{"record":{"id":"cb7c005d428d3694","repo":"theonedev/onedev","slug":"not-authorized-cb7c00","errorCode":null,"errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/AgentTokenResource.java","lineNumber":56,"sourceCode":"\tprivate final AgentTokenService tokenService;\n\t\n\tprivate final AgentService agentService;\n\t\n\tprivate final AuditService auditService;\n\t\n\t@Inject\n\tpublic AgentTokenResource(AgentTokenService tokenService, AgentService agentService, AuditService auditService) {\n\t\tthis.tokenService = tokenService;\n\t\tthis.agentService = agentService;\n\t\tthis.auditService = auditService;\n\t}\n\n\t@Api(order=100)\n\t@Path(\"/{tokenId}\")\n    @GET\n    public AgentToken getToken(@PathParam(\"tokenId\") Long tokenId) {\n    \tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n    \treturn tokenService.load(tokenId);\n    }\n\n\t@Api(order=100, description=\"Get agent using specified token\")\n\t@Path(\"/{tokenId}/agent\")\n    @GET\n    public Agent getAgent(@PathParam(\"tokenId\") Long tokenId) {\n    \tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n\t\tAgentToken token = tokenService.load(tokenId);\n    \treturn agentService.findByToken(token);\n    }\n\t\n\t@Api(order=200)\n\t@GET\n    public List<AgentToken> queryTokens(@QueryParam(\"value\") String value, \n    \t\t@QueryParam(\"offset\") @Api(example=\"0\") int offset, \n    \t\t@QueryParam(\"count\") @Api(example=\"100\") int count) {","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/AgentTokenResource.java#L38-L74","documentation":"getToken in AgentTokenResource loads an agent token record by id and is restricted to server administrators. Non-admin authenticated users receive UnauthorizedException ('Not authorized'). Agent tokens are secrets used to register agents, hence admin-only.","triggerScenarios":"GET /~api/agent-tokens/{tokenId} with credentials of a non-administrator user.","commonSituations":"Auditing agent registration tokens with a regular user token; automated scripts whose account lost admin role after a permissions cleanup.","solutions":["Use a server administrator token","Grant the caller server administrator role","Create/manage agent tokens from the administration web UI instead"],"exampleFix":"// before\nGET /~api/agent-tokens/3  (regular user token)\n// after\nGET /~api/agent-tokens/3  (Authorization: Bearer <admin-token>)","handlingStrategy":"validation","validationCode":"if (!serverAdmin) throw new IllegalStateException(\"Fetching agent tokens requires server administrator\");","typeGuard":null,"tryCatchPattern":"try { AgentToken t = client.getAgentToken(id); } catch (ForbiddenException e) { log.warn(\"Admin token required\"); }","preventionTips":["Use an admin-only token for token audits","Keep agent token management inside the admin UI","Rotate credentials when admin roles change"],"tags":["rest-api","authorization","agent-token","admin-only"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}