{"record":{"id":"ab27f54028da9263","repo":"SonarSource/sonarqube","slug":"you-re-not-authorized-to-push-analysis-results-to","errorCode":null,"errorMessage":"You're not authorized to push analysis results to the SonarQube server. Please contact your SonarQube administrator.","messagePattern":"You're not authorized to push analysis results to the SonarQube server\\. Please contact your SonarQube administrator\\.","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/batch/ProjectDataLoader.java","lineNumber":88,"sourceCode":"  }\n\n  private List<FilePathWithHashDto> searchFilesWithHashAndRevision(DbSession session, @Nullable ComponentDto branchComponent) {\n    if (branchComponent == null) {\n      return Collections.emptyList();\n    }\n    return dbClient.componentDao().selectEnabledFilesFromProject(session, branchComponent.uuid());\n  }\n\n  private static void addFileData(ProjectRepositories data, List<FilePathWithHashDto> files) {\n    for (FilePathWithHashDto file : files) {\n      FileData fileData = new FileData(file.getSrcHash(), file.getRevision());\n      data.addFileData(file.getPath(), fileData);\n    }\n  }\n\n  private static void checkPermission(boolean hasScanPerm) {\n    if (!hasScanPerm) {\n      throw new ForbiddenException(\"You're not authorized to push analysis results to the SonarQube server. \" +\n        \"Please contact your SonarQube administrator.\");\n    }\n  }\n\n}\n","sourceCodeStart":70,"sourceCodeEnd":94,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/batch/ProjectDataLoader.java#L70-L94","documentation":"ProjectDataLoader.checkPermission verifies the submitting user holds the 'scan/provisioning' permission before accepting uploaded analysis data. Without it the loader refuses to import the report and throws ForbiddenException with this user-facing message. It prevents unauthorized pushes of analysis results to the server.","triggerScenarios":"A scanner or CI job authenticates with a token whose user lacks the Execute Analysis (scan) permission on the project, and posts to api/batch/project (internal batch endpoints).","commonSituations":"SonarQube upgrade from versions where scan permission was granted to Anyone; token created for a user who lost project permissions; CI service account not added to the project with Execute Analysis; externally managed instance revoking local permissions.","solutions":["Grant the 'Execute Analysis' permission to the CI user/group on the project (Project Settings > Permissions)","Regenerate the scanner token from an account that has Execute Analysis","If permissions come from a DevOps platform, sync/group membership there and re-authenticate","Check global 'Execute Analysis' permission if the project is not yet provisioned"],"exampleFix":"// before: scanner token of plain user\nSONAR_TOKEN=user-low-priv-token\n// after: token of account with Execute Analysis on the project\nSONAR_TOKEN=ci-service-account-token","handlingStrategy":"validation","validationCode":"// before pushing, verify permission:\nGET api/permissions/search?project=<key>&permission=scan — confirm the token's user appears","typeGuard":null,"tryCatchPattern":"try { loader.load(...); } catch (ForbiddenException e) { failBuild(\"Grant Execute Analysis to the CI account\"); }","preventionTips":["Use a dedicated CI account with Execute Analysis on all analyzed projects","After SonarQube upgrades, re-check permission templates (Anyone group changes)","Regenerate tokens from accounts whose permissions you control"],"tags":["java","sonarqube","permissions","authentication"],"backgroundTag":"permission-denied","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}