Tencent/APIJSON · error · UnsupportedOperationException

{method} 请求，{rk} 不合法！非开放请求不允许传 @key:value ！

Error message

{method} 请求，{rk} 不合法！非开放请求不允许传 @key:value ！

What it means

Thrown when a non-open request carries the @key key (per-request table-key / primary-key selector). Like @combine, it is a query-shaping directive reserved for open requests; closed requests fix it in configuration.

Source

Thrown at APIJSONORM/src/main/java/apijson/orm/AbstractVerifier.java:1126

		// 判断不允许传的key<<<<<<<<<<<<<<<<<<<<<<<<<
		for (String rk : rkset) {
			if (rk == null || KEY_STRING.equals(rk) || KEY_TRIM.equals(rk)) {
				// ConcurrentModificationException  real.remove(rk);
				continue;
			}

			if (refuseSet.contains(rk)) { // 不允许的字段
				throw new IllegalArgumentException(method + "请求，" + name
						+ " 里面不允许传 " + rk + " 等" + StringUtil.get(refuseSet) + "内的任何字段！");
			}

			if (KEY_COMBINE.equals(rk)) {
				throw new UnsupportedOperationException(method + " 请求，" + rk + " 不合法！" +
						"非开放请求不允许传 " + KEY_COMBINE + ":value ！");
			}
			if (KEY_KEY.equals(rk)) {
				throw new UnsupportedOperationException(method + " 请求，" + rk + " 不合法！" +
						"非开放请求不允许传 " + KEY_KEY + ":value ！");
			}

			Object rv = real.get(rk);
			if (rv != null && stringKeyList != null && stringKeyList.contains(rk)) {
				rv = toJSONString(rv);
			}
			if (rv != null && trimKeyList != null && trimKeyList.contains(rk)) {
				rv = StringUtil.trim(rv);
			}

			// 不允许传远程函数，只能后端配置
			if (rk.endsWith("()") && rv instanceof String) {
				throw new UnsupportedOperationException(method + " 请求，" + rk + " 不合法！" +
                        "非开放请求不允许传远程函数 key():\"fun()\" ！");
			}

			// 不在target内的 key:{}

View on GitHub (pinned to 5284052872)

Solutions

1. Drop @key from the payload
2. Have the backend set the intended key in the Request-table config or mark the request open
3. If you need per-request key selection, expose it via a dedicated open tag

Example fix

// before
{"User":{"name":"a","@key":"userId"}}
// after
{"User":{"name":"a"}}

function stripLockedKeys(obj) {
  const out = { ...obj };
  delete out['@key'];
  return out;
}

When it happens

Trigger: A request body containing "@key":"userId" sent to a tag whose Request-table row is not open.

Common situations: Frontend adds @key while trying to switch which column identifies rows (e.g. dedupe by userId instead of id) on a locked endpoint; pasting from APIJSON documentation examples.

Related errors

• {method} 请求，{rk} 不合法！非开放请求不允许传 @combine:value ！
• {method} 请求，{rk} 不合法！非开放请求不允许传远程函数 key():"fun()" ！
• {}: { @key(): value } 对应存储过程 value 中字符 {} 不合法！schema.functio
• @raw:value 的 value 中 {} 不合法！对应的 {}: value 在当前对象 {} 不存在或 valu
• key[]:{} 只支持 GET, GETS 方法！其它方法不允许传 {}:{} 等这种 key[]:{} 格式！

AI-assisted analysis of Tencent/APIJSON@5284052872 (2026-08-14). Data as JSON: /api/errors/0f10a16dbfff4dac. Report an issue: GitHub.