"Empty Payload. JSON content expected." when posting a comment with SDK v6

[k0urge]

Describe the bug

"Empty Payload. JSON content expected." error is thrown when trying to add a comment on an Alert v2.

com.microsoft.graph.models.odataerrors.ODataError: Empty Payload. JSON content expected.
	at com.microsoft.graph.models.odataerrors.ODataError.createFromDiscriminatorValue(ODataError.java:36)
	at com.microsoft.kiota.serialization.JsonParseNode.getObjectValue(JsonParseNode.java:212)
	at com.microsoft.kiota.http.OkHttpRequestAdapter.lambda$throwIfFailedResponse$0(OkHttpRequestAdapter.java:674)
	at com.microsoft.kiota.ApiExceptionBuilder.<init>(ApiExceptionBuilder.java:26)
	at com.microsoft.kiota.http.OkHttpRequestAdapter.throwIfFailedResponse(OkHttpRequestAdapter.java:673)
	at com.microsoft.kiota.http.OkHttpRequestAdapter.sendCollection(OkHttpRequestAdapter.java:200)
	at com.microsoft.graph.security.alerts_v2.item.comments.CommentsRequestBuilder.post(CommentsRequestBuilder.java:72)
	at com.microsoft.graph.security.alerts_v2.item.comments.CommentsRequestBuilder.post(CommentsRequestBuilder.java:56)

HTTP response status code is 400 "bad request".

Expected behavior

A comment is created on the alert, without any error.

For instance, posting the same request with Curl works perfectly:

curl -X POST \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "@odata.type": "microsoft.graph.security.alertComment",
    "comment": "Your comment here"
  }' \
  "https://graph.microsoft.com/v1.0/security/alerts_v2/{alertId}/comments"

How to reproduce

I followed the instructions from the documentation (https://learn.microsoft.com/en-us/graph/api/security-alert-post-comments?view=graph-rest-1.0&tabs=java):

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

com.microsoft.graph.models.security.AlertComment alertComment = new com.microsoft.graph.models.security.AlertComment();
alertComment.setOdataType("microsoft.graph.security.alertComment");
alertComment.setComment("Demo for docs");
var result = graphClient.security().alertsV2().byAlertId("{alert-id}").comments().post(alertComment);

but converted that code into Kotlin. The post() method, contrary to the documentation need a list of comments as input instead of a single comment.

val comment = AlertComment()
comment.odataType = "microsoft.graph.security.alertComment"
comment.comment = "my comment"
graphClient.security().alertsV2().byAlertId(alertId).comments().post(listOf(comment))

Debugging the request, I can see that the payload send by the SDK is [{"comment":"my comment","@odata.type":"microsoft.graph.security.alertComment"}] instead of {"comment":"my comment","@odata.type":"microsoft.graph.security.alertComment"} as it should be.

SDK Version

6.13.0

Latest version known to work for scenario above?

unknown

Known Workarounds

No response

Debug output

Click to expand log

```

</details>


### Configuration

_No response_

### Other information

_No response_

[Ndiritu]

Thanks for reporting this @k0urge.

Following up with an upstream team that owns the metadata we generate the SDK from. OpenAPI spec defines a list of comments.

[dmitry-pavlov]

I confirm the issue. The C# code (using Microsoft.Graph NuGet package version 5.68.0) below:

            await Client.Security.Alerts_v2[alertId].Comments.PostAsync(new List<AlertComment>
            {
                new AlertComment
                {
                    OdataType = "microsoft.graph.security.alertComment",
                    Comment = "my comment", 
                    CreatedByDisplayName = "User name"
                }
            }, _ => { }, token);

results into Exception

Microsoft.Graph.Models.ODataErrors.ODataError: Empty Payload. JSON content expected.
at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.ThrowIfFailedResponseAsync(HttpResponseMessage response, Dictionary`2 errorMapping, Activity activityForAttributes, CancellationToken cancellationToken)
at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.SendCollectionAsync[ModelType](RequestInformation requestInfo, ParsableFactory`1 factory, Dictionary`2 errorMapping, CancellationToken cancellationToken)
at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.SendCollectionAsync[ModelType](RequestInformation requestInfo, ParsableFactory`1 factory, Dictionary`2 errorMapping, CancellationToken cancellationToken)
at Microsoft.Graph.Security.Alerts_v2.Item.Comments.CommentsRequestBuilder.PostAsync(List`1 body, Action`1 requestConfiguration, CancellationToken cancellationToken)

[scottzach1]

The same issue is occurring for me:

import asyncio
import os

from azure.identity import ClientSecretCredential
from msgraph import GraphServiceClient
from msgraph.generated.models.security.alert_comment import AlertComment


async def main():
    creds = ClientSecretCredential(
        client_id=os.getenv("AZURE_CLIENT_ID"),
        client_secret=os.getenv("AZURE_CLIENT_SECRET"),
        tenant_id=os.getenv("AZURE_TENANT_ID"),
    )
    graph = GraphServiceClient(creds)

    alerts = await graph.security.alerts_v2.get()
    alert = alerts.value[0]

    await graph.security.alerts_v2.by_alert_id(alert.id).comments.post(body=[AlertComment(comment="Bazinga")])


if __name__ == '__main__':
    asyncio.run(main())

results in exception:

msgraph.generated.models.o_data_errors.o_data_error.ODataError: 
        APIError
        Code: 400
        message: None
        error: MainError(additional_data={}, code='BadRequest', details=None, inner_error=InnerError(additional_data={}, client_request_id='7612f853-4b08-46a0-ad73-4a8c2f327ecf', date=datetime.datetime(2025, 4, 3, 0, 16, 59), odata_type=None, request_id='ca858fab-a76b-40a8-9545-7cd10a853963'), message='Empty Payload. JSON content expected.', target=None)

dependencies:

azure-identity==1.21.0
msgraph-sdk==1.26.0

Related: https://github.com/microsoftgraph/msgraph-sdk-dotnet/issues/2514 (Dotnet SDK)