SonarSource/sonarqube · warning · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

POST api/ce/resume resumes all paused Compute Engine workers and is restricted to callers with a valid system passcode or system-administrator authentication. Otherwise AbstractUserSession.insufficientPrivilegesException() throws 'Insufficient privileges'. It mirrors the pause endpoint's admin gating.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/ResumeAction.java:57

    this.systemPasscode = systemPasscode;
    this.ceQueue = ceQueue;
  }

  @Override
  public void define(WebService.NewController controller) {
    controller.createAction("resume")
      .setDescription("Resumes pause of Compute Engine workers. Requires the system administration permission or " +
        "system passcode (see " + ProcessProperties.Property.WEB_SYSTEM_PASS_CODE.getKey() + " in sonar.properties).")
      .setSince("7.2")
      .setInternal(true)
      .setHandler(this)
      .setPost(true);
  }

  @Override
  public void handle(Request request, Response response) throws Exception {
    if (!systemPasscode.isValid(request) && !userSession.isSystemAdministrator()) {
      throw AbstractUserSession.insufficientPrivilegesException();
    }

    ceQueue.resumeWorkers();
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Authenticate with a token from a user who has Administer System permission.
2. Send the correct system passcode configured via sonar.systemPasscode on the server.
3. Grant the automation account the Administer System global permission.
4. Verify token validity and target server.

Example fix

// before
curl -X POST http://sonar.example.org/api/ce/resume
// after
curl -X POST -u myAdminToken: http://sonar.example.org/api/ce/resume

// verify credentials are admin-grade before resuming workers
def assertAdminAuth(session):
    me = session.get(f'{SONAR_URL}/api/authentication/validate').json()
    if not me.get('valid'):
        raise ValueError('SonarQube token invalid or expired')

try:
    requests.post(f'{SONAR_URL}/api/ce/resume', headers=auth)
except requests.HTTPError as e:
    if e.response is not None and e.response.status_code == 403:
        raise PermissionError('api/ce/resume requires system administrator privileges') from e
    raise

When it happens

Trigger: Calling POST api/ce/resume without a valid system passcode and without system-administrator authentication.

Common situations: Automation resuming workers after maintenance using a non-admin token; missing or wrong system passcode; expired/revoked admin token; anonymous access.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/e973b2b5b36fe883. Report an issue: GitHub.