When developing a new ExpressionEngine module which uses Ajax extensively within the control panel, I kept getting the following response when trying to access a control panel url.
Disallowed Key Characters.
The reason for this is the EE blocks any urls which contain anything other than the following
a-z 0-9 : _ / -
The reason it was failing was because my urls contained escaped html characters – & instead of &. The solution was to convert the escaped url back to unescaped by using the htmlspecialchars_decode() function