binarywang/WxJava · error · IllegalArgumentException

uri参数中不允许有suite_access_token: {}

Error message

uri参数中不允许有suite_access_token: {}

What it means

Thrown as IllegalArgumentException when executeInternal detects that the caller-supplied URI already contains 'suite_access_token=' as a query parameter. The library injects the suite access token automatically; passing a URI that pre-embeds the token is treated as a programming error to prevent token duplication or leakage.

Source

Thrown at weixin-java-cp/src/main/java/me/chanjar/weixin/cp/tp/service/impl/BaseWxCpTpServiceImpl.java:456

  /**
   * Execute internal t.
   *
   * @param <T>                     the type parameter
   * @param <E>                     the type parameter
   * @param executor                the executor
   * @param uri                     the uri
   * @param data                    the data
   * @param withoutSuiteAccessToken the without suite access token
   * @return the t
   * @throws WxErrorException the wx error exception
   */
  protected <T, E> T executeInternal(RequestExecutor<T, E> executor, String uri, E data,
                                     boolean withoutSuiteAccessToken) throws WxErrorException {
    E dataForLog = DataUtils.handleDataWithSecret(data);

    if (uri.contains("suite_access_token=")) {
      throw new IllegalArgumentException("uri参数中不允许有suite_access_token: " + uri);
    }
    String uriWithAccessToken;
    if (!withoutSuiteAccessToken) {
      String suiteAccessToken = getSuiteAccessToken(false);
      uriWithAccessToken = uri + (uri.contains("?") ? "&" : "?") + "suite_access_token=" + suiteAccessToken;
    } else {
      uriWithAccessToken = uri;
    }


    try {
      T result = executor.execute(uriWithAccessToken, data, WxType.CP);
      log.debug("\n【请求地址】: {}\n【请求参数】：{}\n【响应数据】：{}", uriWithAccessToken, dataForLog, result);
      return result;
    } catch (WxErrorException e) {
      WxError error = e.getError();
      /*
       * 发生以下情况时尝试刷新suite_access_token

View on GitHub (pinned to 1c43293a3c)

Solutions

1. Remove 'suite_access_token=...' from the URI string before passing it to the service method
2. Pass only the base API path and non-token query parameters; the library appends the token automatically
3. If building URLs dynamically, strip any existing suite_access_token parameter: uri = uri.replaceAll('[?&]suite_access_token=[^&]*', '')

Example fix

// before
service.get("https://qyapi.weixin.qq.com/cgi-bin/service/get_login_info?suite_access_token=TOKEN", body);

// after
service.get("https://qyapi.weixin.qq.com/cgi-bin/service/get_login_info", body);

// Validate URI before calling the service
if (uri != null && uri.contains("suite_access_token=")) {
  throw new IllegalArgumentException("URI must not contain suite_access_token; the library injects it automatically");
}
service.get(uri, data);

private static boolean isUriSafe(String uri) {
  return uri != null && !uri.contains("suite_access_token=");
}

try {
  service.get(uri, data);
} catch (IllegalArgumentException e) {
  if (e.getMessage().contains("suite_access_token")) {
    uri = uri.replaceAll("[?&]suite_access_token=[^&]*", "");
    service.get(uri, data);
  } else {
    throw e;
  }
}

When it happens

Trigger: Caller passes a URI string containing 'suite_access_token=xxx' to any service method that routes through executeInternal, e.g., service.get('https://qyapi.weixin.qq.com/...?suite_access_token=TOKEN&type=1', null).

Common situations: Copy-paste from WeChat API documentation that includes the token parameter in sample URLs; manually pre-building URLs with the token; debugging code left in production.

Related errors

• 缺少tagId参数
• uri参数中不允许有access_token:
• Parameter 'leaseMilliseconds' must grate then 0: {}
• 更新「联系我」方式需要指定configId
• 使用该配置的客户群ID列表，支持5个

AI-assisted analysis of binarywang/WxJava@1c43293a3c (2026-08-14). Data as JSON: /api/errors/0a19e0877729126d. Report an issue: GitHub.