SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

api/qualityprofiles/add_project attaches a project to a quality profile. checkPermissions allows the operation only if the user can administrate the profile globally (ADMINISTER_QUALITY_PROFILES) or is a project ADMIN; otherwise it throws insufficientPrivilegesException. This prevents non-admin project users from changing which rule set analyzes their project.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualityprofile/ws/AddProjectAction.java:124

        dbSession.commit();
      }
      qualityProfileChangeEventService.publishRuleActivationToSonarLintClients(project, profile, deactivatedProfile);
    }

    response.noContent();
  }

  private ProjectDto loadProject(DbSession dbSession, Request request) {
    String projectKey = request.mandatoryParam(PARAM_PROJECT);
    return componentFinder.getProjectByKey(dbSession, projectKey);
  }

  private void checkPermissions(QProfileDto profile, ProjectDto project) {
    if (wsSupport.canAdministrate(profile) || userSession.hasEntityPermission(ProjectPermission.ADMIN, project)) {
      return;
    }

    throw insufficientPrivilegesException();
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Grant the user project ADMIN permission on the target project.
2. Or grant global 'Administer Quality Profiles' permission via Administration > Security.
3. Use an admin/automation token with quality-profiles administration rights.
4. Check that the profile name and language parameters match an existing, non-built-in profile (built-in profiles also cannot be modified via other checks).

Example fix

// before: project user tries to attach profile
curl -u usertoken: -X POST "$SONAR/api/qualityprofiles/add_project?language=java&qualityProfile=MyProfile&project=my.project"

// after: grant project admin first
curl -u admintoken: -X POST "$SONAR/api/permissions/add_user?projectKey=my.project&permission=admin&login=jdoe"

curl -u "$TOKEN": "$SONAR/api/permissions/users?projectKey=$PROJECT&login=$USER" | grep '"permission":"admin"'
curl -u "$TOKEN": "$SONAR/api/permissions/user?login=$USER" | grep 'profileadmin'

When it happens

Trigger: Calling POST api/qualityprofiles/add_project (language+profile+projectKey) as a user who is neither a quality-profile administrator nor an administrator of the target project.

Common situations: Developers with project USER access trying to switch their project's profile; automation tokens that lost the global quality-profiles permission; cross-team requests where the caller is admin of a different project.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/bab9da696f0ead18. Report an issue: GitHub.