{"record":{"id":"604245163248bd7b","repo":"theonedev/onedev","slug":"not-authenticated-604245","errorCode":null,"errorMessage":"Not authenticated","messagePattern":"Not authenticated","errorType":"http","errorClass":"UnauthenticatedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java","lineNumber":344,"sourceCode":"\t\n\t@Api(order=1800)\n\t@GET\n    public List<UserData> queryUsers(\n    \t\t@QueryParam(\"term\") @Api(description=\"Any string in login name, full name or email address\") String term, \n    \t\t@QueryParam(\"offset\") @Api(example=\"0\") int offset, \n    \t\t@QueryParam(\"count\") @Api(example=\"100\") int count) {\n\t\tif (!SecurityUtils.isAdministrator())\n\t\t\tthrow new UnauthorizedException();\n\n    \treturn userService.query(term, offset, count).stream().map(this::getData).collect(toList());\n    }\n\t\n\t@Api(order=1850)\n\t@Path(\"/ids/{name}\")\n\t@GET\n\tpublic Long getUserId(@PathParam(\"name\") @Api(description = \"Login name of user\") String name) {\n\t\tif (SecurityUtils.getAuthUser() == null)\n\t\t\tthrow new UnauthenticatedException();\n\n\t\tvar user = userService.findByName(name);\n\t\tif (user != null)\n\t\t\treturn user.getId();\n\t\telse \n\t\t\tthrow new NotFoundException();\n\t}\n\t\n\t@Api(order=1900, description=\"Create new user\")\n    @POST\n    public Long createUser(@NotNull @Valid UserCreateData data) {\n\t\tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n\n\t\tif (userService.findByName(data.getName()) != null)\n\t\t\tthrow new NotAcceptableException(\"Login name is already used by another user\");\n\t\tif (data.getType() == ORDINARY && emailAddressService.findByValue(data.getEmailAddress()) != null)\n\t\t\tthrow new NotAcceptableException(\"Email address is already used by another user\");","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/UserResource.java#L326-L362","documentation":"Thrown by UserResource.getUserId when the request carries no authenticated user at all. Unlike other user endpoints, resolving a login name to an id only requires authentication (any user), but anonymous calls are rejected with UnauthenticatedException ('Not authenticated').","triggerScenarios":"GET /rest/users/ids/{name} without Authorization header/session cookie, or with invalid/expired credentials so SecurityUtils.getAuthUser() returns null.","commonSituations":"Missing REST access token; token expired or revoked; calling the endpoint from an anonymous script or curl without -u/--header.","solutions":["Add valid authentication to the request (access token or basic auth).","Regenerate the access token if it expired or was revoked.","Verify credentials with a cheap authenticated call before this one.","Check that the REST server URL targets the authenticated context, not an anonymous proxy."],"exampleFix":"// before\ncurl http://onedev/api/rest/users/ids/alice\n// after\ncurl -H \"Authorization: Bearer <access-token>\" http://onedev/api/rest/users/ids/alice","handlingStrategy":"validation","validationCode":"if (accessToken == null || accessToken.isBlank())\n    throw new IllegalStateException(\"Access token required for /users/ids endpoint\");","typeGuard":null,"tryCatchPattern":"try { return client.getUserId(name); }\ncatch (NotAuthorizedException e) { throw new NotAuthenticatedException(\"Supply a valid access token\"); }\ncatch (NotFoundException e) { return null; }","preventionTips":["Always attach Authorization header for REST calls.","Rotate/renew tokens before expiry in long-running jobs.","Sanity-check credentials with an authenticated ping call at startup."],"tags":["rest","authentication","user-lookup"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}