{"record":{"id":"87c5151eea4e7ca9","repo":"flowable/flowable-engine","slug":"the-provided-body-contains-a-serialized-object-for","errorCode":null,"errorMessage":"The provided body contains a serialized object for which the class was not found: ${ioe.getMessage()}","messagePattern":"The provided body contains a serialized object for which the class was not found: (.+?)","errorType":"http","errorClass":"FlowableContentNotSupportedException","httpStatus":415,"severity":"error","filePath":"modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/caze/BaseVariableResource.java","lineNumber":388,"sourceCode":"                throw new FlowableContentNotSupportedException(\"Serialized objects are not allowed\");\n            }\n\n            RestVariable restVariable = null;\n            \n            if (!async) {\n                restVariable = getVariableFromRequestWithoutAccessCheck(instanceId, variableName, responseVariableType, false);\n                \n                // We are setting the scope because the fetched variable does not have it\n                restVariable.setVariableScope(scope);\n            }\n            \n            return restVariable;\n            \n        } catch (IOException ioe) {\n            throw new FlowableIllegalArgumentException(\"Could not process multipart content\", ioe);\n            \n        } catch (ClassNotFoundException ioe) {\n            throw new FlowableContentNotSupportedException(\n                    \"The provided body contains a serialized object for which the class was not found: \" + ioe.getMessage());\n        }\n    }\n\n    protected void setVariable(String instanceId, String name, Object value, RestVariableScope scope, boolean isNew, boolean async, VariableInterceptor variableInterceptor) {\n        if (isNew) {\n            variableInterceptor.createVariables(Collections.singletonMap(name, value));\n        } else {\n            variableInterceptor.updateVariables(Collections.singletonMap(name, value));\n        }\n\n        if (RestVariableScope.LOCAL == scope) {\n            //the guard is only added here, because this whole block is new\n            if (isNew && runtimeService.hasLocalVariable(instanceId, name)) {\n                throw new FlowableConflictException(\"Local variable '\" + name + \"' is already present on plan item instance '\" + instanceId + \"'.\");\n            }\n            \n            if (async) {","sourceCodeStart":370,"sourceCodeEnd":406,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/caze/BaseVariableResource.java#L370-L406","documentation":"When the multipart part IS a Java-serialized object, setBinaryVariable deserializes it with ObjectInputStream. If the class of the serialized object is not on the server classpath, a ClassNotFoundException is thrown and rethrown as FlowableContentNotSupportedException with this message. The API refuses to create a variable whose value class the server cannot load.","triggerScenarios":"POSTing application/x-java-serialized-object content of a class that the Flowable server does not have (custom domain object, different package/version of a class, class removed after serialization).","commonSituations":"Clients sending custom DTOs not deployed on the server, version skew between client and server jar versions of a shared model class, refactoring/renaming classes while old clients still send old serialized payloads, uploading objects from a different application entirely.","solutions":["Deploy the missing class to the Flowable server's classpath (add the jar containing it)","Send JSON/typed variables instead of Java-serialized objects so no server-side class loading is needed","Align the serialized class's package/name/serialVersionUID between client and server","If the class was renamed, provide serialization compatibility (serialVersionUID, writeObject/readObject) or re-publish the variable in a portable format"],"exampleFix":"// before: variable value = my.custom.Dto (not on server)\n// after\nMap<String, Object> vars = new HashMap<>();\nvars.put(\"orderData\", dtoToJsonMap(dto)); // send as JSON variable instead of serialized object\nrestClient.post().uri(variablesUrl).body(vars);","handlingStrategy":"try-catch","validationCode":"if (serializedClassName != null && !serverClasspathContains(serializedClassName)) {\n    throw new IllegalStateException(\"Server cannot load class \" + serializedClassName + \"; use a JSON variable instead\");\n}","typeGuard":"null","tryCatchPattern":"try {\n    postSerializedVariable(name, obj);\n} catch (HttpServerErrorException e) {\n    if (e.getResponseBodyAsString().contains(\"class was not found\")) {\n        // fall back to JSON representation of the value\n        postJsonVariable(name, toJson(obj));\n    }\n}","preventionTips":["Avoid Java-serialized objects in REST payloads; use JSON variables","Keep client and server model classes in sync (package, name, serialVersionUID)","Only serialize classes actually deployed on the Flowable server"],"tags":["serialization","classnotfound","classpath","rest"],"backgroundTag":"class-not-found","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}