{"record":{"id":"e973b2b5b36fe883","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-e973b2","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"warning","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/ResumeAction.java","lineNumber":57,"sourceCode":"    this.systemPasscode = systemPasscode;\n    this.ceQueue = ceQueue;\n  }\n\n  @Override\n  public void define(WebService.NewController controller) {\n    controller.createAction(\"resume\")\n      .setDescription(\"Resumes pause of Compute Engine workers. Requires the system administration permission or \" +\n        \"system passcode (see \" + ProcessProperties.Property.WEB_SYSTEM_PASS_CODE.getKey() + \" in sonar.properties).\")\n      .setSince(\"7.2\")\n      .setInternal(true)\n      .setHandler(this)\n      .setPost(true);\n  }\n\n  @Override\n  public void handle(Request request, Response response) throws Exception {\n    if (!systemPasscode.isValid(request) && !userSession.isSystemAdministrator()) {\n      throw AbstractUserSession.insufficientPrivilegesException();\n    }\n\n    ceQueue.resumeWorkers();\n  }\n}\n","sourceCodeStart":39,"sourceCodeEnd":63,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/ResumeAction.java#L39-L63","documentation":"POST api/ce/resume resumes all paused Compute Engine workers and is restricted to callers with a valid system passcode or system-administrator authentication. Otherwise AbstractUserSession.insufficientPrivilegesException() throws 'Insufficient privileges'. It mirrors the pause endpoint's admin gating.","triggerScenarios":"Calling POST api/ce/resume without a valid system passcode and without system-administrator authentication.","commonSituations":"Automation resuming workers after maintenance using a non-admin token; missing or wrong system passcode; expired/revoked admin token; anonymous access.","solutions":["Authenticate with a token from a user who has Administer System permission.","Send the correct system passcode configured via sonar.systemPasscode on the server.","Grant the automation account the Administer System global permission.","Verify token validity and target server."],"exampleFix":"// before\ncurl -X POST http://sonar.example.org/api/ce/resume\n// after\ncurl -X POST -u myAdminToken: http://sonar.example.org/api/ce/resume","handlingStrategy":"validation","validationCode":"// verify credentials are admin-grade before resuming workers\ndef assertAdminAuth(session):\n    me = session.get(f'{SONAR_URL}/api/authentication/validate').json()\n    if not me.get('valid'):\n        raise ValueError('SonarQube token invalid or expired')","typeGuard":null,"tryCatchPattern":"try:\n    requests.post(f'{SONAR_URL}/api/ce/resume', headers=auth)\nexcept requests.HTTPError as e:\n    if e.response is not None and e.response.status_code == 403:\n        raise PermissionError('api/ce/resume requires system administrator privileges') from e\n    raise","preventionTips":["Rotate and validate admin tokens before maintenance windows.","Use the same credentials that successfully called api/ce/pause.","Grant Administer System only to the automation role that needs it.","Check response body for 'Insufficient privileges' to distinguish auth issues from server errors."],"tags":["sonarqube","webapi","authorization","compute-engine"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}