flowable/flowable-engine · error · FlowableIllegalArgumentException

identityId is null

Error message

identityId is null

What it means

The final required parameter check in AddIdentityLinkCmd.validateParams(): identityId (the user or group id being linked) must be non-null. A null identityId gives Flowable nothing to link, so the command rejects it before execution.

Source

Thrown at modules/flowable-app-engine/src/main/java/org/flowable/app/engine/impl/cmd/AddIdentityLinkCmd.java:56

        super(appDefinitionId);
        validateParams(appDefinitionId, identityId, identityIdType, identityType);
        this.appDefinitionId = appDefinitionId;
        this.identityId = identityId;
        this.identityIdType = identityIdType;
        this.identityType = identityType;
    }

    protected void validateParams(String appDefinitionId, String identityId, int identityIdType, String identityType) {
        if (appDefinitionId == null) {
            throw new FlowableIllegalArgumentException("appDefinitionId is null");
        }

        if (identityType == null) {
            throw new FlowableIllegalArgumentException("type is required when adding a new task identity link");
        }

        if (identityId == null) {
            throw new FlowableIllegalArgumentException("identityId is null");
        }

        if (identityIdType != IDENTITY_USER && identityIdType != IDENTITY_GROUP) {
            throw new FlowableIllegalArgumentException("identityIdType allowed values are 1 and 2");
        }
    }

    @Override
    protected Void execute(CommandContext commandContext, AppDefinition appDefinition) {

        if (IDENTITY_USER == identityIdType) {
            CommandContextUtil.getIdentityLinkService().createScopeIdentityLink(appDefinition.getId(), null, ScopeTypes.APP,
                            identityId, null, identityType);
            
        } else if (IDENTITY_GROUP == identityIdType) {
            CommandContextUtil.getIdentityLinkService().createScopeIdentityLink(appDefinition.getId(), null, ScopeTypes.APP,
                            null, identityId, identityType);
        }

View on GitHub (pinned to d6d39ce1c6)

Solutions

1. Resolve and pass the actual user or group id string before calling the API.
2. Validate the incoming request payload for userId/groupId presence.
3. Check that the entity supplying the id is fully loaded (not a lazy/proxy field that is null).

Example fix

// before
appService.addIdentityLink(appDefinitionId, user.getId(), 1, "participant"); // user.getId() may be null
// after
Objects.requireNonNull(user.getId(), "userId is required");
appService.addIdentityLink(appDefinitionId, user.getId(), 1, "participant");

if (identityId == null || identityId.isBlank()) {
    throw new IllegalArgumentException("identityId (user or group id) is required");
}

try { appService.addIdentityLink(appDefId, identityId, idType, type); }
catch (FlowableIllegalArgumentException e) { log.error("Identity link rejected: " + e.getMessage()); }

When it happens

Trigger: Calling the identity-link API with identityId == null — e.g. an unset userId/groupId variable, or a user object whose id field was never loaded.

Common situations: Passing user.getId() from a partially hydrated entity; request payloads missing userId/groupId; confusing identityId (String user/group id) with identityIdType (int flag).

Related errors

• appDefinitionId is null
• type is required when adding a new task identity link
• type is required when deleting a process identity link
• userId and groupId cannot both be null
• type is required when adding a new process instance identity

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/5692bee4f0328b4b. Report an issue: GitHub.