Tencent/APIJSON · error · IllegalArgumentException

{method}请求,{name}/{key} 不能传 {idKey} !

Error message

{method}请求,{name}/{key} 不能传 {idKey} !

What it means

In verifyRequest's table-object branch: for POST requests the client must not supply the primary id key (resolved via IdCallback.getIdKey, default 'id') because ids are generated server-side. If robj.containsKey(finalIdKey) is true, IllegalArgumentException rejects the request with '{method}请求,{name}/{key} 不能传 {idKey}!'.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:700

					if (StringUtil.isEmpty(ds, false)) {
						ds = datasource;
					}
					if (StringUtil.isEmpty(ns, false)) {
						ns = namespace;
					}
					if (StringUtil.isEmpty(cl, false)) {
						cl = catalog;
					}
					if (StringUtil.isEmpty(sh, false)) {
						sh = schema;
					}

					String idKey = idCallback == null ? null : idCallback.getIdKey(db, ds, ns, cl, sh, key);
					String finalIdKey = StringUtil.isEmpty(idKey, false) ? KEY_ID : idKey;

					if (method == POST) {
						if (robj.containsKey(finalIdKey)) {
							throw new IllegalArgumentException(method + "请求," + name + "/" + key + " 不能传 " + finalIdKey + " !");
						}
					} else {
						Boolean atLeastOne = tobj == null ? null : getBoolean(tobj, Operation.IS_ID_CONDITION_MUST.name());
						if (Boolean.TRUE.equals(atLeastOne) || RequestMethod.isUpdateMethod(method)) {
							verifyId(method.name(), name, key, robj, finalIdKey, maxUpdateCount, atLeastOne != null ? atLeastOne : IS_UPDATE_MUST_HAVE_ID_CONDITION);

							String userIdKey = idCallback == null ? null : idCallback.getUserIdKey(db, ds, ns, cl, sh, key);
							String finalUserIdKey = StringUtil.isEmpty(userIdKey, false) ? KEY_USER_ID : userIdKey;
							verifyId(method.name(), name, key, robj, finalUserIdKey, maxUpdateCount, false);
						}
					}
				}

				return verifyRequest(method, key, tobj, robj, maxUpdateCount, database, datasource, namespace, catalog, schema, idCallback, parser);
			}

			@Override
			protected L onParseJSONArray(String key, L tarray, L rarray) throws Exception {

View on GitHub (pinned to 5284052872)

Solutions

  1. Remove the id field from POST bodies — let IdCallback assign ids on insert.
  2. If the client truly supplies ids (e.g. UUID strings), configure a custom IdCallback and keep clients consistent with it; do not mix server-generated and client-sent ids for the same table.
  3. Strip id in the client serializer for create operations (e.g. lodash omit / DTO projection).

Example fix

// before
POST { "User": { "id": 5, "name": "x" } }

// after
POST { "User": { "name": "x" } }
Defensive patterns

Strategy: validation

Validate before calling

if (method == RequestMethod.POST && tableObj.containsKey(idKey)) {
    clientError("POST must not carry " + idKey + "; ids are generated server-side");
}

Type guard

boolean isIdFreePost(Map<String,Object> tableObj, String idKey) { return !tableObj.containsKey(idKey); }

Try / catch

catch (IllegalArgumentException e) when message contains "不能传" -> 400; strip the id key client-side and resubmit once.

Prevention

When it happens

Trigger: A POST body includes "id" (or the configured id key) inside a table object, e.g. {"User": {"id": 5, "name":"x"}}; the POST branch detects the key and throws before the insert is built.

Common situations: Client reuses an update-form/model that carries id for create; ORM-style DTO serialized wholesale; front-end generates ids offline (uuid-thinking) while the server uses IdCallback; changing IdCallback id key but old clients still send the previous key.

Related errors


AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/d6c9221ee9e8c046. Report an issue: GitHub.