SonarSource/sonarqube · critical · GitlabServerException

Your GitLab token was revoked

Error message

Your GitLab token was revoked

What it means

checkResponseIsSuccessful inspects every failing GitLab API response. When GitLab answers HTTP 401 and the body indicates the token was revoked, it throws GitlabServerException 'Your GitLab token was revoked'. This means the personal access token used for the GitLab DevOps integration is no longer valid and must be replaced.

Source

Thrown at server/sonar-alm-client/src/main/java/org/sonar/alm/client/gitlab/GitlabApplicationClient.java:212

  private static String urlEncode(String value) {
    try {
      return URLEncoder.encode(value, UTF_8.toString());
    } catch (UnsupportedEncodingException ex) {
      throw new IllegalStateException(ex.getCause());
    }
  }

  protected static void checkResponseIsSuccessful(Response response) throws IOException {
    checkResponseIsSuccessful(response, "GitLab Merge Request did not happen, please check your configuration");
  }

  protected static void checkResponseIsSuccessful(Response response, String errorMessage) throws IOException {
    if (!response.isSuccessful()) {
      String body = response.body().string();
      LOG.error("Gitlab API call to [{}] failed with {} http code. gitlab response content : [{}]", response.request().url(), response.code(), body);
      if (isTokenRevoked(response, body)) {
        throw new GitlabServerException(response.code(), "Your GitLab token was revoked");
      } else if (isTokenExpired(response, body)) {
        throw new GitlabServerException(response.code(), "Your GitLab token is expired");
      } else if (isInsufficientScope(response, body)) {
        throw new GitlabServerException(response.code(), "Your GitLab token has insufficient scope");
      } else if (response.code() == HTTP_FORBIDDEN) {
        throw new GitlabServerException(response.code(), "Forbidden access to GitLab. Verify your token's permissions and IP restrictions.");
      } else if (response.code() == HTTP_TOO_MANY_REQUESTS) {
        throw new GitlabServerException(response.code(), "GitLab API rate limit exceeded. Try again later.");
      } else if (response.code() == HTTP_UNAUTHORIZED) {
        throw new GitlabServerException(response.code(), "Invalid personal access token");
      } else if (response.isRedirect()) {
        throw new GitlabServerException(response.code(), "Request was redirected, please provide the correct URL");
      } else {
        throw new GitlabServerException(response.code(), errorMessage);
      }
    }
  }

View on GitHub (pinned to 184c821202)

Solutions

1. Create a new GitLab personal access token with the required scopes (api, read_user) in GitLab > User Settings > Access Tokens.
2. Update the token in SonarQube under Administration > General Settings > DevOps Platform Integrations > GitLab (or re-run the binding configuration).
3. If the token is provided per-project, update it in the project's ALM binding settings.
4. Check GitLab admin audit logs to confirm who/what revoked the token before re-issuing.

Example fix

// before
String token = "glpat-REVOKED-TOKEN";
// after: generate a fresh token in GitLab and store it
String token = newGitLabPatWithApiAndReadUserScopes();

// Before configuring, check the token is alive
Response r = call("GET", gitlabUrl + "/api/v4/personal_access_tokens/self", token);
if (r.code() == 401) throw new IllegalStateException("GitLab token invalid or revoked — issue a new PAT with api and read_user scopes");

try {
  gitlabClient.checkToken();
} catch (GitlabServerException e) {
  if ("Your GitLab token was revoked".equals(e.getMessage())) {
    // prompt for a new PAT and re-run binding
  } else { throw e; }
}

When it happens

Trigger: Any GitLab API call routed through checkResponseIsSuccessful (checkProjectAccess, checkToken, getPersonalAccessTokenInfo, checkWritePermission, createProjectAccessToken) receives 401 with a body matching the revoked-token signature ("401 unauthorized" / revoked message) at GitlabApplicationClient.java:212.

Common situations: A GitLab admin revoked or deleted the PAT; the user manually revoked the token in GitLab user settings; the token was invalidated by rotating it; the token was deleted after offboarding the user.

Related errors

• Your GitLab token is expired
• Invalid personal access token
• Your GitLab token has insufficient scope
• Invalid personal access token
• Authentication failed, verify the Client Id, Client Secret a

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/cd42a722e171d712. Report an issue: GitHub.