{"record":{"id":"66e4733dc485aad0","repo":"flowable/flowable-engine","slug":"method-http-method-not-supported","errorCode":null,"errorMessage":"${method} HTTP method not supported","messagePattern":"(.+?) HTTP method not supported","errorType":"validation","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-http-common/src/main/java/org/flowable/http/common/impl/apache/ApacheHttpComponentsFlowableHttpClient.java","lineNumber":223,"sourceCode":"                    setRequestEntity(requestInfo, patch);\n                    request = patch;\n                    break;\n                }\n                case \"DELETE\": {\n                    HttpDeleteWithBody delete = new HttpDeleteWithBody(uri);\n                    setRequestEntity(requestInfo, delete);\n                    request = delete;\n                    break;\n                }\n                case \"HEAD\": {\n                    request = new HttpHead(uri);\n                    break;\n                }\n                case \"OPTIONS\":\n                    request = new HttpOptions(uri);\n                    break;\n                default: {\n                    throw new FlowableException(requestInfo.getMethod() + \" HTTP method not supported\");\n                }\n            }\n\n            setHeaders(request, requestInfo.getHttpHeaders());\n            setHeaders(request, requestInfo.getSecureHttpHeaders());\n\n            setConfig(request, requestInfo);\n            return new ApacheHttpComponentsExecutableHttpRequest(request);\n        } catch (URISyntaxException ex) {\n            throw new FlowableException(\"Invalid URL exception occurred\", ex);\n        } catch (IOException ex) {\n            throw new FlowableException(\"IO exception occurred\", ex);\n        }\n    }\n\n    protected URI createUri(String url) throws URISyntaxException {\n        String uri = SPACE_CHARACTER_PATTERN.matcher(url).replaceAll(ENCODED_SPACE_CHARACTER);\n        return new URI(PLUS_CHARACTER_PATTERN.matcher(uri).replaceAll(ENCODED_PLUS_CHARACTER));","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-http-common/src/main/java/org/flowable/http/common/impl/apache/ApacheHttpComponentsFlowableHttpClient.java#L205-L241","documentation":"prepareRequest builds the Apache HttpRequest via a switch on the HTTP method. Only GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS (per the switch) are supported; any other method string reaches the default branch and throws FlowableException with '<method> HTTP method not supported'. The delegating layer normally restricts methods, but the expression-driven method value can still resolve to something unsupported.","triggerScenarios":"The HTTP task's requestMethod expression resolves at runtime to a method outside the supported set (e.g. 'TRACE', 'CONNECT', lowercase handled, but a custom/invalid value like 'PURGE' or 'GET2'), reaching prepareRequest directly.","commonSituations":"Passing the HTTP method from a process variable that came from user input or an external system; typos like 'DELET'; supporting non-standard verbs used by some APIs (e.g. Elasticsearch PURGE) through generic HTTP tasks.","solutions":["Change the requestMethod to one of the supported verbs (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS)","If the target API only supports the non-standard verb, use a supported verb with an override header (e.g. X-HTTP-Method-Override) if the server honors it","Validate/sanitize the variable feeding requestMethod before the task","Extend the client via a custom HttpRequestInformation handler if non-standard methods are truly required"],"exampleFix":"// before\nexecution.setVariable(\"httpMethod\", \"PURGE\");\n// after\nexecution.setVariable(\"httpMethod\", \"POST\");","handlingStrategy":"validation","validationCode":"java.util.Set<String> SUPPORTED = java.util.Set.of(\"GET\",\"POST\",\"PUT\",\"DELETE\",\"PATCH\",\"HEAD\",\"OPTIONS\");\nString m = (String) execution.getVariable(\"httpMethod\");\nif (m == null || !SUPPORTED.contains(m.trim().toUpperCase())) {\n    throw new IllegalArgumentException(\"Unsupported HTTP method: \" + m);\n}","typeGuard":"boolean isSupportedMethod(String m) { return m != null && java.util.Set.of(\"GET\",\"POST\",\"PUT\",\"DELETE\",\"PATCH\",\"HEAD\",\"OPTIONS\").contains(m.trim().toUpperCase()); }","tryCatchPattern":"try {\n    client.prepareRequest(requestInfo);\n} catch (FlowableException e) {\n    if (e.getMessage() != null && e.getMessage().endsWith(\"HTTP method not supported\")) {\n        // reject or substitute a supported verb\n    } else { throw e; }\n}","preventionTips":["Whitelist methods before binding them to requestMethod expressions","Never pass user-supplied strings directly as the HTTP method","Use X-HTTP-Method-Override for non-standard verbs where the server supports it"],"tags":["flowable","http-method","unsupported-operation","http-client"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}