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/8296ec6ba9c11822. Report an issue: GitHub.