SonarSource/sonarqube · warning · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

POST api/ce/pause pauses all Compute Engine workers and is restricted to callers presenting a valid system passcode or authenticated as a system administrator. Otherwise AbstractUserSession.insufficientPrivilegesException() is thrown with 'Insufficient privileges'. This prevents non-admins from halting background analysis processing.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/PauseAction.java:57

    this.systemPasscode = systemPasscode;
    this.ceQueue = ceQueue;
  }

  @Override
  public void define(WebService.NewController controller) {
    controller.createAction("pause")
      .setDescription("Requests pause of Compute Engine workers. Requires the system administration permission or " +
        "system passcode (see " + ProcessProperties.Property.WEB_SYSTEM_PASS_CODE.getKey() + " in sonar.properties).")
      .setSince("7.2")
      .setInternal(true)
      .setHandler(this)
      .setPost(true);
  }

  @Override
  public void handle(Request request, Response response) throws Exception {
    if (!systemPasscode.isValid(request) && !userSession.isSystemAdministrator()) {
      throw AbstractUserSession.insufficientPrivilegesException();
    }

    ceQueue.pauseWorkers();
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Use a token from a user holding the Administer System global permission.
2. Provide the correct system passcode header matching sonar.systemPasscode server configuration.
3. Grant Administer System to the automation account if appropriate.
4. Check the server is the expected one and the token is still valid.

Example fix

// before
curl -X POST http://sonar.example.org/api/ce/pause
// after
curl -X POST -u myAdminToken: http://sonar.example.org/api/ce/pause

// check admin auth material exists before pausing workers
def assertCanPause(headers):
    if 'Authorization' not in headers and 'X-Sonar-Passcode' not in headers:
        raise ValueError('Need admin Authorization header or X-Sonar-Passcode')

try:
    requests.post(f'{SONAR_URL}/api/ce/pause', headers=auth)
except requests.HTTPError as e:
    if e.response is not None and e.response.status_code == 403:
        raise PermissionError('api/ce/pause requires system administrator or valid passcode') from e
    raise

When it happens

Trigger: Calling POST api/ce/pause without a valid system passcode and without system-administrator authentication.

Common situations: Maintenance automation run under a non-admin token; missing Authorization header; wrong sonar.systemPasscode configured on the client side; anonymous requests.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/f5c50202a0a866e8. Report an issue: GitHub.