{"record":{"id":"bdc757c0592c63ea","repo":"theonedev/onedev","slug":"count-should-not-be-greater-than-1000","errorCode":null,"errorMessage":"Count should not be greater than 1000","messagePattern":"Count should not be greater than 1000","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/BuildResource.java","lineNumber":135,"sourceCode":"\t@Path(\"/{buildId}/fixed-issue-ids\")\n    @GET\n    public Collection<Long> getFixedIssueIds(@PathParam(\"buildId\") Long buildId) {\n\t\tBuild build = buildService.load(buildId);\n    \tif (!SecurityUtils.canAccessProject(build.getProject())) \n\t\t\tthrow new UnauthorizedException();\n    \treturn build.getFixedIssueIds();\n    }\n\t\n\t@Api(order=600)\n\t@GET\n    public List<Build> queryBuilds(\n    \t\t@QueryParam(\"query\") @Api(description=\"Syntax of this query is the same as in <a href='/~builds'>builds page</a>\", example=\"\\\"Job\\\" is \\\"Release\\\"\") String query, \n    \t\t@QueryParam(\"offset\") @Api(example=\"0\") int offset, \n    \t\t@QueryParam(\"count\") @Api(example=\"100\") int count) {\n\n\t\tvar subject = SecurityUtils.getSubject();\n\t\tif (!SecurityUtils.isAdministrator(subject) && count > RestConstants.MAX_PAGE_SIZE)\n    \t\tthrow new NotAcceptableException(\"Count should not be greater than \" + RestConstants.MAX_PAGE_SIZE);\n\n    \tvar parsedQuery = BuildQuery.parse(null, query, true, true);\n\t\t\n    \treturn buildService.query(subject, null, parsedQuery, false, offset, count);\n    }\n\n\t@Api(order = 650)\n\t@Path(\"/{buildId}/description\")\n\t@POST\n\tpublic Response setDescription(@PathParam(\"buildId\") Long buildId, String description) {\n\t\tBuild build = buildService.load(buildId);\n\t\tif (!SecurityUtils.canManageBuild(build))\n\t\t\tthrow new UnauthorizedException();\n\t\tvar oldDescription = build.getDescription();\n\t\tif (!Objects.equals(oldDescription, description)) {\n\t\t\tbuild.setDescription(description);\n\t\t\tbuildService.update(build);\n\t\t\tauditService.audit(build.getProject(), \"updated description of build \\\"\" + build.getReference().toString(build.getProject()) + \"\\\" via RESTful API\", oldDescription, description);","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/BuildResource.java#L117-L153","documentation":"OneDev's REST endpoint GET /builds (queryBuilds) throws NotAcceptableException with 'Count should not be greater than 1000' when a non-administrator caller passes a count parameter exceeding RestConstants.MAX_PAGE_SIZE (1000). Administrators bypass the cap. This is a server-side pagination guard to protect the API from very large page requests.","triggerScenarios":"GET /~api/builds?count=2000 (or any count > 1000) called by a non-admin user/token. Counts of 1000 or less succeed regardless of who calls.","commonSituations":"Scripts that hardcode large page sizes assuming unlimited paging; migrating scripts from other APIs with permissive limits; copying example requests that used admin accounts.","solutions":["Reduce the count parameter to 1000 or less and paginate with offset (count=1000, offset=0, then offset=1000, ...)","Use an administrator account/token if you truly need pages larger than 1000","Loop with increasing offsets until fewer than `count` results are returned"],"exampleFix":"// before\nGET /~api/builds?count=5000&offset=0\n// after\nGET /~api/builds?count=1000&offset=0\nGET /~api/builds?count=1000&offset=1000  // repeat until empty page","handlingStrategy":"validation","validationCode":"const MAX_PAGE_SIZE = 1000;\nfunction validatePage(count, offset = 0) {\n  if (!Number.isInteger(count) || count < 1 || count > MAX_PAGE_SIZE)\n    throw new Error(`count must be 1..${MAX_PAGE_SIZE} for non-admin users`);\n  if (offset < 0) throw new Error('offset must be >= 0');\n  return {count, offset};\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Cap client-side page size at 1000 (RestConstants.MAX_PAGE_SIZE)","Paginate with offset instead of requesting huge pages","Request larger pages only when running under an administrator token"],"tags":["rest","pagination","onedev","validation"],"backgroundTag":"value-out-of-range","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}