SonarSource/sonarqube · warning · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

The api/ce/info Web Service endpoint returns Compute Engine worker pause status only to callers who present a valid system passcode or are authenticated as a system administrator. If neither holds, AbstractUserSession.insufficientPrivilegesException() is thrown and the WS responds 'Insufficient privileges'. This is SonarQube's standard admin-gating for sensitive server-management endpoints.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/InfoAction.java:59

    this.systemPasscode = systemPasscode;
    this.ceQueue = ceQueue;
  }

  @Override
  public void define(WebService.NewController controller) {
    controller.createAction("info")
      .setDescription("Gets information about Compute Engine. Requires the system administration permission or " +
        "system passcode (see " + ProcessProperties.Property.WEB_SYSTEM_PASS_CODE.getKey() + " in sonar.properties).")
      .setSince("7.2")
      .setInternal(true)
      .setHandler(this)
      .setResponseExample(getClass().getResource("info-example.json"));
  }

  @Override
  public void handle(Request request, Response response) throws Exception {
    if (!systemPasscode.isValid(request) && !userSession.isSystemAdministrator()) {
      throw AbstractUserSession.insufficientPrivilegesException();
    }

    Ce.InfoWsResponse.Builder builder = Ce.InfoWsResponse.newBuilder();
    CeQueue.WorkersPauseStatus status = ceQueue.getWorkersPauseStatus();
    builder.setWorkersPauseStatus(convert(status));
    WsUtils.writeProtobuf(builder.build(), request, response);
  }

  private static Ce.WorkersPauseStatus convert(CeQueue.WorkersPauseStatus status) {
    switch (status) {
      case PAUSING:
        return Ce.WorkersPauseStatus.PAUSING;
      case PAUSED:
        return Ce.WorkersPauseStatus.PAUSED;
      case RESUMED:
        return Ce.WorkersPauseStatus.RESUMED;
      default:
        throw new IllegalStateException("Unsupported WorkersPauseStatus: " + status);

View on GitHub (pinned to 184c821202)

Solutions

1. Log in as a user with the Administer System global permission, or generate a token from such a user and send it as Authorization: Bearer.
2. If calling programmatically, supply the correct system passcode (value of sonar.systemPasscode on the server) in the request.
3. Grant the 'Administer System' permission to the account used for automation (Administration > Security > Global Permissions).
4. Verify the request actually reaches the intended server/organization and that the token was not revoked or expired.

Example fix

// before
curl http://sonar.example.org/api/ce/info
// after
curl -u myAdminToken: http://sonar.example.org/api/ce/info

// ensure an admin token is configured before calling
def requireAdminToken():
    token = os.environ.get('SONAR_ADMIN_TOKEN')
    if not token:
        raise ValueError('SONAR_ADMIN_TOKEN is required for api/ce/info')
    return {'Authorization': f'Bearer {token}'}

try:
    r = requests.get(f'{SONAR_URL}/api/ce/info', headers=auth)
    r.raise_for_status()
except requests.HTTPError as e:
    if r.status_code == 403:
        raise PermissionError('Use a system-admin token or the system passcode for api/ce/info') from e
    raise

When it happens

Trigger: Calling GET api/ce/info without a valid sonar.authenticator passcode header and without being logged in as a system administrator.

Common situations: Scripts or CI tools hitting the CE info WS anonymously; using a regular user account that lacks Administer System permission; stale or wrong sonar.systemPasscode in the client; token belonging to a non-admin user.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Provided user with login '%s' does not have 'Browse' permiss

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/042d8f828ab50f58. Report an issue: GitHub.