{"record":{"id":"a8d3a69bd210f9fa","repo":"theonedev/onedev","slug":"cannot-create-access-token-for-disabled-user","errorCode":null,"errorMessage":"Cannot create access token for disabled user","messagePattern":"Cannot create access token for disabled user","errorType":"http","errorClass":"ExplicitException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenResource.java","lineNumber":76,"sourceCode":"\n\t@Api(order=150)\n\t@Path(\"/{accessTokenId}/authorizations\")\n\t@GET\n\tpublic Collection<AccessTokenAuthorization> getAuthorizations(@PathParam(\"accessTokenId\") Long accessTokenId) {\n\t\tvar accessToken = accessTokenService.load(accessTokenId);\n\t\tif (!isAdministrator() && !accessToken.getOwner().equals(getAuthUser()))\n\t\t\tthrow new UnauthorizedException();\n\t\treturn accessToken.getAuthorizations();\n\t}\n\t\n\t@Api(order=200, description=\"Create access token\")\n\t@POST\n\tpublic Long createToken(@NotNull @Valid AccessToken accessToken) {\n\t\tvar owner = accessToken.getOwner();\n\t\tif (!isAdministrator() && !owner.equals(getAuthUser()))\n\t\t\tthrow new UnauthorizedException();\n\t\telse if (owner.isDisabled())\n\t\t\tthrow new ExplicitException(\"Cannot create access token for disabled user\");\n\t\t\n\t\tif (accessTokenService.findByOwnerAndName(owner, accessToken.getName()) != null)\n\t\t\tthrow new ExplicitException(\"Name already used by another access token of the owner\");\n\t\t\t\n\t\taccessTokenService.createOrUpdate(accessToken);\n\n\t\tif (!getAuthUser().equals(owner)) {\n\t\t\tvar newAuditContent = VersionedXmlDoc.fromBean(accessToken.getFacade()).toXML();\n\t\t\tauditService.audit(null, \"created access token \\\"\" + accessToken.getName() + \"\\\" in account \\\"\" + owner.getName() + \"\\\" via RESTful API\", \n\t\t\t\t\tnull, newAuditContent);\n\t\t}\n\n\t\treturn accessToken.getId();\n\t}\n\n\t@Api(order=250, description=\"Update access token\")\n\t@Path(\"/{accessTokenId}\")\n\t@POST","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenResource.java#L58-L94","documentation":"createToken throws ExplicitException when the owner specified for the new access token is a disabled user account. Disabled accounts must not receive new credentials, so the endpoint rejects token creation even if the caller is an admin or the owner themselves.","triggerScenarios":"POST /~access-tokens (AccessTokenResource.createToken) where owner.isDisabled() returns true — the target user account has been deactivated in OneDev.","commonSituations":"Provisioning pipelines still referencing offboarded employees' accounts; users deactivated due to license limits or LDAP sync; bulk scripts that don't check account status before minting tokens.","solutions":["Re-enable the user account (Admin > Users) if the account should be active, then retry.","Create the token under a different, active user/service account.","Remove the disabled user from the provisioning configuration.","If the user was offboarded, stop attempting to create credentials for them."],"exampleFix":"// before: owner 'alice' is disabled\nPOST /~access-tokens  {\"owner\": {\"name\": \"alice\"}, ...}  -> ExplicitException\n// after: reactivate alice in Admin > Users, or use an active account\nPOST /~access-tokens  {\"owner\": {\"name\": \"alice-active\"}, ...}","handlingStrategy":"validation","validationCode":"const user = await getUser(ownerName);\nif (user.disabled) {\n  throw new Error(`User ${ownerName} is disabled; cannot create access token`);\n}","typeGuard":"function isEligibleOwner(user: { name: string; disabled: boolean }): boolean {\n  return !user.disabled;\n}","tryCatchPattern":"try {\n  await createToken(payload);\n} catch (e) {\n  if (/disabled user/.test(String(e.response?.data?.message ?? e.message))) {\n    // reactivate account or pick an active owner\n  } else throw e;\n}","preventionTips":["Check account status before provisioning credentials","Keep offboarded users out of provisioning configs","Sync your HR/offboarding data with your token-provisioning pipeline"],"tags":["rest","access-token","user-account"],"backgroundTag":"user-account-disabled","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}