{"record":{"id":"79e7372f5be7b176","repo":"flowable/flowable-engine","slug":"key-provided-in-request-body-does-not-match-the-ke","errorCode":null,"errorMessage":"Key provided in request body does not match the key in the resource URL.","messagePattern":"Key provided in request body does not match the key in the resource URL\\.","errorType":"http","errorClass":"FlowableIllegalArgumentException","httpStatus":400,"severity":"error","filePath":"modules/flowable-rest/src/main/java/org/flowable/rest/service/api/identity/GroupResource.java","lineNumber":71,"sourceCode":"    @ApiResponses(value = {\n            @ApiResponse(code = 200, message = \"Indicates the group was updated.\"),\n            @ApiResponse(code = 404, message = \"Indicates the requested group was not found.\"),\n            @ApiResponse(code = 409, message = \"Indicates the requested group was updated simultaneously.\")\n    })\n    @PutMapping(value = \"/identity/groups/{groupId}\", produces = \"application/json\")\n    public GroupResponse updateGroup(@ApiParam(name = \"groupId\") @PathVariable String groupId, @RequestBody GroupRequest groupRequest) {\n        Group group = getGroupFromRequest(groupId);\n\n        if (groupRequest.getId() == null || groupRequest.getId().equals(group.getId())) {\n            if (groupRequest.isNameChanged()) {\n                group.setName(groupRequest.getName());\n            }\n            if (groupRequest.isTypeChanged()) {\n                group.setType(groupRequest.getType());\n            }\n            identityService.saveGroup(group);\n        } else {\n            throw new FlowableIllegalArgumentException(\"Key provided in request body does not match the key in the resource URL.\");\n        }\n\n        return restResponseFactory.createGroupResponse(group);\n    }\n\n    @ApiOperation(value = \"Delete a group\", tags = { \"Groups\" }, code = 204)\n    @ApiResponses(value = {\n            @ApiResponse(code = 204, message = \"Indicates the group was found and  has been deleted. Response-body is intentionally empty.\"),\n            @ApiResponse(code = 404, message = \"Indicates the requested group does not exist.\")\n    })\n    @DeleteMapping(\"/identity/groups/{groupId}\")\n    @ResponseStatus(HttpStatus.NO_CONTENT)\n    public void deleteGroup(@ApiParam(name = \"groupId\") @PathVariable String groupId) {\n        Group group = getGroupFromRequest(groupId);\n        \n        if (restApiInterceptor != null) {\n            restApiInterceptor.deleteGroup(group);\n        }","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-rest/src/main/java/org/flowable/rest/service/api/identity/GroupResource.java#L53-L89","documentation":"GroupResource.updateGroup only applies changes when the id in the request body matches the groupId path variable; otherwise it throws FlowableIllegalArgumentException. Group ids are immutable identifiers, so a body that renames or mismatched the URL would either update the wrong record or be ambiguous — the REST layer rejects it instead.","triggerScenarios":"PUT /identity/groups/{groupId} where the JSON body's \"id\" differs from {groupId}, e.g. PUT /identity/groups/sales with body {\"id\":\"marketing\",...}, or the client simply omitted the id field and it deserialized to a different/mismatched value.","commonSituations":"Attempting to rename a group by changing its id in the body (ids are immutable — create a new group instead); a shared request DTO whose id field was populated with the wrong value; copying a payload built for a POST into a PUT.","solutions":["Make the body \"id\" exactly match the {groupId} path variable.","To 'rename' a group, create a new group with the desired id and delete the old one; ids cannot be changed via update.","On the client, serialize the id from the same source used to build the URL."],"exampleFix":"// before\nPUT /identity/groups/sales {\"id\":\"marketing\",\"name\":\"Marketing\"}\n// after\nPUT /identity/groups/sales {\"id\":\"sales\",\"name\":\"Sales (EU)\"}\n// renaming requires create-new + delete-old, not a body id change","handlingStrategy":"validation","validationCode":"if (!groupId.equals(groupRequest.getId())) {\n    throw new IllegalArgumentException(\"Body id must match URL groupId for PUT /identity/groups/\" + groupId);\n}","typeGuard":"boolean idMatchesUrl(String urlId, GroupRequest r) { return r != null && urlId != null && urlId.equals(r.getId()); }","tryCatchPattern":null,"preventionTips":["Serialize the body id from the same variable used in the URL.","Never attempt to rename groups by changing the body id — create a new group instead.","Reuse the GET response entity (which carries the correct id) when building updates."],"tags":["rest-api","validation","group","id-mismatch"],"backgroundTag":"invalid-argument-value","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}