{"record":{"id":"6f4436db4aaa0d68","repo":"flowable/flowable-engine","slug":"the-provided-body-contains-a-serialized-object-for-6f4436","errorCode":null,"errorMessage":"The provided body contains a serialized object for which the class was not found: \" + ioe.getMessage()","messagePattern":"The provided body contains a serialized object for which the class was not found: \" \\+ ioe\\.getMessage\\(\\)","errorType":"http","errorClass":"FlowableContentNotSupportedException","httpStatus":415,"severity":"error","filePath":"modules/flowable-rest/src/main/java/org/flowable/rest/service/api/runtime/process/BaseExecutionVariableResource.java","lineNumber":187,"sourceCode":"            } else {\n                throw new FlowableContentNotSupportedException(\"Serialized objects are not allowed\");\n            }\n\n            RestVariable variable = null;\n            \n            if (!async) {\n                variable = getVariableFromRequestWithoutAccessCheck(execution, variableName, scope, false);\n                \n                // We are setting the scope because the fetched variable does not have it\n                variable.setVariableScope(scope);\n            }\n            \n            return variable;\n\n        } catch (IOException ioe) {\n            throw new FlowableIllegalArgumentException(\"Could not process multipart content\", ioe);\n        } catch (ClassNotFoundException ioe) {\n            throw new FlowableContentNotSupportedException(\"The provided body contains a serialized object for which the class was not found: \" + ioe.getMessage());\n        }\n\n    }\n\n    protected RestVariable setSimpleVariable(RestVariable restVariable, Execution execution, boolean isNew, boolean async) {\n        if (restVariable.getName() == null) {\n            throw new FlowableIllegalArgumentException(\"Variable name is required\");\n        }\n\n        // Figure out scope, revert to local if omitted\n        RestVariableScope scope = restVariable.getVariableScope();\n        if (scope == null) {\n            scope = RestVariableScope.LOCAL;\n        }\n\n        Object actualVariableValue = restResponseFactory.getVariableValue(restVariable);\n        setVariable(execution, restVariable.getName(), actualVariableValue, scope, isNew, async);\n","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-rest/src/main/java/org/flowable/rest/service/api/runtime/process/BaseExecutionVariableResource.java#L169-L205","documentation":"FlowableContentNotSupportedException thrown when deserializing a variable body whose Java class is not on the REST server's classpath. The REST API deserializes serialized Java objects sent as binary variables; if the object's class cannot be loaded, the request is rejected. This protects against silently accepting an unusable variable value.","triggerScenarios":"POST/PUT of a binary variable with a Java-serialized object (Content-Type application/x-java-serialized-object) whose class was removed from the server or never deployed there.","commonSituations":"Client serializes a custom POJO that exists on the client but not in the flowable-rest webapp's classpath; server upgraded and the class was renamed/moved; different library versions on client and server.","solutions":["Ensure the serialized class (and its package) is present on the server's classpath, e.g. add the client's domain jar to flowable-rest's WEB-INF/lib","Prefer sending JSON or primitive values instead of raw Java-serialized objects","If the class was refactored, re-serialize the variable with the new class name or use a serialization filter/Compatibility mode","Check that client and server share the same version of the library defining the class"],"exampleFix":"// before\nclasspath: flowable-rest.war (no domain classes)\nObjectOutputStream oos = new ObjectOutputStream(out); oos.writeObject(myCustomDto);\n// after\n// add domain-classes.jar to flowable-rest/WEB-INF/lib so ClassNotFoundException disappears","handlingStrategy":"validation","validationCode":"Class<?> c = null;\ntry { c = Class.forName(myDto.getClass().getName(), false, Thread.currentThread().getContextClassLoader()); } catch (ClassNotFoundException ignored) {}\nif (c == null) throw new IllegalStateException(\"Class \" + myDto.getClass().getName() + \" must be on the flowable-rest server classpath\");","typeGuard":"static boolean isSerializableSafe(Object o) { return o instanceof String || o instanceof Number || o instanceof Boolean || o instanceof byte[]; }","tryCatchPattern":"try {\n    restClient.setBinaryVariable(executionId, name, body);\n} catch (HttpServerErrorException | HttpClientErrorException e) {\n    if (e.getResponseBodyAsString().contains(\"class was not found\")) { /* fall back to JSON transport */ }\n}","preventionTips":["Deploy the same domain-classes jar to the server that the client serializes with","Prefer JSON/primitive variable types over java serialization","Keep client and server library versions aligned","Pin serialized class package names — avoid refactors that change them"],"tags":["rest","serialization","classpath","variables"],"backgroundTag":"class-not-found","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}