SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

api/scannercache/get returns cached scanner data for a project. checkPermission grants access to users with project SCAN, project ADMIN, or global SCAN (Execute Analysis) permission; all others get insufficientPrivilegesException. The endpoint is meant for CI accounts and project admins retrieving data cached during analysis.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/scannercache/ws/GetAction.java:129

      }
    }
  }

  private static boolean requestedCompressedData(Request request) {
    return request.header("Accept-Encoding")
      .map(encoding -> Arrays.stream(encoding.split(","))
        .map(String::trim)
        .anyMatch("gzip"::equals))
      .orElse(false);
  }

  private void checkPermission(ProjectDto project) {
    if (userSession.hasEntityPermission(ProjectPermission.SCAN, project) ||
      userSession.hasEntityPermission(ProjectPermission.ADMIN, project) ||
      userSession.hasPermission(SCAN)) {
      return;
    }
    throw insufficientPrivilegesException();
  }
}

View on GitHub (pinned to 184c821202)

Solutions

  1. Grant global 'Execute Analysis' (scan) permission to the CI user — the standard fix for pipeline tokens.
  2. Or grant the user project SCAN or project ADMIN permission via api/permissions/add_user.
  3. Ensure the request is authenticated and the user is a member of any group that carries the project SCAN permission.
  4. Verify the projectKey matches the project whose permissions were granted (renamed keys are a common mismatch).

Example fix

// before: user-only role cannot read scanner cache
curl -u usertoken: "$SONAR/api/scannercache/get?projectKey=my.project"

// after: grant project scan permission
curl -u admintoken: -X POST "$SONAR/api/permissions/add_user?projectKey=my.project&permission=scan&login=jdoe"
Defensive patterns

Strategy: try-catch

Validate before calling

curl -u "$TOKEN": "$SONAR/api/permissions/users?projectKey=$PROJECT&login=$USER" | grep -E '"scan"|"admin"'
curl -u "$TOKEN": "$SONAR/api/permissions/user?login=$USER" | grep '"scan"'

Try / catch

try {
  ScannerCache cache = wsClient.scannerCache().get(req.setProjectKey(key));
} catch (ServiceErrorException e) {
  if (e.errors().contains("Insufficient privileges")) {
    // grant project SCAN/ADMIN or global scan to the token's user
  }
}

Prevention

When it happens

Trigger: Calling GET api/scannercache/get?projectKey=... for a project where the token's user has no SCAN/ADMIN project permission and no global Execute Analysis permission.

Common situations: CI tokens whose project roles were reset while the global scan permission was also revoked; dashboards fetching scanner cache anonymously; users added only as USER (not SCAN/ADMIN) on the project.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/abba3ec0c48dc211. Report an issue: GitHub.