{"record":{"id":"b4679fc4cb6a8fb8","repo":"theonedev/onedev","slug":"not-authorized-b4679f","errorCode":null,"errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/WorkspaceResource.java","lineNumber":104,"sourceCode":"\t\t\t@QueryParam(\"query\") @Api(description=\"Syntax of this query is the same as in <a href='/~workspaces'>workspaces page</a>\", example=\"active\") String query,\n\t\t\t@QueryParam(\"offset\") @Api(example=\"0\") int offset,\n\t\t\t@QueryParam(\"count\") @Api(example=\"100\") int count) {\n\t\tvar subject = SecurityUtils.getSubject();\n\t\tif (!SecurityUtils.isAdministrator(subject) && count > RestConstants.MAX_PAGE_SIZE)\n\t\t\tthrow new NotAcceptableException(\"Count should not be greater than \" + RestConstants.MAX_PAGE_SIZE);\n\n\t\tvar parsedQuery = WorkspaceQuery.parse(null, query, true);\n\n\t\treturn workspaceService.query(subject, null, parsedQuery, offset, count);\n\t}\n\n\t@Api(order=300, description=\"Create new workspace\")\n\t@POST\n\tpublic Long createWorkspace(@NotNull @Valid WorkspaceCreateData data) {\n\t\tvar subject = SecurityUtils.getSubject();\n\t\tvar user = SecurityUtils.getUser(subject);\n\t\tif (user == null)\n\t\t\tthrow new UnauthorizedException();\n\n\t\tProject project = projectService.load(data.getProjectId());\n\t\tif (!SecurityUtils.canCreateWorkspaces(subject, project))\n\t\t\tthrow new UnauthorizedException();\n\n\t\tif (project.getHierarchyWorkspaceSpecs().stream()\n\t\t\t\t.noneMatch(it -> it.getName().equals(data.getSpecName()))) {\n\t\t\tthrow new NotAcceptableException(\"Workspace spec not found: \" + data.getSpecName());\n\t\t}\n\n\t\tObjectId commitId = ObjectId.fromString(data.getCommitHash());\n\t\tvar commit = project.getRevCommit(commitId, false);\n\t\tif (commit == null) \n\t\t\tthrow new NotAcceptableException(\"Commit not found: \" + data.getCommitHash());\n\n\t\tIssue issue = null;\n\t\tif (data.getIssueId() != null) {\n\t\t\tissue = issueService.get(data.getIssueId());","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/WorkspaceResource.java#L86-L122","documentation":"createWorkspace throws UnauthorizedException when there is no authenticated user on the request subject. Workspace creation requires a real user identity; anonymous or token-less requests cannot create workspaces. This is the first of two authorization checks in the endpoint.","triggerScenarios":"POSTing to /workspaces without credentials, or with a token/job credential that does not resolve to a User (SecurityUtils.getUser(subject) returns null).","commonSituations":"Calling the API with a malformed or revoked access token; missing Authorization header in a script; using a machine credential that authenticates but carries no user identity.","solutions":["Send a valid Authorization header with a personal access token of a real user","Verify the token works via GET /users/me before calling the endpoint","Re-generate the access token if it was revoked or expired"],"exampleFix":"// before\npost(\"/workspaces\", data); // no auth\n// after\npost(\"/workspaces\", data, auth: bearerToken(userAccessToken));","handlingStrategy":"validation","validationCode":"User me = tryGetAuthenticatedUser(); if (me == null) throw new IllegalStateException(\"no valid credentials\");","typeGuard":"boolean hasUserIdentity(Subject s) { return SecurityUtils.getUser(s) != null; }","tryCatchPattern":"try { createWorkspace(data); } catch (UnauthorizedException e) { throw new ConfigurationException(\"invalid or missing access token\"); }","preventionTips":["Always attach a valid user access token to API calls","Validate tokens with GET /users/me before workflows","Rotate tokens before expiry and never strip the Authorization header"],"tags":["rest-api","authorization","workspace"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}