{"record":{"id":"a09e67f904711142","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-a09e67","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/branch/ws/ListAction.java","lineNumber":145,"sourceCode":"    builder.setExcludedFromPurge(branch.isExcludeFromPurge());\n    builder.setBranchId(branch.getUuid());\n    return builder;\n  }\n\n  private static void setBranchStatus(ProjectBranches.Branch.Builder builder, @Nullable MeasureDto qualityGateMeasure) {\n    ProjectBranches.Status.Builder statusBuilder = ProjectBranches.Status.newBuilder();\n    if (qualityGateMeasure != null) {\n      ofNullable(qualityGateMeasure.getString(ALERT_STATUS_KEY)).ifPresent(statusBuilder::setQualityGateStatus);\n    }\n\n    builder.setStatus(statusBuilder);\n  }\n\n  private void checkPermission(ProjectDto project) {\n    if (!userSession.hasEntityPermission(USER, project) &&\n        !userSession.hasEntityPermission(ProjectPermission.SCAN, project) &&\n        !userSession.hasPermission(SCAN)) {\n      throw insufficientPrivilegesException();\n    }\n  }\n}\n","sourceCodeStart":127,"sourceCodeEnd":149,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/branch/ws/ListAction.java#L127-L149","documentation":"ForbiddenException 'Insufficient privileges' from /api/branches/list when the current user has none of: User permission on the project, Scan permission on the project, or global Scan permission. At least one of these is required to see a project's branch list.","triggerScenarios":"Calling GET /api/branches/list?project=KEY as a user with no role on that project and no global scan permission; using a token of a user who was removed from the project; querying a private project.","commonSituations":"CI tokens without project roles; users added to a group that lost the project permission; SonarCloud projects where the token owner isn't a member of the organization/team.","solutions":["Grant the user 'User' (or at minimum 'Scan') permission on the project via Administration > Projects > Permissions.","Add the user/token owner to a group that has the project permissions.","Use a token belonging to a user with global Scan permission for CI-style reads.","Confirm the project key is correct and the permission applies to that exact project, not a sibling."],"exampleFix":"// before: user has no role on project\nGET /api/branches/list?project=my_proj  -> 403\n// after: in UI Administration > my_proj > Permissions, grant 'User' to ci-bot\nGET /api/branches/list?project=my_proj  -> 200","handlingStrategy":"validation","validationCode":"// shell: verify visibility before calling\nSTATUS=$(curl -s -o /dev/null -w '%{http_code}' -u \"$TOKEN:\" \"$SONAR/api/projects/show?project=$KEY\")\n[ \"$STATUS\" = \"200\" ] || echo \"no permission on project $KEY\"","typeGuard":null,"tryCatchPattern":"try {\n  branches = ws.get(\"/api/branches/list?project=\" + key);\n} catch (ForbiddenException e) {\n  log.warn(\"User lacks User/Scan permission on {}\", key);\n  throw e;\n}","preventionTips":["Provision CI users into a group included in project permission templates.","Verify token owner membership after org/team changes.","Use GET /api/permissions/groups?projectKey=K to audit effective grants."],"tags":["sonarqube","webapi","authorization","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}