{"record":{"id":"76e76d30ea53fe14","repo":"theonedev/onedev","slug":"count-should-not-be-greater-than-100","errorCode":null,"errorMessage":"Count should not be greater than 100","messagePattern":"Count should not be greater than 100","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/PullRequestResource.java","lineNumber":259,"sourceCode":"\t@Path(\"/{requestId}/fixed-issue-ids\")\n    @GET\n    public Collection<Long> getFixedIssueIds(@PathParam(\"requestId\") Long requestId) {\n\t\tPullRequest pullRequest = pullRequestService.load(requestId);\n    \tif (!SecurityUtils.canReadCode(pullRequest.getProject())) \n\t\t\tthrow new UnauthorizedException();\n    \treturn pullRequest.getFixedIssueIds();\n    }\n\t\n\t@Api(order=1100)\n\t@GET\n    public List<PullRequest> queryPullRequests(\n    \t\t@QueryParam(\"query\") @Api(description=\"Syntax of this query is the same as in <a href='/~pulls'>pull requests page</a>\", example=\"to be reviewed by me\") String query, \n    \t\t@QueryParam(\"offset\") @Api(example=\"0\") int offset, \n    \t\t@QueryParam(\"count\") @Api(example=\"100\") int count) {\n\n\t\tvar subject = SecurityUtils.getSubject();\n\t\tif (!SecurityUtils.isAdministrator(subject) && count > RestConstants.MAX_PAGE_SIZE)\n    \t\tthrow new NotAcceptableException(\"Count should not be greater than \" + RestConstants.MAX_PAGE_SIZE);\n\n\t\tvar parsedQuery = PullRequestQuery.parse(null, query, true);\n    \t\n    \treturn pullRequestService.query(subject, null, parsedQuery, false, offset, count);\n    }\n\n\t@Api(order=1200)\n\t@POST\n    public Response createPullRequest(@NotNull PullRequestOpenData data) {\n\t\tUser user = SecurityUtils.getUser();\n\n\t\tProjectAndBranch target = new ProjectAndBranch(data.getTargetProjectId(), data.getTargetBranch());\n\t\tProjectAndBranch source = new ProjectAndBranch(data.getSourceProjectId(), data.getSourceBranch());\n\n\t\tif (!SecurityUtils.canReadCode(target.getProject()) || !SecurityUtils.canReadCode(source.getProject()))\n\t\t\tthrow new UnauthorizedException();\n\n\t\tPullRequest request = new PullRequest();","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/PullRequestResource.java#L241-L277","documentation":"queryPullRequests rejects any requested page size above RestConstants.MAX_PAGE_SIZE (100) for non-administrator subjects with a NotAcceptableException (HTTP 406-style). OneDev caps REST page sizes to protect the server from expensive query executions; only administrators may request larger counts.","triggerScenarios":"GET /~api/pull-requests?count=500 by a regular user; hardcoded page sizes over 100 in scripts or integrations; an admin wrote the script (worked), then a normal service account ran it.","commonSituations":"Pagination loops using count=1000; migration/export tools copying settings between instances; ported scripts from other APIs that allow big pages.","solutions":["Set count to 100 or less and paginate using the offset parameter (offset=0,100,200,...).","Run the query as an administrator account/token if large pages are truly required.","Update the integration's page-size constant to RestConstants.MAX_PAGE_SIZE (100)."],"exampleFix":"// before\nGET /~api/pull-requests?offset=0&count=1000\n// after\nGET /~api/pull-requests?offset=0&count=100\nGET /~api/pull-requests?offset=100&count=100","handlingStrategy":"validation","validationCode":"const MAX_PAGE_SIZE = 100\nif (!isAdmin && count > MAX_PAGE_SIZE) count = MAX_PAGE_SIZE\n// then paginate\nfor (let offset = 0; ; offset += count) { await query(offset, count) }","typeGuard":null,"tryCatchPattern":"try {\n  return await api.get(`/pull-requests?offset=${o}&count=${c}`)\n} catch (e) {\n  if (/Count should not be greater than/.test(e.message)) { c = 100; /* retry */ }\n  else throw e\n}","preventionTips":["Cap count at 100 in every OneDev REST integration.","Paginate with offset loops instead of large pages.","Document that only admins may exceed the page cap.","Centralize page-size as a shared constant."],"tags":["rest","pagination","validation","onedev"],"backgroundTag":"invalid-query-parameter","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}