flowable/flowable-engine · error · FlowableContentNotSupportedException

The provided body contains a serialized object for which the

Error message

The provided body contains a serialized object for which the class was not found: ${ioe.getMessage()}

What it means

When the multipart part IS a Java-serialized object, setBinaryVariable deserializes it with ObjectInputStream. If the class of the serialized object is not on the server classpath, a ClassNotFoundException is thrown and rethrown as FlowableContentNotSupportedException with this message. The API refuses to create a variable whose value class the server cannot load.

Source

Thrown at modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/caze/BaseVariableResource.java:388

                throw new FlowableContentNotSupportedException("Serialized objects are not allowed");
            }

            RestVariable restVariable = null;
            
            if (!async) {
                restVariable = getVariableFromRequestWithoutAccessCheck(instanceId, variableName, responseVariableType, false);
                
                // We are setting the scope because the fetched variable does not have it
                restVariable.setVariableScope(scope);
            }
            
            return restVariable;
            
        } catch (IOException ioe) {
            throw new FlowableIllegalArgumentException("Could not process multipart content", ioe);
            
        } catch (ClassNotFoundException ioe) {
            throw new FlowableContentNotSupportedException(
                    "The provided body contains a serialized object for which the class was not found: " + ioe.getMessage());
        }
    }

    protected void setVariable(String instanceId, String name, Object value, RestVariableScope scope, boolean isNew, boolean async, VariableInterceptor variableInterceptor) {
        if (isNew) {
            variableInterceptor.createVariables(Collections.singletonMap(name, value));
        } else {
            variableInterceptor.updateVariables(Collections.singletonMap(name, value));
        }

        if (RestVariableScope.LOCAL == scope) {
            //the guard is only added here, because this whole block is new
            if (isNew && runtimeService.hasLocalVariable(instanceId, name)) {
                throw new FlowableConflictException("Local variable '" + name + "' is already present on plan item instance '" + instanceId + "'.");
            }
            
            if (async) {

View on GitHub (pinned to d6d39ce1c6)

Solutions

1. Deploy the missing class to the Flowable server's classpath (add the jar containing it)
2. Send JSON/typed variables instead of Java-serialized objects so no server-side class loading is needed
3. Align the serialized class's package/name/serialVersionUID between client and server
4. If the class was renamed, provide serialization compatibility (serialVersionUID, writeObject/readObject) or re-publish the variable in a portable format

Example fix

// before: variable value = my.custom.Dto (not on server)
// after
Map<String, Object> vars = new HashMap<>();
vars.put("orderData", dtoToJsonMap(dto)); // send as JSON variable instead of serialized object
restClient.post().uri(variablesUrl).body(vars);

if (serializedClassName != null && !serverClasspathContains(serializedClassName)) {
    throw new IllegalStateException("Server cannot load class " + serializedClassName + "; use a JSON variable instead");
}

null

try {
    postSerializedVariable(name, obj);
} catch (HttpServerErrorException e) {
    if (e.getResponseBodyAsString().contains("class was not found")) {
        // fall back to JSON representation of the value
        postJsonVariable(name, toJson(obj));
    }
}

When it happens

Trigger: POSTing application/x-java-serialized-object content of a class that the Flowable server does not have (custom domain object, different package/version of a class, class removed after serialization).

Common situations: Clients sending custom DTOs not deployed on the server, version skew between client and server jar versions of a shared model class, refactoring/renaming classes while old clients still send old serialized payloads, uploading objects from a different application entirely.

Related errors

• The provided body contains a serialized object for which the
• Error writing form model response
• Unexpected exception getting variable data
• Error getting variable ${variable.getName()}
• Serialized objects are not allowed

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/87c5151eea4e7ca9. Report an issue: GitHub.