What causes "{method}请求，{name} 里面不允许传 {rk} 等{refuseSet}内的任何字段！" in Tencent/APIJSON?

Strip refused fields from the payload before sending (build a minimal write object)

Tencent/APIJSON · error · IllegalArgumentException

{method}请求，{name} 里面不允许传 {rk} 等{refuseSet}内的任何字段！

Error message

{method}请求，{name} 里面不允许传 {rk} 等{refuseSet}内的任何字段！

What it means

Thrown during request verification: the client sent a field that the Request table's REFUSE list forbids for this request. REFUSE is the server-side 'must NOT send' contract (with !key exceptions and !"" refuse-all-but-MUST mode).

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:1117

					refuseSet.add(rfs);
				}
			}
		}

		// 解析不允许的字段>>>>>>>>>>>>>>>>>>>

		Set<String> onKeys = new LinkedHashSet<>();

		// 判断不允许传的key<<<<<<<<<<<<<<<<<<<<<<<<<
		for (String rk : rkset) {
			if (rk == null || KEY_STRING.equals(rk) || KEY_TRIM.equals(rk)) {
				// ConcurrentModificationException  real.remove(rk);
				continue;
			}

			if (refuseSet.contains(rk)) { // 不允许的字段
				throw new IllegalArgumentException(method + "请求，" + name
						+ " 里面不允许传 " + rk + " 等" + StringUtil.get(refuseSet) + "内的任何字段！");
			}

			if (KEY_COMBINE.equals(rk)) {
				throw new UnsupportedOperationException(method + " 请求，" + rk + " 不合法！" +
						"非开放请求不允许传 " + KEY_COMBINE + ":value ！");
			}
			if (KEY_KEY.equals(rk)) {
				throw new UnsupportedOperationException(method + " 请求，" + rk + " 不合法！" +
						"非开放请求不允许传 " + KEY_KEY + ":value ！");
			}

			Object rv = real.get(rk);
			if (rv != null && stringKeyList != null && stringKeyList.contains(rk)) {
				rv = toJSONString(rv);
			}
			if (rv != null && trimKeyList != null && trimKeyList.contains(rk)) {
				rv = StringUtil.trim(rv);

View on GitHub (pinned to 5284052872)

Solutions

Strip refused fields from the payload before sending (build a minimal write object)
If the field should be client-writable, remove it from REFUSE (or add a !key exception) in the Request table
On the client, keep read models and write models separate so fetched objects are not echoed back

Example fix

// before  REFUSE="balance"
{"User":{"name":"a","balance":100}}
// after
{"User":{"name":"a"}}

Defensive patterns

Strategy: validation

Validate before calling

const REFUSED_FIELDS = ['balance', 'role']; // mirror of Request-table REFUSE
function stripRefused(obj, refused) {
  const out = { ...obj };
  for (const f of refused) delete out[f];
  return out;
}

Try / catch

catch (e) { if (/不允许传/.test(e.message)) { const rk = e.message.match(/传 (\S+) 等/)?.[1]; retryWithout(rk); } else throw e; }

Prevention

Build write payloads from explicit field lists, never echo fetched rows back
Maintain a client-side copy of REFUSE per endpoint and strip before send
Coordinate REFUSE changes with client release notes

When it happens

Trigger: Request row for POST User has REFUSE="balance" (or refuse-all !"" without the key in MUST) and the client posts {"User":{"name":"a","balance":100}} — refuseSet contains 'balance' when rkset is scanned.

Common situations: Client reuses a full object (e.g. a row fetched via GET) as the POST/PUT body, including server-managed columns; frontend sends extra fields the backend owns (balance, role, createdAt); new refuse rule deployed while old clients still send the field.

Related errors

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/63ebdd83288e93d5. Report an issue: GitHub.