Do you mean that restful api is able to specify variable values but the variables are not set to prompted from web UI?

User used /rest/builds/build_id to get build variables then use the result to submit a build request via the API
Consequently, they can modify not prompted variables in api request.
To address this, we propose adding a configuration option in general setting or a similar option in another page to define which variables are accessible via GET requests and suitable in POST requests.

Filed as an improvement request:

Hello Mr. Robin Shen,

when 'Check API Build Request Variables' checked yes, user can not request build via api only use promotionSource-buildId
eachPromotion.getConfigurationPath() function did not execute groovy script in {promotionSource > promotion > Configuration}

Please help me check it.
Thank you

Not quite understand the issue here. Can you please show me an example?

Example:
I have 2 configurations: root/SRC & root/DES
I used api to create build request in configuration "root/DES"

<com.pmease.quickbuild.BuildRequest>
{root/DES configuration id}

{build in root/SRC}

</com.pmease.quickbuild.BuildRequest>

DES - Check API Build Request Variables: A
SRC - Promotions> Promotion_1:
Configuration: ${groovy: return "root/DES"}

If A=="no", build request created successfully by api
If A=="yes", can not create build request:
error: 500
msg: Unable to find promotion targetting configuration 'root/DES'

This issue has now been fixed in 16.0.14: