flowable/flowable-engine · error · FlowableIllegalArgumentException

Key provided in request body doesn't match the key in the…

Error message

Key provided in request body doesn't match the key in the resource URL.

What it means

FlowableIllegalArgumentException thrown by the REST group-update endpoint when the group key in the request body does not match the {groupId} in the URL. The REST API treats the URL key as authoritative; PUT is only allowed when both keys agree. This protects against accidentally retargeting a group to a different identity.

Solutions

1. Set the groupId field in the request body to exactly the same value as the {groupId} path variable
2. Remove the groupId field from the update body if the API version allows omitting it, so only URL key is used
3. Fix the client code that builds the URL from a different variable than the one placed in the body
4. Check for whitespace/case differences between the URL segment and body key

Example fix

// before
PUT /groups/sales
{"groupId":"marketing","name":"Sales"}
// after
PUT /groups/sales
{"groupId":"sales","name":"Sales"}

// JS client check before PUT
if (body.groupId !== groupIdInUrl) {
  body.groupId = groupIdInUrl; // URL key is authoritative
}
await fetch(`/groups/${encodeURIComponent(groupIdInUrl)}`, {method:'PUT', body: JSON.stringify(body)});

When it happens

Trigger: PUT /flowable-idm-service/groups/{groupId} with a body whose 'groupId' (key) field is set to a different value than the URL path variable, or missing/null in a client that copies the wrong field.

Common situations: Client code reuses a serialized group object from another group; frontend form submits a stale or user-editable groupId field; API consumers confuse group 'id' with 'name' or 'type' fields; template-driven requests where the body key was never updated after changing the URL.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• A request body was expected when bulk updating tasks.
• A request body was expected when executing the form submit.
• Attachment name is required.
• AttachmentRequest properties not found in request
• Batch part with id ' ' does not have a batch part document.

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/9422babadddfa678. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-idm-rest/src/main/java/org/flowable/idm/rest/service/api/group/GroupResource.java:71

    @ApiResponses(value = {
            @ApiResponse(code = 200, message = "Indicates the group was updated."),
            @ApiResponse(code = 404, message = "Indicates the requested group was not found."),
            @ApiResponse(code = 409, message = "Indicates the requested group was updated simultaneously.")
    })
    @PutMapping(value = "/groups/{groupId}", produces = "application/json")
    public GroupResponse updateGroup(@ApiParam(name = "groupId") @PathVariable String groupId, @RequestBody GroupRequest groupRequest) {
        Group group = getGroupFromRequest(groupId);

        if (groupRequest.getId() == null || groupRequest.getId().equals(group.getId())) {
            if (groupRequest.isNameChanged()) {
                group.setName(groupRequest.getName());
            }
            if (groupRequest.isTypeChanged()) {
                group.setType(groupRequest.getType());
            }
            identityService.saveGroup(group);
        } else {
            throw new FlowableIllegalArgumentException("Key provided in request body doesn't match the key in the resource URL.");
        }

        return restResponseFactory.createGroupResponse(group);
    }

    @ApiOperation(value = "Delete a group", tags = { "Groups" }, code = 204)
    @ApiResponses(value = {
            @ApiResponse(code = 204, message = "Indicates the group was found and  has been deleted. Response-body is intentionally empty."),
            @ApiResponse(code = 404, message = "Indicates the requested group does not exist.")
    })
    @DeleteMapping("/groups/{groupId}")
    @ResponseStatus(HttpStatus.NO_CONTENT)
    public void deleteGroup(@ApiParam(name = "groupId") @PathVariable String groupId) {
        Group group = getGroupFromRequest(groupId);
        
        if (restApiInterceptor != null) {
            restApiInterceptor.deleteGroup(group);
        }

View on GitHub (pinned to d6d39ce1c6)