SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

api/qualityprofiles/remove_project detaches a project from a quality profile. checkPermissions mirrors AddProjectAction: the caller must either be able to administrate the profile (quality-profile administration) or hold project ADMIN permission on the target project. Otherwise insufficientPrivilegesException is thrown.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualityprofile/ws/RemoveProjectAction.java:117

      }

      qualityProfileChangeEventService.publishRuleActivationToSonarLintClients(project, activatedProfile, profile);

      response.noContent();
    }
  }

  private ProjectDto loadProject(DbSession dbSession, Request request) {
    String projectKey = request.mandatoryParam(PARAM_PROJECT);
    return componentFinder.getProjectByKey(dbSession, projectKey);
  }

  private void checkPermissions(QProfileDto profile, ProjectDto project) {
    if (wsSupport.canAdministrate(profile) || userSession.hasEntityPermission(ProjectPermission.ADMIN, project)) {
      return;
    }

    throw insufficientPrivilegesException();
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Grant project ADMIN permission on the target project to the calling user.
2. Or grant global 'Administer Quality Profiles' permission.
3. Run the cleanup with an administrator token.
4. Confirm the projectKey parameter refers to the project the user administers, not a renamed/duplicate key.

Example fix

// before: non-admin tries to detach profile
curl -u usertoken: -X POST "$SONAR/api/qualityprofiles/remove_project?language=java&qualityProfile=TeamProfile&project=my.project"

// after: grant project admin
curl -u admintoken: -X POST "$SONAR/api/permissions/add_user?projectKey=my.project&permission=admin&login=jdoe"

curl -u "$TOKEN": "$SONAR/api/permissions/users?projectKey=$PROJECT&login=$USER" | grep '"permission":"admin"'
curl -u "$TOKEN": "$SONAR/api/permissions/user?login=$USER" | grep 'profileadmin'

When it happens

Trigger: Calling POST api/qualityprofiles/remove_project (language+qualityProfile+projectKey) as a user who is neither a quality-profile administrator nor an admin of the given project.

Common situations: Project USER-level developers trying to unlink a profile from their project; cleanup scripts run with a token that only has analysis rights; callers admin of a different project than the one named in projectKey.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/ba2c1288f6262987. Report an issue: GitHub.