It's possible to create groups with some characters that need URL encoding before being used in API requests. Example "strange%name". This is a valid group name and I can create a group with this name. However, when I go to view this group I get a 400 response from the "/ui/api/v1/ui/groups/strange%name" endpoint since it doesn't url encode the group name before use.
/ui/api/v1/ui/groups/strange%25name returns the expected json response.
Group names needs to be url encoded before they are used in API requests.
If a character is not allowed in a group name (like \, / etc) it should be blocked from use in the web UI and the create group endpoint (PUT /api/security/groups).